Users on DOC and Facebook reported that the signup page has fine print saying that you authorize Aven the ability to pull tax transcripts (hence the notifications about IRS 4506C forms being sent out and pulled.)
I believe that Aven is using the tax transcript data as accurate’ish income data and combining it with the last 4 of SSNs and birthdays to apply for credit cards and HELOCs using your data, if your credit is not frozen.
I also believe that Aven is using the Plaid-linked bank accounts to set up the credit card and HELOC applications, although I initially thought that Plaid was just tokenized bank info without access to your actual bank account numbers. Not sure about that part.