[GNC] AqBanking help for Citi CC (cont'd again)

[David Reiser]

> On Oct 21, 2019, at 12:13 PM, Jonathan Stickel <jjstickel at gmail.com> wrote:
> 
> On 10/20/19 22:13, John Ralls wrote:
>>> On Oct 20, 2019, at 7:46 PM, Jonathan Stickel <jjstickel at gmail.com> wrote:
>>> 
>>> As with messages in January and August, I too would like AqBanking to work with a Citi credit card account. I've followed the recommend settings described here:
>>> 
>>> https://lists.gnucash.org/pipermail/gnucash-user/2018-October/080548.html
>>> 
>>> but still no luck.
>>> 
>>> I did find a feature when logged in to my citi.com account to "manage access" for third party software applications ("like Quicken® or Quickbooks®"). This is through Profile->More Settings. Clicking on Add Access then gives 10 minutes to make a connection. I've tried running AqBanking during this 10 minute window, but it still does not retrieve an account list or download transactions. So I am at a loss. If anyone is currently being successful using a Citi cards connection, please post!
>> That 10-minute window makes it seem like it's OFX Web Connect, where you authenticate via the web and then connect with your financial software. AQBanking and therefor GnuCash doesn't support that. It supports only OFX Direct Connect where the financial software handles the authentication.
>> Regards,
>> John Ralls
> 
> Thanks for the observation. Perhaps that part is a red herring.
> 
> My main question remains:  is anyone successfully running AqBanking with Citi Cards? If so, how did you make it work?
> 
> Thanks,
> Jonathan

Not anymore. I used aqbanking for many years to download Citicard transactions. A couple years ago the connections started failing about half the time. And a couple hours later, whether I got the data or not, I’d get an email from Citi saying they had detected suspicious activity on my account and I was required to change my password. Kinda weird for them to cough up all the transaction data, and then decide the connection was suspicious. But this is not the first disagreement I’ve had with Citi over weird security policies. Eventually I gave up on directconnect downloads. If I need Citi transactions (not often recently), I log in via the web interface, download the qfx file, and import that into Gnucash.

https://community.quicken.com/discussion/7859184/new-8-27-19-citi-cards-returning-ol-301-error#latest <https://community.quicken.com/discussion/7859184/new-8-27-19-citi-cards-returning-ol-301-error#latest>
indicates that Citi has further modified their permitted third part access, and even Quicken users are having problems.

I tried the old aqbanking connect attempt last night, and got no response. The ofx.log showed the outgoing commands, with nothing coming back. I had activated Citi’s 10 minute window, to no avail. I also got no notice that anyone had tried to break in. I’d love to see the ofx.log and conn.log from a successful download in Quicken of Citi transaction data. There’s a chance the old ofx server just drops the connection on any attempted login. 

Citi’s description of the third party authorization (once an app is authorized, changing your password won’t prevent access by the app…) leads me to believe there is some additional handshake/authentication going on during that logon in 10 minute window that is outside the ofx spec. If so, there’s no way for aqbanking to handle that. I seriously doubt we’ll ever see published-standard ofxdirectconnect transaction downloads from Citi again. The banking regulators are making it hard to accomplish, Quicken would just as soon the handshake be totally proprietary, and the banks don’t want to bother with software development if they can help it.

Good luck.

--
Dave Reiser
dbreiser at icloud.com