No. Never hand anyone your bank account username and password. A legitimate loan processor doesn't need your login credentials to do their job. What is normal, and increasingly common, is being asked to connect your accounts through a secure service like Plaid, the same read-only connection budgeting apps use. You type your password into your bank's own login screen, the lender gets authorization to verify assets and monitor balances during the process, and they never see or store your password. That's a legitimate, safe part of modern loan origination. The bright line: a secure, read-only authorization made through your bank's own login screen is fine. Anyone asking you to email or text your actual username and password is asking for something no legitimate process requires, and that request is worth stopping on. If a processor asks for raw credentials, decline. Ask them to send the secure verification link instead, or offer your bank statements directly. Protecting your login protects you from both fraud and liability, so hold that line no matter how routine they make it sound.