[GNC-dev] New OFX Requirements For USAA FSB

Anthony J. Munoz II ag368 at hotmail.com
Sun Feb 7 12:19:33 EST 2021

This is very good news indeed! I've been watching this mailing list for
awhile to see if anyone could crack the code. That being said, I'm
trying to get this information disbursed to the developers of the open
source software PocketSense. They basically created a Python script that
generates OFX files for MIcrosoft Money customers (as it is now
abandonware but still has a strong following). Hopefully the developer
of that script can use this knowledge to get USAA working again.

On 2/7/2021 12:00 PM, Jean L wrote:
> Wow! That's dedication!
> I have to admit, the same thing happened with my Credit Union
> (Patelco) and I didn't have the dedication to do what you did!
> Kudos to you. It's really maddening, like you say, that apparently the
> only clients that our banks think have the right to download their
> data are Quicken customers.
> In any case, thanks for posting the "recipe" and the details of how
> you got to your final success. I'm impressed!
> One thing though: I would have imagined that the communication between
> Quicken and your bank was encrypted, how were you able to decrypt
> that, not knowing any of the keys they probably use?
> Jean
> On 2/6/2021 8:45 PM, Scott McRae wrote:
>> I got this working in my software with some help for the info on this
>> list.
>> Here is a write-up:
>> USAA's changes to their OFX interface
>> -------------------------------------
>> On 2020-01-26, USAA's previous OFX interface (
>> https://service2.usaa.com/ofx/OFXServlet) stopped working. It seems like
>> they switched to a new interface through a tech provider to replace
>> their
>> previous login method (with your website credentials) to an
>> app-specific ID
>> and password. This is a good move for security, but it was done without
>> notice, it seems, to anyone but Quicken.
>>  From some internet searches, I found some people on the right track to
>> fixing this on the GNU Cash development mailing list:
>> https://lists.gnucash.org/pipermail/gnucash-devel/2021-January/045664.html
>> They were able to determine that USAA was:
>>   - using a new OFX endpoint:
>> https://df3cx-services.1fsapi.com/casm/usaa/access.ofx
>>   - using a new OFX Org ID: USAA Federal Savings Bank
>>   - using a new OFX FID: 67811
>> Additionally, someone on the USAA forums was about to extract and
>> post the
>> link to generate an App ID and PIN:
>> source:
>> https://communities.usaa.com/t5/Finances/USAA-Creates-Quicken-Monopoly/td-p/243850/highlight/false
>> Authorization link: https://df3cx-services.1fsapi.com/casm/usaa/enroll
>> However, with a lot of trial and error I still wasn't able to hit
>> this new
>> endpoint successfully. So I decided to give the devil his due and
>> temporarily got a Quicken subscription and setup an SSL
>> man-in-the-middle.
>> The new OFX interface is *very* finicky, so you basically have to input
>> everything exactly the way it expects it. Here is an example of an
>> account
>> listing query that works:
>> echo -en
>> Federal Savings
>> Bank\r\n<FID>67811\r\n</FI>\r\n<APPID>QMOFX\r\n<APPVER>2300\r\n<CLIENTUID>1955A543-B071-455E-A31E-73CC7C493D68\r\n</SONRQ>\r\n</SIGNONMSGSRQV1>\r\n<SIGNUPMSGSRQV1>\r\n<ACCTINFOTRNRQ>\r\n<TRNUID>e39add7d-2085-4504-b9ee-be37927de39c\r\n<ACCTINFORQ>\r\n<DTACCTUP>19900101\r\n</ACCTINFORQ>\r\n</ACCTINFOTRNRQ>\r\n</SIGNUPMSGSRQV1>\r\n</OFX>\r\n"
>> | curl -isS -X POST -H "Content-Type: application/x-ofx" -A
>> InetClntApp/3.0
>> --data-binary @- https://df3cx-services.1fsapi.com/casm/usaa/access.ofx
>> Note you have to change the XXXXX and NNNNN to the App ID and PIN you
>> get
>> from the link above.
>> Some things I've found through trial and error:
>>   - The OFX elements must be separated with "\r\n". This is dumb, but
>> true.
>> No spaces. No simple "\n". Exactly "\r\n".
>>   - The APPID "QMOFX" and APPVER "QMOFX" work. Others I tried did not.
>>   - The CLIENTUID "1955A543-B071-455E-A31E-73CC7C493D68" works for
>> me. It
>> must be uppercase. This might be particular to your account. If so,
>> you can
>> find it looking at the OFX logs from Quicken.
>>   - TRNUID must be present, but an UUID will do.
>>   - DTACCTUP: The value "19900101" works. The value "19700101" does
>> not. The
>> value "19900101000000" does not.
>>   - You need the "Content-Type: application/x-ofx" header
>>   - You need the User-Agent "InetClntApp/3.0". This is what Quicken
>> for Mac
>> sends.
>> It also seems their gateway will under some conditions put your IP on
>> a ban
>> list. If you are testing, you may want to spin up an AWS instance or
>> something. When you get on it, you'll start seeing an empty HTML page
>> response, like:
>> <html>
>> <head>
>> <META NAME="robots" CONTENT="noindex,nofollow">
>> <script
>> src="/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3">
>> </script>
>> <body>
>> </body></html>
>> Valid queries will work from different source IPs when this happens.
>> Thanks to Bob White on the GNU Cash list and RDD! on the USAA Forums for
>> the breadcrumbs. No thanks to USAA for swapping out their functional
>> interface with absolutely no notice or documentation and pretending like
>> Quicken users are the only customers of any importance. Please just
>> don't
>> break our software again... at least for awhile.
>> - Scott McRae
>> _______________________________________________
>> gnucash-devel mailing list
>> gnucash-devel at gnucash.org
>> https://lists.gnucash.org/mailman/listinfo/gnucash-devel
> _______________________________________________
> gnucash-devel mailing list
> gnucash-devel at gnucash.org
> https://lists.gnucash.org/mailman/listinfo/gnucash-devel
> .

More information about the gnucash-devel mailing list