What Upside does and how it accesses your account
Upside is a cashback app that connects to your bank account or debit card to track your spending and offer rewards at partner merchants. The app uses read-only access, meaning it can see your transaction history but cannot move money, change passwords, or make purchases on your behalf. It does not store your actual login credentials — instead, it uses a third-party connection service (usually Plaid or a similar aggregator) to read your transaction data.
The connection works like this: you authorize Upside to view your account through that intermediary service, which acts as a secure tunnel between your bank and the app. Your bank login details stay with your bank. Upside sees only the transactions it needs to match against their partner retailers and calculate your cashback.
That said, linking any app to your bank account carries real risks if something goes wrong — not because Upside itself is malicious, but because a compromised connection or a data breach at any point in the chain could expose your transaction history or banking details. The question is whether Upside's security practices and the protections available to you make that risk acceptable.
Key Takeaways
- Upside uses read-only access through a third-party connection service, so it cannot move money or change your account settings.
- Your bank login credentials are not shared with Upside; they stay with your bank and the intermediary service.
- If your Upside account is hacked, the attacker sees your transaction history but cannot access your bank account directly.
- You can revoke Upside's access to your bank account at any time through your bank's app or settings, which stops all data sharing immediately.
- Upside is a private company and not FDIC-insured, so if the company fails, your cashback balance may not be recovered.
How the connection protects your actual bank account
The biggest protection is that Upside never receives your login credentials. When you authorize the connection, you are not handing over your username and password. Instead, you are granting permission through an intermediary — Plaid, Finicity, or another aggregator — that your bank recognizes and trusts. Your bank then allows that intermediary to share read-only data with Upside.
Because Upside has no login access, a breach of Upside's servers cannot give an attacker the keys to your bank account. They would see your transaction history (which is sensitive but not catastrophic) but could not log in, move money, or change your account details. Your bank's own security — your password, two-factor authentication, and fraud monitoring — remains intact.
You can also disconnect Upside from your bank instantly. Log into your bank's app or website, find the connected apps or third-party access section, and revoke Upside's permission. The connection stops immediately, and Upside loses access to any new transactions. This is different from deleting the Upside app itself — deleting the app does not automatically revoke the bank connection, so you need to do both.
Real risks: data breach, account takeover, and company failure
Upside stores your transaction history on its servers. If Upside is hacked, that data — which includes merchant names, amounts, dates, and sometimes location — could be exposed. This is not as bad as exposing your login credentials, but it is still sensitive information that could be used for targeted phishing, identity theft, or social engineering attacks against you.
A second risk is account takeover at Upside itself. If someone gains access to your Upside account (through a weak password, phishing, or a breach of Upside's user database), they can see all your transaction history and potentially change your account settings or claim your cashback balance. This does not give them access to your bank account, but it is still a problem worth preventing — use a strong, unique password for Upside and enable two-factor authentication if the app offers it.
A third risk is company failure. Upside is a private company, not a bank, and your cashback balance is not FDIC-insured. If Upside runs out of money or shuts down, there is no may provide you will be able to withdraw your accumulated cashback. This is a smaller risk for a well-funded company, but it is not zero.
What to check before you link your account
Before authorizing the connection, verify that you are using the official Upside app from the Apple App Store or Google Play Store — not a fake app or a link from an email or text message. Scammers sometimes create lookalike apps that steal login credentials. Check the developer name (it should be Upside Services Inc.) and read recent reviews for warnings about phishing or fraud.
Once you have the real app, check Upside's privacy policy and terms of service. Look for statements about how long they keep your transaction data, whether they sell it to third parties, and what happens to your data if you delete your account. Upside's policy should say they do not sell your personal information to advertisers, though they may use it to improve their own service.
Also check which intermediary service Upside uses to connect to your bank. During the authorization process, you should see the name of the service (Plaid, Finicity, or another) before you log in. If you do not recognize the name or it seems suspicious, stop and research it first. Legitimate aggregators are well-known and have their own security certifications.
How to revoke access and protect yourself going forward
To disconnect Upside from your bank, open your bank's mobile app or website and look for a section called "Connected Apps," "Third-Party Access," "App Permissions," or "Authorized Apps." The exact name varies by bank. Find Upside in the list and select "Revoke," "Disconnect," or "Remove." Your bank will confirm the action, and Upside will lose access within minutes.
You can also contact your bank's customer service and ask them to revoke third-party access to your account. They can do it for you, though it may take a business day to process.
To protect yourself while using Upside, use a strong password that you do not use anywhere else — a random mix of at least 12 characters including uppercase, lowercase, numbers, and symbols. Enable two-factor authentication on your Upside account if available. Do not click links in emails or texts claiming to be from Upside; instead, open the app directly or go to Upside's official website. Monitor your bank account regularly for unauthorized transactions, and set up fraud alerts with your bank if you are concerned.
Comparing Upside to other cashback apps
Most cashback apps use the same connection model as Upside — read-only access through a third-party aggregator. Apps like Rakuten, Fetch Rewards, and Ibotta all work similarly. The main differences are in what data they collect, how they use it, and how much cashback they offer.
Some apps (like Rakuten) do not require a bank connection at all — they work through your credit card or by scanning receipts. This eliminates the bank-linking risk entirely, though you lose the automatic transaction matching. Others (like Fetch) only ask for receipt photos, which is even lower risk. If you want cashback but are uncomfortable linking your bank account, these alternatives are worth considering.
If you do link your bank to an app, the security of that app matters less than the security of your bank itself. Your bank's fraud protections, two-factor authentication, and monitoring are your real safety net. The app is just a window into your data — it cannot override your bank's security.
Frequently Asked Questions
Can Upside move money out of my bank account?
No. Upside has read-only access, which means it can see your transactions but cannot initiate transfers, make purchases, or change account settings. Even if Upside is hacked, the attacker cannot move your money because they do not have login access to your bank.
What happens to my data if I delete the Upside app?
Deleting the app does not automatically disconnect it from your bank. You must revoke access separately through your bank's connected apps section. Once you do, Upside stops receiving new transaction data, but they may keep the data they already collected unless you request deletion.
Is Upside safer than giving my login to a cashback app directly?
Yes, significantly. Apps that ask for your actual bank login credentials are much riskier because they can do anything your login allows — move money, change passwords, or access other accounts if you reuse the password. Upside's read-only model through an intermediary is much safer.
What should I do if I think my Upside account was hacked?
Change your Upside password immediately and enable two-factor authentication if you have not already. Revoke Upside's access to your bank account. Check your bank account for unauthorized transactions and contact your bank if you find any. Monitor your credit report for signs of identity theft.
Can I get my cashback back if Upside shuts down?
Probably not. Upside is not a bank and your cashback is not insured. If the company fails, your balance may be lost. This is a small risk for a well-funded company, but it is worth keeping in mind if you accumulate a large balance.