Robins Kaplan.

Correction: An earlier version of this story characterized Visa's pending acquisition of Plaid as final. 

Venmo and Cash App users are suing a financial technology company for allegedly creating one of the largest databases of transactional data in history "through a decade-long campaign of lies and deceit," according to a lawsuit in California federal court.

In a class action complaint filed in the U.S. District Court for the Northern District of California Thursday, attorneys from Robins Kaplan assert that Plaid Inc., a service that connects payment apps to banks, has violated the privacy rights of millions of consumers.

"Imagine there is a company that knows every dollar you deposit or withdraw, every dollar you charge or pay to your credit card, and every dollar you put away for retirement, within hours after you make the transaction," wrote a team of Robbins Kaplan attorneys led by Michael Ram in Mountain View, California. "Imagine that, as far as you know, you never provided your username and password to this company or otherwise authorized it to access your online accounts. Imagine you never heard of this company at all. That company exists. It is called Plaid. And this is exactly what it does."

Plaid, which Visa announced plans to acquire in January, said in an email statement that the lawsuit is baseless and the company plans to vigorously defend itself.

"Plaid does not sell and has never sold consumers' personal information or data," said a spokesperson for Plaid. "Consumer data is obtained and used with consumer consent. We believe strongly that consumers should have permission-based access to and control over their financial data, and embody these principles in our practices."

The complaint contends that, after connecting consumers' payment apps to their banks, Plaid stores their credentials and uses them to collect five years worth of transactional data and continues to track users' data going forward. Plaintiffs claim that the data-gathering scheme is not incidental to the company's business model, and in fact, it is Plaid's "very purpose." 

"Plaid's scheme is a bait and switch—a sophisticated imitation of the logos and branding of major financial institutions, designed to fool users into thinking that they are interacting directly with their banks when in fact they are interacting only with Plaid," the lawsuit asserts. "After Plaid has gathered reams of a user's sensitive personal data, Plaid aggregates the data with that of millions of other users, chops it up,and sells it to the highest bidder."

In addition to damages, the payment app users are asking the court to order Plaid to stop illegally downloading consumers' financial information and disgorge users credentials and profits acquired from its data gathering. 

The complaint brings 10 causes of action against Plaid, including common law invasion of privacy, violation of the Stored Communications Act and negligence.

A key tool in its ability to deceptively get hold of the credentials, the lawyers wrote, is the company's version of OAuth, the tech industry's standard verification process that asks users to give permission for a platform to funnel information to another website or app without storing login data. Plaid's version, "Managed OAuth," does not use a separate dialogue box disclosing the permissions and it does store usernames and passwords, according to the complaint. 

"Plaid achieves this fraud by erecting a sophisticated edifice of deceit to trick users into thinking that they are logging into their financial institutions, when in fact they are turning over their credentials to Plaid," plaintiffs allege in the complaint.

Payment app users also argue that they suffered economic damages from loss of control of valuable information. Visa announced a deal to acquire the fintech company in January for $5.3 billion, "based in no small part on the universe of consumers that Plaid has accumulated," the suit states.

Lawyers for the plaintiff did not immediately respond to a request for comment. The complaint called into question any consent that Plaid received from users, since most consumers do not realize Plaid is involved in their use of the finance apps, they allege. 

"If consumers don't know that Plaid exists, they certainly cannot consent to Plaid taking their data," they wrote.

Sign up for Law.com's Legal Radar to keep up with the latest news and lawsuits in a free, personalized news feed. Track class actions and who's getting the work by industry, practice area, law firm, company and region.