I was researching AI based fraud detection for documents and came across a product called Diro.
Their claim immediately stood out: "Documents fetched directly from the source, not uploaded." Naturally, I assumed this meant official APIs from banks or government systems.
After digging deeper, I realized the approach is very different.
Instead of APIs, a virtual browser is spun up on their infrastructure and mirrored into your browser UI. You log in there, not on your own device. The environment is tightly locked down. No tab switching, no developer tools, no inspection.
Technically, this means credentials are entered into a browser you do not control. That browser is likely forked from an open source base with custom code layered on top. At that point, you are trusting not just the platform, but every modification made to that browser.
From a banking perspective, this is where feasibility becomes questionable. Banks explicitly say never share credentials. They do not endorse this model. At best, it is tolerated. If fraud occurs, liability shifts to the user.
This approach exists because APIs do not. It is legal with consent and useful for one-time, low-risk verification, but it remains a trust-based workaround rather than true source-level integration.
That distinction matters when real money is involved.