25 October 2023

[By email: data@treasury.gov.au](mailto:data@treasury.gov.au)

Consumer Data Right Policy and Engagement Branch
Market Conduct and Digital Division
Treasury
Langton Cres
Parkes ACT 2600

Dear Sir/Madam

**RE: Screen Scraping – policy and regulatory implications**

Difrent Rental Pty Ltd (‘Difrent’) appreciates the opportunity to provide feedback to the Department
of Treasury on the topic of whether credit providers’ utilisation of “screen scraping” technologies to
obtain bank statement information from consumers should be banned, and replaced with utilisation
of the Consumer Data Right (‘CDR’) to obtain this information.

**Introduction & overview of Difrent’s current bank statement document acquisition processes**

Difrent holds an Australian Credit License and is a consumer lease provider of technology items,
mobile devices, home appliances and furniture. It has been offering these services since November
2018 through a “virtual” model, in which consumers engage with Difrent by telephone and online. If
the consumer is approved, Difrent arranges for the items that are the subject of the lease to be
supplied directly to the consumer by retail partners.

Difrent has obtained electronic bank statements from its applicants since the business’s
commencement. Difrent has always viewed this process as the most efficient and accurate way in
which to meet its credit license obligation to verify a consumer’s financial situation. In any event the
requirement for consumer lease providers to review bank statement documents was recently codified
to law under the Financial Sector Reform Act 2022 (Cth).

Difrent is aware that there are multiple service providers that facilitate the supply of bank statement
information between applicants and consumer credit providers. Difrent has only ever used one such
service provider. At the time of Difrent’s operational commencement that business was known as
bankstatements.com.au; it has since been acquired by the credit bureau Illion and is branded with
that same name.

Difrent has only ever utilised screen scraping technology for “read access”. None of the processes
undertaken with its applicants, or supplied via Illion, provide any right or ability for “write access”.
Difrent do not consider that “write access” would ever be required by, or appropriate for, a consumer
lessor. Accordingly comments in this submission that relate to Difrent’s use of electronic bank
statement services apply only to those supplied by Illion.


-----

The following are critically important to the process of bank statements being supplied by applicants
to Difrent via the Illion service:

The process is secure for the applicant

-  At no time is the applicant’s login credentials for their financial institution/s provided to
Difrent, or entered into screens on Difrent’s website properties.

-  Applicants supply the information on Illion owned and controlled website properties. Being a
credit bureau in addition to providing electronic bank statement services, Illion is highly
experienced and credentialed in working with sensitive and personal consumer data.

-  As described on Illion’s frequently asked questions page, _“All data sent to our server is_
_encrypted with 256-bit encryption, secured by 2048-bit keys. This is the same level of_
_encryption that the banks use”[1]._

-  Information is transmitted from Illion to Difrent via secure, online file transfer protocols.

-  No write access is provided to a consumer’s bank accounts.

Statements for all accounts held with a particular financial institution are supplied to Difrent

-  In order for Difrent to meet its credit license obligation to verify a consumer’s financial
situation, it is imperative that information for all active bank accounts are supplied by the
applicant.

-  Consumers are advised in an on-screen message prior to completing their financial institution
login “please note that once you submit your details, statements for all bank accounts will
_automatically be retrieved and submitted”._

-  In Difrent’s experience, applicants rarely hold 1 bank account. More commonly, multiple bank
accounts within the same financial institution are maintained by an applicant, with different
accounts used for different purposes.

-  The automatic supply of statements for all accounts held by an applicant with a particular
financial institution (in addition to a Centrelink statement, if relevant) ensures Difrent can
consider the full range of that applicant’s income and expenditure. This is necessary to reach
a view of whether the applicant has the capacity to meet the financial obligations of a
prospective consumer lease.

Difrent has reviewed screenshots of the CDR and compared them to the steps currently undertaken
by applicants using the Illion electronic bank statement service. Difrent has some general concerns in
respect of:

-  the number of screens that must be navigated by a consumer using the CDR compared to
existing bank statement platforms; and

-  the less streamlined process of supplying Centrelink and financial institution statements using
the CDR compared to the existing bank statement platforms.

However, there is a far larger potential issue that would be caused by screen scraping technologies
being replaced by the CDR in its current form. For the sake of importance, Difrent’s submission will
focus entirely on this other issue.

1 https://www.bankstatements.com.au/about/faq


-----

**Unavoidable conflict between the CDR and consumer lessors meeting their credit license obligations**

At its core, the CDR offers consumers a choice of the information they consent to sharing with data
recipients. In screenshots sighted by Difrent, this includes the consumer selecting which accounts from
their financial institution they consent to having transaction information shared.

Unfortunately, this presents an unavoidable conflict to the obligations that consumer lessors must
meet under their credit license.

In order to verify a consumer’s financial situation in full, it is axiomatic that a consumer lessor review
transaction information for all accounts held by a consumer with a particular financial institution. It is
simply not possible to reach a decision that a prospective consumer lease is not unsuitable for a
consumer if information for only a portion of an applicant’s income and/or expenditure is supplied to
the consumer lessor.

It is very common for consumers to have multiple bank accounts with a financial institution and to use
these different accounts for different purposes. Difrent recently reviewed a large sample of bank
statement submissions from its applicants. The sample demonstrated:

-  Applicants held an average of 3 accounts with their financial institution;

-  Only 20% of applicants held a single account with their financial institution;

-  28% of applicants held 2 accounts with their financial institution;

-  27% of applicants held 3 accounts with their financial institution; and

-  25% of applicants held more than 3 accounts with their financial institution.

Furthermore, based on transaction descriptions, Difrent identified that approximately 25% of
applicants also held accounts with a second financial institution.

As outlined earlier in this submission, Illion’s electronic bank statement service supplies to Difrent
transaction information for all accounts held by a consumer.

Applicants are advised prior to completing the process that statements for all accounts will be supplied
to Difrent. At this point, the applicant has the choice to not proceed, which would result in their
application expiring on Difrent’s system. However, should the consumer wish to continue, they do not
have a choice of which accounts are sent. This is because Difrent could not complete an unsuitability
assessment, as required under its credit license, unless transaction information for all bank accounts
was supplied.

Therein lies the conflict between the CDR and consumer lessors’ credit license obligations:

-  consumer lessors must receive information for all accounts in order to verify a consumer’s
financial situation; but

-  giving consumers a choice of which accounts to share information for is an inherent
component of the CDR, and Difrent are certain that a large proportion of applicants will
**exercise this choice and not consent to information for some of their accounts being shared.**

It is very important to acknowledge that consumers do not have a working knowledge of credit
licensee obligations, or the reasons why a consumer lessor may require certain information. This has


-----

been regularly demonstrated to Difrent in various interactions with prospective and existing
applicants for Difrent’s services.

Difrent regularly receive enquires from consumers by phone or online of whether they can simply
send in payslips when applying for a consumer lease rather than supplying full account statements.

Difrent also regularly need to explain to applicants who have accounts with multiple financial
institutions the reasons why Difrent need to obtain the account transaction information for the second
financial institution as well. Responses given by these consumers helps to inform the limited
understanding that consumers have about the information credit providers must rely on to meet their
responsible lending obligations.

These responses include comments like “but my pay doesn’t go to those accounts”, “I just use those
_accounts for savings” or “I just pay my Afterpay through those accounts”, implying that the applicant_
believes the transactions on these other accounts are not pertinent to their application for a consumer
lease.

Given Difrent’s experience, set out above, it is reasonable to expect that under the CDR consumers
will apply all of these types of reasonings, ill-informed as they may be, to withhold certain bank
account transaction when given the choice to do so.

Some applicants will also withhold sharing accounts with transaction information that they consider
to be embarrassing for one reason or another, even if the nature of these transactions would not
actually negatively impact their likelihood to be approved for a consumer lease.

There are also more nefarious reasons why, given the opportunity, applicants may withhold sharing
information for certain bank accounts. Difrent regularly encounter bank statement documents that
demonstrate good financial conduct on several accounts held with the financial institution by the
applicant but a final, “zombie”, account that is:

-  not in use by the applicant; and

-  which other credit providers are attempting (and failing) to draw direct debits from.

These are typically the accounts that a consumer’s income was formerly paid into, and the consumer
either has not supplied the credit provider with updated account details for ongoing direct debits, or
is actively seeking to avoid paying the credit provider.

Regardless of whether:

-  a consumer excludes transaction information due to an incorrect belief that it may not be
relevant; or

-  the information is not shared by the consumer in an attempt to improve their likelihood of
being approved

there is clearly a great likelihood that use of the CDR in its current form will result in consumer lease
providers very often receiving only a partial summary of an applicant’s financial situations.

Difrent is also of the view that simply adding information in the customisable launch screen for the
CDR, advising users of the requirement to share information for all active accounts, will not ensure a
high rate of full account information being shared by consumers. Instructions are often not read in full


-----

by online users, and to most everyday consumers it would seem counterintuitive to be given the
option to exclude individual accounts in the first place if there was a strict requirement that
information for all accounts be sent.

Difrent similarly does not feel that these problems will be easily resolved by direct follow up with
consumers who have not initially supplied information for all of their bank accounts, for the following
reasons:

1. There will be a significant increase in operating costs for consumer lessors such as Difrent to

conduct follow up activities – so much so that it may make ongoing operations unviable;

2. There are difficulties involved in successfully contacting applicants after they have disengaged

from the application process. People work and have other daily commitments that may cause
them to be unavailable to accept phone calls, others will not accept calls from numbers they
do not recognise, and SMSs and emails may never be read or may be treated as promotional
or junk mail by a consumer’s mail server; and

3. In the case that Difrent successfully reach an applicant to request information for accounts

that had not previously been supplied now be submitted, it would be entirely expected that
the applicant may react unfavourably to the request. By providing the consumer a choice
initially to exclude accounts from having been sent, it will be difficult to justify to the consumer
why this choice is no longer available to them.

Difrent has real-life experience in the difficulties involved in reaching applicants to supply additional
financial information. As set out earlier in this submission, approximately 25% of applicants that supply
bank statement documents to Difrent hold accounts with a second financial institution. Difrent
attempts to contact these applicants by a combination of phone, email and/or SMS. Statement
information for these consumers’ second financial institution are subsequently supplied to Difrent less
**than 10% of the time. That is, out of 100 sets of bank statement documents currently received,**
approximately 25 will show evidence of the consumer holding accounts with a second financial
institution, and of these 25 consumers less than 3 will ultimately provide account transaction
document for this second financial institution.

Difrent would expect similarly low rates of applicants subsequently supplying account transaction
information in cases where this information was previously withheld by consumers. This is a
foreboding statistic for the potential impact to the operations of consumer lessors such as Difrent if
the CDR in its current form was to be the only source from which to verify a consumer’s financial
situation.

**Conclusion and recommendations**

There is an obvious conflict between the way in which the CDR currently operates and the
requirements that consumer lessors must meet under their credit license obligations. It is
contradictory to:

-  require consumer lease providers to utilise bank statement documents to verify a consumer’s
financial situation as part of an unsuitability assessment; and to

-  separately legislate that the only electronic method for consumers to supply this information
is one that actively encourages consumers to consider whether to only provide limited bank
transaction data to the consumer lease provider.


-----

There is also a secure, working alternative already in place, in the form of technologies offered by
service providers such as Illion.

In light of this, Difrent submit that the **CDR in its current form is not fit for purpose for the consumer**
**lease industry.**

Difrent trust that Treasury and other stakeholders appreciate the enormous difficulties and
disadvantages that would be placed on consumer lessors to meet their credit license obligations if
technologies other than the CDR were banned from use.

A potential solution would be for the CDR to be adapted, so that consumers were not provided the
option to select which bank account information was to be shared, and which was to be excluded, in
cases where the data was to be used specifically for a credit assessment.

Until then, and in the absence of the CDR being fit for purpose, **Difrent recommend that existing**
**technologies such as Illion’s remain available for use by consumer lease providers (and credit**
providers generally, to which the same circumstances apply) to enable credit license obligations to
continue to be met.

Adam Goldfain
**Managing Director**
**Difrent Rental**


-----

