Quicken Community is moving to Single Sign On! Starting 1/22/21, you'll sign in to the community with your Quicken ID. For more information: http://bit.ly/CommunitySSO

Trusted Bank Aggregation Partner

GM
GM Member ✭✭
[Removed-Inaccurate] It concerns me that the aggregator seems to be logging over night. Then, when I do a morning update, it again logs into my bank. Why is it logging in at night? What is the process that it follows? I don't seem to have lost any money but there hasn't been any explanation on what is actually going on. Appreciate any input. thanks. gm.

Best Answers

  • Chris_QPW
    Chris_QPW Member ✭✭✭✭
    Accepted Answer
    GM said:
    [Removed-Inaccurate] It concerns me that the aggregator seems to be logging over night. Then, when I do a morning update, it again logs into my bank. Why is it logging in at night? What is the process that it follows? I don't seem to have lost any money but there hasn't been any explanation on what is actually going on. Appreciate any input. thanks. gm.

    Even though this hasn't changed as @Boatnmaniac said I thought I would talk about the question, because it does bear talking about given what is known about the current "Express Web Connect" system.

    Here is the official link on that:
    https://help.quicken.com/pages/viewpage.action?pageId=3217626

    But one has to wonder about the "logging in twice" as in, at night and when you ask Quicken to update.

    Here is my belief.  It all started exactly how it is described in the article.  And as such when you ran update in Quicken you were not in fact contacting the financial institution at all, you were contacting only the "nightly cache" on the Intuit server.

    This served two purposes.  One is that logging into some of these sites is very slow, and by caching that transactions it is speed up.  The other being that it reduced the number of logins to the financial institution's which of course they like.  And I will actually throw in a third, and that is some financial institution's wanted to risk the time of day this happened to a less busy time.

    And I think for some financial institutions this is still the model, and as such the nightly logging in persists (even if the model doesn't fit with the present day behavior at that financial institution).

    We use to see this behavior lots of times where the transactions that came in after the nightly update wouldn't show up in Quicken until after the next update.

    Given multiple factor authentication and generally just trying to be more interactive, we can clearly see that this model isn't what is really happening for a lot (if not all) of the financial institutions today.  For instance I can download my PayPal transactions shortly after they are posted in the PayPal account.

    The path to retrieving the transactions is about the same:

    Quicken -> Intuit server -> financial institution's website  (this system is slowly being changed to a different one)

    The newest seems to be:
    Quicken -> Quicken Connection Service (QCS) -> Intuit server -> financial institution's website

    Note that QCS caches transactions for some period of time (I'm not sure how long) and as a result back to back requests go faster, because they come from this cache of transactions.

    So the nightly logins seem to me to be more of "don't change it, because it might break something" more than anything else.
    Signature:
    (I'm always using the latest Quicken Windows Premier subscription version)
    This is my website: http://www.quicknperlwiz.com/
  • GM
    GM Member ✭✭
    edited October 2020 Accepted Answer
    You are correct in saying that many of us didn't really know how EWC worked. We had a false sense of security I guess. [Removed-Disruptive]  Thanks for the information.

Answers

  • Quicken_Tyka
    Quicken_Tyka Moderator mod
    Hello @GM

    Thank you for taking the time to visit the Community to ask your question.

    What you are describing is the aggregation process for Express Web Connect. Express Web Connect is a connection method used to download transactions to Quicken.

    https://www.quicken.com/support/how-quicken-connects-your-bank

    Access and retrieval of data are automated through the use of nightly updates. During these updates, our aggregation partner logs in to your bank's website on your behalf. Generally, this happens once a day and outside of business hours. Because of this, you may notice login activity on your bank's website overnight.

    To confirm the connection method being used, you may open Quicken and navigate to Tools > Account List, there you may see the connection type.

    This has been the aggregation process for many years. The service provider is and has always been Intuit and that has not changed recently either.

    I hope this helps to clarify, please let me know if you have any additional questions.

    -Quicken Tyka
    ~~~***~~~
  • Chris_QPW
    Chris_QPW Member ✭✭✭✭
    Accepted Answer
    GM said:
    [Removed-Inaccurate] It concerns me that the aggregator seems to be logging over night. Then, when I do a morning update, it again logs into my bank. Why is it logging in at night? What is the process that it follows? I don't seem to have lost any money but there hasn't been any explanation on what is actually going on. Appreciate any input. thanks. gm.

    Even though this hasn't changed as @Boatnmaniac said I thought I would talk about the question, because it does bear talking about given what is known about the current "Express Web Connect" system.

    Here is the official link on that:
    https://help.quicken.com/pages/viewpage.action?pageId=3217626

    But one has to wonder about the "logging in twice" as in, at night and when you ask Quicken to update.

    Here is my belief.  It all started exactly how it is described in the article.  And as such when you ran update in Quicken you were not in fact contacting the financial institution at all, you were contacting only the "nightly cache" on the Intuit server.

    This served two purposes.  One is that logging into some of these sites is very slow, and by caching that transactions it is speed up.  The other being that it reduced the number of logins to the financial institution's which of course they like.  And I will actually throw in a third, and that is some financial institution's wanted to risk the time of day this happened to a less busy time.

    And I think for some financial institutions this is still the model, and as such the nightly logging in persists (even if the model doesn't fit with the present day behavior at that financial institution).

    We use to see this behavior lots of times where the transactions that came in after the nightly update wouldn't show up in Quicken until after the next update.

    Given multiple factor authentication and generally just trying to be more interactive, we can clearly see that this model isn't what is really happening for a lot (if not all) of the financial institutions today.  For instance I can download my PayPal transactions shortly after they are posted in the PayPal account.

    The path to retrieving the transactions is about the same:

    Quicken -> Intuit server -> financial institution's website  (this system is slowly being changed to a different one)

    The newest seems to be:
    Quicken -> Quicken Connection Service (QCS) -> Intuit server -> financial institution's website

    Note that QCS caches transactions for some period of time (I'm not sure how long) and as a result back to back requests go faster, because they come from this cache of transactions.

    So the nightly logins seem to me to be more of "don't change it, because it might break something" more than anything else.
    Signature:
    (I'm always using the latest Quicken Windows Premier subscription version)
    This is my website: http://www.quicknperlwiz.com/
  • GM
    GM Member ✭✭
    Appreciate the comments by all.

    First, I don't appreciate the moderator removing part of my question/comments. If the Aggregator doesn't have my passwords then how do they log in. I've never dug into the details of quicken in the past because I believed that Intuit managed that function and I call Intuit to help resolve problems when transactions could not be downloaded. I'm not sure many users are aware of how this function is actually implemented/performed and they should be.

    Second, the Aggregator is probably doing a nightly (4am) download since I get an alert at that time. When I do a download at 7am I also get the login alert. This concerned me as I didn't know "who" was performing the 4am login. (I have my bank account set to alert me for every login.) When I implemented Two Factor Authentication, the late night login disappeared so I suspected it was related to the Quicken Aggregator.

    So thanks for the information and clarification. I just wish that Quicken would do a better job of documenting their security practices both for their software and their/Aggregator servers.

    Thanks Again! gm.
  • Chris_QPW
    Chris_QPW Member ✭✭✭✭
    GM said:
    Appreciate the comments by all.

    If the Aggregator doesn't have my passwords then how do they log in.
    The Aggregator does have your password.  I don't think anyone here has said otherwise.

    They have always had your password, you can't setup an Express Web Connect account/connection without giving it to them.

    A LOT of people have gotten a false sense of how Express Web Connect works over the years, and it isn't until a recent change that they noticed.

    Intuit is the aggregator.  When Intuit sold off Quicken they still needed all the systems to connect to the financial institutions for QuickBooks.   And Quicken Inc is much to small of a company to support this on their own.  So Quicken Inc pays Intuit for this service.

    Now in the past you would setup your account and it would ask you for your username and password.  Those were saved on Intuit's servers when you use Express Web Connect (this isn't true of Direct Connect).  Quicken also saved those usernames and passwords in the password vault giving the users a false sense that the "aggregation" was only being done at the time they ran One Step Update.  That has never been true.

    Recently Quicken Inc has changed the way the Express Web Connect connection works, and decided to put "not needed" for the Express Web Connect passwords in the Password Vault.  They were in fact never needed, this just makes it visible.

    One difference is about how you would change the password.  Before you could change it in the Password Vault and it would pass that change on to the aggregator servers.  Now what they do is have you change it at your financial institution, and then when it updates and fails they then prompt you for it.
    Signature:
    (I'm always using the latest Quicken Windows Premier subscription version)
    This is my website: http://www.quicknperlwiz.com/
  • GM
    GM Member ✭✭
    edited October 2020 Accepted Answer
    You are correct in saying that many of us didn't really know how EWC worked. We had a false sense of security I guess. [Removed-Disruptive]  Thanks for the information.
  • GeoffG
    GeoffG SuperUser ✭✭✭✭✭
    GM said:
    You are correct in saying that many of us didn't really know how EWC worked. We had a false sense of security I guess. [Removed-Disruptive]  Thanks for the information.
    I take issue with your comment about Quicken aggregation being somehow less secure. This method has been in place for well over a decade, perhaps two and has never had any security breaches that I am aware of.
    You previously state that Quicken should provide more information about how and what they do to secure your passwords. What has been provided is sufficient for the average Quicken user without providing a roadmap to nefarious hackers to attempt a data breach.
    user since '92 | Quicken Windows Premier - Subscription | Windows 10 Pro version 20H2
  • GM
    GM Member ✭✭
    Have they had a security audit done on their system/software recently?? Many, many companies have thought they were secure until they were hacked. Many more questions should be asked. By the way, I've had quicken for 20 years - long time user with few complaints. Have a good weekend folks!
Sign In or Register to comment.