Start here
The free tool below runs entirely in this browser — no account, nothing stored or transmitted. Redact anything you would not want kept before you type it.
Open the companion tool →Why revocability is the comparison that matters
Every service in this category needs account visibility, so 'it can see my bills' is not the differentiator. The differentiator is how that visibility was granted. A token-based authorization can be scoped to specific accounts and specific data and cut off from your own provider's dashboard; a stored username and password grants whatever the login grants, including changes you never authorized, and revoking it means changing your password and hoping nothing was copied.
Then there is the onward path. A service holding credentials may retain data after you cancel, may share it with partners, and may itself be breached. Ask what data it keeps, for how long, whether your data improves or trains its products, and who its partners are — and get the answers in writing before you connect, not after.
The protocol
- Find how it connects: an aggregator or token-based authorization you approve in a popup, or your username and password typed into the service's own form.
- Check the scope: which accounts, which data (balances, transactions, or the ability to act), and whether it can move money or only read it.
- Look for the revoke path in your own bank or provider dashboard — an authorized apps, connected services, or third-party access list — and confirm the connection appears there.
- Ask three questions in writing: what data do you retain, for how long, and do you use my data to train or improve products or share it with partners?
- Prefer read-only. If the service needs to act — to dispute a bill or cancel a subscription — ask whether it can do that through a scoped authorization or a one-time confirmation instead of holding your login.
- If you already gave a password, change it now, turn on multi-factor authentication, and revoke the connection from your provider's dashboard rather than only inside the service.
What the tool does
Describe what a bill-negotiating or money-saving service asked for and how it connects, and get a scope reading: what that access grants, what it can do without you, and how to revoke it. It runs in this browser; nothing is sent or stored.
Limit first: This is an access-scope aid, not a security audit of any company, and it cannot confirm what a service does with your data or whether it is safe. It can miss a risky connection and it can flag an ordinary one.
Open the companion tool →One human next step
If the service made a change you did not authorize or you cannot get it disconnected, contact your bank or provider directly using the number on your statement and ask them to revoke the connection and reverse the change; then file a complaint with the CFPB and report it to the FTC. If money moved, treat it as fraud and call the institution's fraud line today.
Research log and safety checks
AI-assist path: not used for a verdict. The reading sorts connection methods and the retention answers the reader collects; whether a vendor's systems are secure is not something any model can verify from a marketing page, and claiming otherwise would fail §1.2 UIC-10. §6.9 disclosed: the achievable assist is reading the service's own authorization screen, which the reader has and the tool does not — so the tool supplies the classification and the questions instead. §6.10: not a frontier-pace topic; no agent-misalignment incident or capability-acceleration claim is cited.
§0.5 protection result: category is financial-agent-exposure; crisis-adjacent: no; fear/urgency/scarcity toolkit used: no. The protective function is free and the paid feature is convenience only.