Quicken is currently unable to verify financial institution information for download QFX file, BofA

https://community.quicken.com/discussion/comment/20513897#Comment_20513897

https://community.quicken.com/discussion/comment/20513905#Comment_20513905

The flow of information for Express Web Connect + is:

Financial Institution → Intuit (with a protocol called FDX which uses rotating security tokens for authentication) → Quicken servers → Quicken (the program using Sync using the same method as Sync to Mobile/Web)

And both Intuit and Quicken servers do retain the the transaction information for some period of time. With Intuit it has been stated in the past that it is something like 30 to 60 days. In the case of the Quicken servers it has never been stated how long they keep it but since they are using the same system/Quicken Cloud dataset that Sync to Mobile/Web uses and it starts with 2 years from the Desktop data file and keeps it until the Cloud dataset is deleted one would have to assume it keeps it to.

So, I would say that @Kipa has a good understanding of what information is being stored outside of the user’s computer, but not really of the ‘why’.

First off Quicken Inc pays Intuit for the connection services and as such Intuit is in control of what happens on their servers, not Quicken Inc. But there are other reasons for retaining the information like the financial institutions wanting reduce the requests to their servers. It also seems like Quicken Inc has implemented some kind of duplicate transaction system on their servers to prevent duplication when switching between Direct Connect and Express Web Connect +.

As for Quicken Inc implementing their own solution so that users can avoid their data being stored on servers, Quicken Inc is a small company of about 200 employees, it can’t maintain the needed relationships with the financial institutions. That is why they pay Intuit for this, and as such have follow the rules that Intuit and the financial institutions have agreed upon.

Kipa

https://community.quicken.com/discussion/comment/20513905#Comment_20513905

Not 100% true. We already figured out one workaround by downloading a .csv file from Bank of America and using that as a basis for an upload into Quicken. It doesn't have some of the pre-upload intelligence/processing that Quicken does for Web Connect files, but working on those aspects. Even if we strike out, I'll have at least one other choice.

Kipa

@Chris_QPW

Thanks for the above detail - really helpful to better understand more. I didn't even think of another copy of the financial data staying with Intuit in addition to Quicken, so more to look into. Right now, I've done direct downloads from BofA in a .csv file. Not as elegant, but keeps my work flows going without having to commit to Express Web Connect + so far.

Q Info

From the virtual assistant:

Our documentation doesn't contain specific information about Merrill Lynch Benefits Online's current authorization service support for QFX downloads.
Financial institutions can provide QFX files for download while discontinuing the authorization service that Quicken requires to validate them - these are separate functions. When a bank no longer supports Web Connect authorization in Quicken, the file cannot be authorized when importing, even if QFX downloads are still available.
Which specific error message are you seeing when trying to import the QFX file from Merrill Lynch Benefits Online?

Quicken is unable to verify the financial institution

The "unable to verify the financial institution" error occurs when your bank no longer supports Web Connect authorization in Quicken, even if they still provide QFX downloads.
This happens because Web Connect files require access to online services to validate the file and transactions for security purposes. The verification process is separate from file download capability - banks can provide QFX files but discontinue the authorization service Quicken needs.
This issue can only be resolved by contacting Merrill Lynch Benefits Online directly, as they control Web Connect support and provide the QFX file.

BroncoWm

So if I am getting the Quicken cannot verify banking information, check again later, it is Bank of America's fault?

https://community.quicken.com/discussion/comment/20516202#Comment_20516202

Yes.

George McK

The "unable to verify the financial institution" error occurs when your bank no longer supports Web Connect authorization in Quicken, even if they still provide QFX downloads.
is this solely BofA problem?

Should i contact BofA online banking department?

https://community.quicken.com/discussion/comment/20516683#Comment_20516683

Only BofA can change this, but I doubt they will. They want people to switch over to Express Web Connect +. I also doubt that the first line support of BofA will know what is going on, and as such might blame Quicken Inc.

George McK

I have used other down loading but I get bank entry as far back as Feb and March.

make it impossible to verify balance and reconciliation of bank accounts!

hopefully Quicken does not sleep on this problem expedite a solution. I have used Ui Ken for over 20 years and this is the most frustrating situation

George McK

typo: hopefully Quicken does not sleep on this problem expedite a solution. I have used Quicken for over 20 years and this is the most frustrating situation!

The issue (for me, at least) with Express Web Connect+ (EWC+) that all your financial information (if you agree to use it) is stored on Intuit server (not even Quicken).

EWC+ works, as follows:

Intuit uses your credentials to periodically pull your financial information from the financial institution, like BofA, and stores on Intuit servers.
The Quicken application on your PC or Mac then pulls the information from Intuit.

Intuit is not a financial institution, and thus, does not have to follow the financial rules and regulations.

In addition, remember Equifax. Why would we want all our financial information stored in one place - Intuit.

It is highly likely that Quicken is pressuring financial institutions to make this change. Fidelity recently discontinued Direct Connect in favor of EWC+.

I refuse to use EWC+, and when I can no longer update transactions without it, I will stop using Quicken. Which is sad as I have been a Quicken user since 1990, when it ran on DOS.

Say NO to QWC+ !!

In addition, If BofA requested the change, why does BofA still offer "Web Connect for Quicken 2018 and above" as a download option.

https://community.quicken.com/discussion/comment/20517112#Comment_20517112

We can't know for sure, but if you are worried about a non-financial institution holding your transactions then I would think the bigger risk is Quicken Inc's servers (which BTW are on AWS). But note both Quicken Inc and Intuit say that they are using financial institution security procedures.

As far as what has been stated Intuit holds the transactions for a limited amount of time, probably something like 30 to 60 days. Now Quicken Inc hasn't stated how long they hold transactions, but you have to understand that the transactions are "synced" using the exact same system as "Sync to Mobile/Web". And "Sync to Mobile/Web" starts with something like the last three years and doesn't remove any transactions unless the user deletes the Quicken Cloud dataset. Given that they are using the same system, and that they don't say otherwise I would have to assume they have the same policy on retaining transactions.

https://community.quicken.com/discussion/comment/20517113#Comment_20517113

It just shows that even in BofA one hand doesn't talk to the other let along properly communicate with Intuit/Quicken Inc. They haven't bothered telling the website developers to change it, or maybe they don't even consider it worth their time to change it. After all, the "block" has already been put in.

Doodaman

I've read through this entire posting, tried resetting the account, which did not solve the connection issues and I'm still confused. Can a straight, concise answer be given? Will Quicken be able to download and incorporate transactions at some future date or will this feature no longer be available for Merrill Lynch/Bank of America accounts?

I had discussions with Schwab and Quicken about Express Web Connect+ (EWC+). From these discussions, EWC+ works, as follows:

When the financial institution agrees to force us to use EWC+, a new window appears in Quicken from Intuit (not that Quicken is no longer part of Intuit). This window requests your login credentials for the financial institution, and you agree to allow Intuit to do this.
Intuit uses the login credentials to access your financial data, and then downloads your financial information (balances, transactions, etc) onto Intuit servers.
Quicken on your local system, queries the Intuit servers for your financial information.
Intuit then periodically polls the financial institution for updates to your financial information, presumably so that updates to Quicken are faster.

The issue I have with this new process is:

Intuit is not a financial institution, and does not need to follow the strict requirements that are imposed financial institutions to preserve your data. Obviously, it's in their best interest to do so, just not required.
When Schwab switched to EWC+, as part of the login process a warning pop-up appeared in Quicken that said Schwab was not liable for any issue that might occur regarding Intuit's handling of your data. Because of this I moved my accounts out of Schwab to Etrade. Etrade still supports Direct Connect where financial data only flows between servers at the financial institution and the Quicken App on your computer.
Housing financial data from everyone using Quicken on one set of servers (namely Intuit) is NOT a good idea. Remember Equifax. A security breach at Intuit could be far worse.

Regarding BofA making this switch, I wonder if Quicken, the company, is involved, as BofA still offers Web Connect as an option for downloading transactions into the Quicken App. Web Connect is where you log into the financial institution and download a .QFX file of transactions directly to your computer, and then this file is imported into the Quicken App.

Why would BofA still offer that option, if BofA made to decision to not allow this form of communications.

Say NO to EWC+.

@wrb you have part of this wrong.

With Express Web Connect + Intuit at no time has your login credentials. When Quicken starts the authorization process your web browser is directed to the financial institution’s website. You login there and authorize them to give Intuit what is needed for Intuit to use a rotating security token to fetch your transaction information. This is the reason they can call at least this part of the process more secure. No one outside of you or the institution have your login credentials which could be used to make actual transactions in your accounts.

Yes, if Inuit or Quicken Inc servers were hacked they might be able to see your transactions (nothing has been stated how even financial institutions store that information) but there would be no information that could be to actually login into your accounts at the financial institution.

And as for this question:

Why would BofA still offer that option, if BofA made to decision to not allow this form of communications

Clearly you are not taking into account how large organizations “work”.

brockden

I'm am old lady, and have been using Q for many years. I don't understand this express web connect - and why i should not use it.

Is there another program [not quicken] that i can switch to

https://community.quicken.com/discussion/comment/20517689#Comment_20517689

It should be stated the @wrb stated his opinion, whereas there are thousands of people that disagree with that opinion which is evident by the fact that they are using Express Web Connect +. At the end of the day nothing in this world is without some risk and everyone has to decide for themselves what they want to do.

As for another program to replace Quicken, over the years I have heard tons of people complain about Quicken and that they were going to find something else. I guess some might have found something that served their needs. Others have come back to report they found nothing that could replace all the features that Quicken has. But in general, this is a Quicken forum and they don't allow discussions on their dime for competitor products.

This post keeps getting removed!!!

I had discussions with Schwab and Quicken about Express Web Connect+ (EWC+). From these discussions, EWC+ works, as follows:

When the financial institution agrees to force us to use EWC+, a new window appears in Quicken from Intuit (not that Quicken is no longer part of Intuit). This window requests your login credentials for the financial institution, and you agree to allow Intuit to do this.
Intuit uses the login credentials to access your financial data, and then downloads your financial information (balances, transactions, etc) onto Intuit servers.
Quicken on your local system, queries the Intuit servers for your financial information.
Intuit then periodically polls the financial institution for updates to your financial information, presumably so that updates to Quicken are faster.

The issue I have with this new process is:

Intuit is not a financial institution, and does not need to follow the strict requirements that are imposed financial institutions to preserve your data. Obviously, it's in their best interest to do so, just not required.
When Schwab switched to EWC+, as part of the login process a warning pop-up appeared in Quicken that said Schwab was not liable for any issue that might occur regarding Intuit's handling of your data. Because of this I moved my accounts out of Schwab to Etrade. Etrade still supports Direct Connect where financial data only flows between servers at the financial institution and the Quicken App on your computer.
Housing financial data from everyone using Quicken on one set of servers (namely Intuit) is NOT a good idea. Remember Equifax. A security breach at Intuit could be far worse.

Why would BofA still offer that option, if BofA made to decision to not allow this form of communications.

I had discussions with Schwab and Quicken about Express Web Connect+ (EWC+). From these discussions, EWC+ works, as follows:

When the financial institution agrees to force us to use EWC+, a new window appears in Quicken from Intuit (not that Quicken is no longer part of Intuit). This window requests your login credentials for the financial institution, and you agree to allow Intuit to do this.
Intuit uses the login credentials to access your financial data, and then downloads your financial information (balances, transactions, etc) onto Intuit servers.
Quicken on your local system, queries the Intuit servers for your financial information.
Intuit then periodically polls the financial institution for updates to your financial information, presumably so that updates to Quicken are faster.

The issue I have with this new process is:

Intuit is not a financial institution, and does not need to follow the strict requirements that are imposed financial institutions to preserve your data. Obviously, it's in their best interest to do so, just not required.
When Schwab switched to EWC+, as part of the login process a warning pop-up appeared in Quicken that said Schwab was not liable for any issue that might occur regarding Intuit's handling of your data. Because of this I moved my accounts out of Schwab to Etrade. Etrade still supports Direct Connect where financial data only flows between servers at the financial institution and the Quicken App on your computer.
Housing financial data from everyone using Quicken on one set of servers (namely Intuit) is NOT a good idea. Remember Equifax. A security breach at Intuit could be far worse.

Why would BofA still offer that option, if BofA made to decision to not allow this form of communications.

@wrb You post is in this thread three times, it didn't get removed, but I think I can explain what is going on. This forum has a spam filtering system that when it either thinks that something might be spam, or if you post several times fast, or even sometimes at random it will push the comment into a queue for the moderators to approve before it shows up. It can take a while for the moderators to see it an approve it.

I have enough points so that doesn't happen to me anymore, but when I started it did. It will post a very quick message that it is doing that, but it is easy to miss.

https://community.quicken.com/discussion/comment/20513870#Comment_20513870

I agree with you Kipa. Express Web Connect will allow the aggregator, Intuit, to store your login id and password for the purposes of downloading bank transactions. This means more exposure for Quicken customers, given recent Intuit data breaches. However, Chris_QPW notes that the security handshake when using Express Web Connect +Plus+ does not pass login ID and password, which is a relief.

The most secure way to download B of A transactions is using one of the QIF format options. Upside is that no identifying account information is downloaded or stored. Downside is less integration of the downloaded transactions with your Quicken account files.

As to NotACPA's comment about Quicken not storing personal info when using the now-defunct Web Connect download, he should look at the header of any of his QFX files for an insight.

Dave

https://community.quicken.com/discussion/comment/20517578#Comment_20517578

Thanks Chris for more refinement of how you believe that the authentification process works with Express Web Connect. I would be relieved to know for a fact that login id and password for my bank account is used by Intuit only once during the initial setup of EWC and not every time I want to download transactions.

If that is the case, then the question arises, what is the life-time of the "rotating security token"? If it is a forever rotating token, then the worry becomes, how long does Intuit retain my login id and password which they used during initial setup of EWC? If it is 30 - 60 days, then, given recent data breaches at Intuit, I would be skeptical of using EWC. Shouldn't everyone?

https://community.quicken.com/discussion/comment/20518411#Comment_20518411

With Express Web Connect + Intuit/Quicken Inc never gets your username and password. When you go to setup Express Web Connect + what it does is start your web browser with a URL at the financial institution's website. You are then logging into your financial institution's website and authorizing the communication with Intuit. What is exchanged with Intuit is the needed security information so that every time Intuit goes to connect to the financial institution it can verify that it is in fact an Intuit server. From there on Intuit connect using the rotating security tokens. And what I mean by "rotating" is that it gets a new security token every time it connects. EDIT: This is the same kind of thing as why your credit card now has a "chip". The chip generates a new "virtual card number" every time you use it. So, if someone intercepts the "virtual card number" it is useless because that number is only valid for the one transaction. The same is true of these rotating security tokens. The "security information" I referred to is the information needed so that Intuit can generate the rotating security tokens that the financial institution agrees that can only be generated by Intuit.

You need to separate that though from a financial institution that is using Express Web Connect (no plus). Express Web Connect does work by Intuit holding your username and password to log in as you on at the financial institution's website.

Not only is Express Web Connect + better for security it is better for reliability over Express Web Connect. With Express Web Connect the Intuit server are really logging in exactly how you would. That means that if the financial institution is using multiple factor logins for you, then Express Web Connect has to handle them too, which is prone to problems, not to mention any changes at the website might break it.

Whereas Express Web Connect + is using a protocol called FDX which means that it has its own built-in security model I described above so no need for multiple factor authentication. It also means that the format of the data sent will be the same from one financial institution to another and as such should be more reliable just for the fact that Intuit doesn't have to use different code for different financial institutions.

But let be perfectly clear. There is the security of your login information, that is what I just posted on. And then there is the security of the actual transactions. The only thing that has been absolutely stated about the transactions is that they are being stored on both the Intuit and Quicken Inc servers for at least some duration.

It is also stated that in both cases they are using bank level security to protect all of this information.

Past that we are left to speculation, but I'm also not just throwing out pure fantasy. I have definitely proved that the "Sync to Mobile/Web/Quicken Cloud dataset" system is being used for both Express Web Connect and Express Web Connect +, which by definition is storing the transactions (and more, the more depending on what online services you are using).

The speculation is in the duration of how long transactions are stored on the Intuit and Quicken Inc servers. In the case of Intuit, the guess is based on long ago statements that Intuit made on the subject (30 to 60 days have both been thrown out). In the case of the Quicken Inc servers that has never been stated. And my guess is that they aren't doing anything different than with the "Sync to Mobile/Web" since they are using the same system for the "sync" (but not making these transactions visible to Mobile/Web), so I would think they would have the same duration of how long they keep them on the server (this is the speculation part). And "Sync to Mobile/Web" doesn't have a "duration" it keeps them all.

https://community.quicken.com/discussion/comment/20518424#Comment_20518424

Chris_QPW said,

"You need to separate that thought from a financial institution that is using Express Web Connect (no plus). Express Web Connect does work by Intuit holding your username and password to log in as you on at the financial institution's website."

My apologies, Chris, for not knowing that "EWC+" is something more than a marketer's rendition of "EWC". Your analogy to credit cards with intelligence on a chip makes sense. It is now easier to feel more confident in continued use of Quicken for downloads of bank data.

However, review of the original announcement, posted on this Community Support site (Ticket #:11975451), announcing discontinuance of Web Connect did little to build confidence in future security and success.

It also eroded confidence in Quicken's handling of the change by allowing its subscribers to continue to be frustrated by the "Try again later" show-stopper when importing unsuccessfully what appears to be a normal-as-always Web Connect QFX file.

Nor was it helpful to have the words "Web Connect" appear in the name of now-defunct process, the less-robust EWC and the enhanced EWC+. (That plus sign is sure carrying a heavy load; one not made clear to users).

It seems that Intuit and B of A are the important dogs in this fight with Quicken merely the **** cat….. and none seem much concerned about the worry the roll-out engenders in Quicken's customer base. For many not privy to this thread, the best "revolving security token" may end up being CSV file downloads.

Dave

https://community.quicken.com/discussion/comment/20518429#Comment_20518429

@Chris_QPW said "The only thing that has been absolutely stated about the transactions is that they are being stored on both the Intuit and Quicken Inc servers for at least some duration."

Thanks, Chris, for completing the loop on this thread about security. Your comment raises the question of what constitutes a transaction transmission in this context. Does the online transfer of transactions using EWC+ contain the same header information that the now-defunct Web Connect transaction file (.QFX) did? If so, then users' login-id and bank account numbers are being stored for some unknown period of time on both Quicken and Intuit's servers. (Given that info, hacking of accounts would be greatly enhanced, as only the password would be needed.)

Not to harp on this, but given Intuit's recent data breaches, if login id & bank account number are present in the transaction bundle, that does not build confidence in using EWC+.

Having said that I have no idea if the set of known breaches at Intuit and the set of FDX security mechanisms at Intuit overlap in any manner other than the name of the company. You have said that Quicken/Intuit never see the users' login id or password when using EWC+. Does the header of an EWC+ transaction bundle bear this out?

Dave

https://community.quicken.com/discussion/comment/20518617#Comment_20518617

It is my strong belief that the username and password aren't stored on the Intuit server for Express Web Connect +. They designed the FDX protocol around the OAuth2 protocol for the authorization which doesn't use a username and password. There wouldn't even be a place in the data for putting it in.

Now clearly, we have zero access to Intuit's and the financial institution's server logs and such to confirm that so I can't give a 100% assurance, but I seriously doubt it.

Note that the logs that we can get are from Quicken (the program) to the Quicken Inc servers. In that log data there definitely isn't any username or password. You can see that log with Help → Contact Support → Log Files → Cloud Sync Log.

https://community.quicken.com/discussion/comment/20518697#Comment_20518697

That makes sense, given your description of the "revolving security token" and the analogy to how credit cards with chips work.

Thanks for the feedback Chris.

As an aside, in the most recent download from my bank, I chose the QIF 4y format and was pleasantly surprised to find that my transfers (TXFR) to two credit cards actually showed the correct card for each transfer…… something that had not happened during several years of using Web Connect. Go figure.

Dave