How does Quicken login to my bank account?
Rocks
Member ✭✭
About 1 month ago, I logged into my bank's online banking (RBC Canada). I got a warning message that someone had attempted to login to my account with the correct account number and password but failed to answer my security question. It gave me the date and time and I confirmed it was not me logging in. It then prompted me to change my password.
My banking account and password are in my head only. Not written anywhere, not saved anywhere, not the same as any other password and not easy to guess.
My next login to Quicken several weeks later, my update didn't work , of course, because I changed my bank password. After some research on how to get my accounts updating again, I got it working again. About a week later, same message as above when I logged into my online banking. I realized at this point, Quicken does save my password (although I can't figure out how, or how to disable it).
My question. When Quicken logs in to my account, how does it handle the security question from my bank, if asked? Or does the bank not ask the security question when it gets a request from Quicken? This is very frustrating and scary. Either, the problem is with security question, in which case Quicken becomes useless to me, or my account and password are being stolen from my bank or Quicken (which are the only two sites with access to this information).
I've emailed Quicken support about this but never got a reply. I'm using Canadian Version with all updates.
My banking account and password are in my head only. Not written anywhere, not saved anywhere, not the same as any other password and not easy to guess.
My next login to Quicken several weeks later, my update didn't work , of course, because I changed my bank password. After some research on how to get my accounts updating again, I got it working again. About a week later, same message as above when I logged into my online banking. I realized at this point, Quicken does save my password (although I can't figure out how, or how to disable it).
My question. When Quicken logs in to my account, how does it handle the security question from my bank, if asked? Or does the bank not ask the security question when it gets a request from Quicken? This is very frustrating and scary. Either, the problem is with security question, in which case Quicken becomes useless to me, or my account and password are being stolen from my bank or Quicken (which are the only two sites with access to this information).
I've emailed Quicken support about this but never got a reply. I'm using Canadian Version with all updates.
0
This discussion has been closed.
Answers
Second question. After the same update I started to see that Quicken Web Sync was successful. I never enabled this and would like to disable it. I can't find anywhere where I can do this.
I've found various other topics on this and the actions they mention are not available in my version. I have the Canadian version with all updates.
Please help. This is very frustrating and should be a simple setting.
Connection Types in Quicken
P.S. You can't email Quicken Supporthttp://www.quicken.com/contact-support
FAQ: Why Didn't I Receive an Answer When I Reported a Problem?
Windows 10 Pro 32 & 64-Bit Build 20236.1005
also Windows 10 Pro 64-Bit Build 19041.572
View: https://community.quicken.com/discussion/7859218/work-with-copies-of-your-actual-quicken-data-files/p1?new=1
> Hi @Rocks ,
> Have you bother to check your Password Vault? You need to know your Password Vault password, in order to access it.
I don't use the password vault.
> (Quote)
> Frankly this is a big "unknown" and Quicken Inc and Intuit aren't talking. At least I have never heard anyone from Quicken Inc/Intuit really explain what is being done, most likely because of "security" and because the answer is different for different financial institutions.
> Note that Inuit provides the Express Web Connect service (Quicken Inc pays them).And it was originally designed (and most likely still does it) to log in once a night to your financial institution's website and get your transactions, and save them on their server until you ask Quicken to pick them up (One Step Update or Update Now).This isn't done with any "standardized protocol". Instead it is an "agreement" between the financial institution and Intuit. And as such is different for different financial institutions. And it seems with the financial institutions putting more and more 2FA and such kind of security measures in place,it is getting harder for this process to work right.
Pity that no one is talking. I like the application but it's pretty useless if I can't download my transactions. What you said about Quicken downloading transactions periodically makes sense. The warnings I got from my bank indicate "someone" tried to login and it wasn't me. I also noticed since it started updating without me entering the password, the transactions were downloaded very quickly, so maybe they were downloaded to Quicken already. I'm all for security but unfortunately it's killed this app for me.
> BTW just in case it isn't obvious. When you use Express Web Connect, the Intuit servers store your credentials (username, password, security questions, ...) you entered on their servers (encrypted from what they have said).
Where is this set and is there another setting I can use so it doesn't remember my credentials?
These 3rd-party entities (aggregators) use YOUR financial username and password to obtain YOUR info.
Financial institutions -- who might require 2FA from you -- often work-out agreements w/ these aggregators to relax 2FA requirements on these "trusted entities" to allow access w/o 2FA.
Obviously, this is a backdoor into you account which could be exploited by bad actors if all parties are not "on their toes" re: the constantly-evolving threat vectors.
"Krebs on Security" had a very informative piece on it last fall; linked below:
https://krebsonsecurity.com/2019/11/ncr-barred-mint-quickbooks-from-banking-platform-during-account-takeover-storm/
Good amplifying info.
Thanks.