Vanguard OFX service ongoing issue
Probably just a temporary glitch, but I have not seen it before:
MD error message:
Account: S-Vangd TIRA
I'm sorry, an error occurred. The details of this error are below.
Error Description:java.lang.SecurityException: Server sent redirect from a secure connection to a non-secure connection. Stopping
java.lang.SecurityException: Server sent redirect from a secure connection to a non-secure connection. Stopping
java.lang.SecurityException: Server sent redirect from a secure connection to a non-secure connection. Stopping
at com.moneydance.apps.md.controller.olb.CustomURLStreamHandlerFactory$HttpURLConnectionImpl.beginResponse(CustomURLStreamHandlerFactory.java:430) at com.moneydance.apps.md.controller.olb.CustomURLStreamHandlerFactory$HttpURLConnectionImpl.getResponseCode(CustomURLStreamHandlerFactory.java:455) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.sendMessage(OFXConnection.java:2702) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.sendMessage(OFXConnection.java:2560) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.getTransactions(OFXConnection.java:976) at com.moneydance.apps.md.view.gui.OnlineManager.downloadTransactions(OnlineManager.java:651) at com.moneydance.apps.md.view.gui.OnlineManager.downloadTransactions(OnlineManager.java:632) at com.moneydance.apps.md.view.gui.AccountDetailPanel.lambda$actionForService$10(AccountDetailPanel.java:460) at com.moneydance.apps.md.controller.BackgroundOpsThread.run(BackgroundOpsThread.java:177)
Console Window:
20241226-10:28:47.452 !Cannot send cookie back to source: https://vesnc.vanguard.com/us/OfxDirectConnectServlet; DCID=www21; path=%2F; domain=ofx.discovercard.com -> DCID=www21; path=%2F; domain=ofx.discovercard.com
20241226-10:28:47.452 !Cannot send cookie back to source: https://vesnc.vanguard.com/us/OfxDirectConnectServlet; NSC_pmvj2-NzNfssjmm-wt=9f52352e0000; path=%2F; domain=taxcert.mlol.ml.com -> NSC_pmvj2-NzNfssjmm-wt=9f52352e0000; path=%2F; domain=taxcert.mlol.ml.com
20241226-10:28:47.452 !Cannot send cookie back to source: https://vesnc.vanguard.com/us/OfxDirectConnectServlet; JSESSIONID=C908827D64E0499F05F7F3BEE1A0B0F6; path=%2Fnetbenefits%2Fofx%2F; domain=nbofx.fidelity.com; secure -> JSESSIONID=C908827D64E0499F05F7F3BEE1A0B0F6; path=%2Fnetbenefits%2Fofx%2F; domain=nbofx.fidelity.com; secure
20241226-10:28:47.452 Unrecognized cookie parameter: Tue, 10-May-2022 09:07:43 PDT ->
20241226-10:28:47.452 Unrecognized cookie parameter: Tue, 10-May-2022 09:07:45 PDT ->
java.lang.SecurityException: Server sent redirect from a secure connection to a non-secure connection. Stopping
at com.moneydance.apps.md.controller.olb.CustomURLStreamHandlerFactory$HttpURLConnectionImpl.beginResponse(CustomURLStreamHandlerFactory.java:430) at com.moneydance.apps.md.controller.olb.CustomURLStreamHandlerFactory$HttpURLConnectionImpl.getResponseCode(CustomURLStreamHandlerFactory.java:455) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.sendMessage(OFXConnection.java:2702) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.sendMessage(OFXConnection.java:2560) at com.moneydance.apps.md.controller.olb.ofx.OFXConnection.getTransactions(OFXConnection.java:976) at com.moneydance.apps.md.view.gui.OnlineManager.downloadTransactions(OnlineManager.java:651) at com.moneydance.apps.md.view.gui.OnlineManager.downloadTransactions(OnlineManager.java:632) at com.moneydance.apps.md.view.gui.AccountDetailPanel.lambda$actionForService$10(AccountDetailPanel.java:460) at com.moneydance.apps.md.controller.BackgroundOpsThread.run(BackgroundOpsThread.java:177) 20241226-10:29:21.688 Online downloads (account: 'A-Vangd RIRA', service: 'Vanguard') finished...
20241226-10:29:28.626 Log setting 'DEBUG' has been changed to: Enabled
Showing page 8 out of 9. View the first page
Keyboard shortcuts
Generic
| ? | Show this help |
|---|---|
| ESC | Blurs the current field |
Comment Form
| r | Focus the comment reply box |
|---|---|
| ^ + ↩ | Submit the comment |
You can use Command ⌘ instead of Control ^ on Mac
211 Posted by avp2 on 18 Feb, 2025 05:03 PM
Now (18th) is broken for me as before. And, a setup online banking refresh does not fix it this time. I guess they made another change.
212 Posted by roy on 18 Feb, 2025 05:17 PM
Same result for me today also
213 Posted by whitedavidp on 18 Feb, 2025 05:17 PM
I managed to get a successful download all accounts (includes my 2 Vanguard accounts) this morning. But after seeing avp2's post I tried to download the 2 Vanguard accounts again and he is correct. They are no longer working again. Sheesh!
214 Posted by Tim on 18 Feb, 2025 05:31 PM
Maybe time for a bunch of pesky calls to Vanguard Support ?? This is nuts !
215 Posted by dtd on 18 Feb, 2025 09:21 PM
Mark at fundmanagerssoftware is also experiencing this problem, so we're all back again to that starting point:
Here is his message at 1:42pm:
Hi Dan,
Yes, unfortunately I’m seeing the same problem in Fund Manager again. I’m not sure of the reason why. It will probably take the help of someone at Vanguard. Maybe they are purposely trying to prevent programs like MD and FM from accessing their OFX server, I’m not sure.
FYI, this is being discussed on our forum here:
https://www.fundmanagersoftware.com/forum/viewtopic.php?f=6&t=6711
Thanks,
Mark
216 Posted by Ambassador Dave on 18 Feb, 2025 09:53 PM
I received this back from my Vanguard contact today:
"...there have been multiple reports of issues with OFX and [Vanguard's tech team] are currently investigating the issue. I was told that they hope to know more by the end of the week; however, that seemed like more of a guess when it comes to the timeline."
So...not great news, yet it suggests the multiple calls/messages/etc have helped and the issue has some attention internally.
217 Posted by sth on 19 Feb, 2025 05:23 PM
Just called Vanguard. Old issue number was closed. When asked seemed to think mine was the first complaint they heard on this. Any asked to fix it and gave details again. New ticket (Repair/IT Dept) #366138
Mentioned I had been downloading since 2011 and no problems until December and it was a feature I valued at Vanguard.
218 Posted by Jon on 25 Feb, 2025 09:08 PM
FWIW, I called Vanguard last week about this and they responded today punting back to Infinite Kind / Money Dance. I told them if they don't fix it, I'll be moving my funds to Fidelity since transaction downloads work just fine there.
Have I missed an official response from Infinite Kind on this?
219 Posted by Tim on 25 Feb, 2025 09:17 PM
I did the same thing. After calling, I sent a MESSAGE. They responded that it was the fault of MD .. Today, I sent a followup message telling them of their lousy service and i am starting to transfer funds to FIDELITY. I opened a new account there over the weekend and made my first transfer today. They are not hearing us. .
220 Posted by dwg on 25 Feb, 2025 09:20 PM
TiK cannot do anything about Direct Connect unless the institution made a change in their connection information that needs to be updated in Moneydance. Nothing has been changed in DC in Moneydance that would make it stop working in itself.
So far it looks like that is not the case here, so there really is nothing that TiK can say or do.
221 Posted by roy on 25 Feb, 2025 09:20 PM
It would help to hear form Infinite Kind to know what they say about all
this.
I hate to see Vanguard go they way of Schwab and loose downloading from them
too.
222 Posted by cgrinds on 26 Feb, 2025 03:37 PM
It's not a Moneydance problem. I use https://github.com/csingley/ofxtools to download transactions from Vanguard and my automation broke Dec '24 and Feb 18 just like it did for Moneydance customers.
223 Posted by Tim on 26 Feb, 2025 03:56 PM
Received the following message update from mine a couple days ago :
Dear Timothy:
Thank you for taking the time to contact us.
Our team have sent out new guidance. They are advising to use our Download center to import your files until the matter is resolved.
You can create a report that documents your transaction history, by following these steps:
1. Select the Vanguard logo at the upper left corner of the screen.
2. Choose the “document” icon at the top of the page, then select "Statements."
3. Next, select “Download center."
4. Follow the prompts to create the report needed.
------------------------------------------------
I replied back to them that THIS is not the solution. I have 4 accounts and to be required to Manually Download and Import into my MD programs is unacceptable. I advised them that I am actively NOW starting to transfer funds OUT of Vanguard to Fidelity (which I am now doing).
224 Posted by dtd on 26 Feb, 2025 05:28 PM
I see that some are planning to move to Fidelity from Vanguard because Fidelity still supports OFX/Direct Connect.
I have Fidelity accounts as well.
The following is not meant to discourage such movement, but it might provide information on making that decision.
https://infinitekind.tenderapp.com/discussions/online-banking/1250602-vanguard-ofx-outage-recurrence-possible-solution#comment_63359842
225 Posted by Tim on 26 Feb, 2025 05:38 PM
Good points @dtd !! This is all CRAZY ... They ALL have us in a bind.
226 Posted by whitedavidp on 26 Feb, 2025 09:52 PM
For those considering Fidelity, just be aware that the way you have to handle sweep accounts will be different. I cannot seem to find the discussion I saw back when I moved some to Fidelity, but the crux of the matter was that a bunch of transactions that worked just fine when from Vanguard requires I now change the transaction type to XFER and handle the MM stuff as if it were CASH. Once I got used to it, it is only a slight PIA. Perhaps someone else can find the thread so you can have more details on this.
227 Posted by bheck11 on 27 Feb, 2025 01:10 PM
I'm ready to throw in the proverbial towel and (once again) set up Vanguard in MD+.
Meanwhile, I'm less bothered by Vanguard's ending direct (QFX) downloads than of their clown car approach to helping their customers. (1) They discontinued support for this option with zero notification to customers; (2) those responsible on the IT side have completely failed to communicate what's going on even to their own tech support operation, and (3) insofar as any communication has occurred, they have taken a "blame the victim" approach. To top it off, even to this date no one at Vanguard has bothered to clarify the situation for customers, either directly (to those who have called or messaged) or indirectly (to providers such as Infinite Kind).
I have no immediate plans to switch my very long-standing accounts, but I may be looking at alternatives for the long run. For example, my bank would be delighted to more of my investment accounts, in which I can trade Vanguard funds/ETFs at no cost. As it happens, downloading transactions from my bank requires MD+, but at least if there's an issue I can call or even visit my investment advisor, who is way more responsive than anyone at Vanguard has proven to be.....
228 Posted by whitedavidp on 27 Feb, 2025 07:47 PM
First, while I would certainly describe myself as a sophisticated user with over 35 years in software engineering and design, let me say that I am NOT a very sophisticated investor. My accounts and investment types have always been quite simple and limited. But I am also something of a control-freak - to say the least. So others may have far more complete information, experience, and conclusions about all of this...
On the subject of Vanguard vs Fidelity. I feel that we are placed between a rock and a hard place:
1. Fidelity supports direct OFX download NOW. But we have no idea about the future.
2. Vanguard direct OFX download is hosed-up NOW but there is the possibility (however minimal, I guess) that it might get fixed/restored in the future. Their customer support on this just sucks no matter how you look at it.
3. Vanguard offers manual OFX download - of a sort - NOW. However, I just used this facility and it failed to properly import a CD maturation (should be a SELL) into MD. Instead it created an XFR which required substantial hand-modification to get corrected. Previously (with the exception of share # and share price - which required minor modification), these transactions downloaded properly using direct OFX download. So who knows what other transactions will work or not?
4. At least for now, Fidelity offers only CSV history download - which is completely worthless. And there is little/no indication that this will change in the future.
It is hard - at least for me - to know which "devil" to choose. I already moved my own accounts from Vanguard to Fidelity some time ago (at that time because Vanguard decided to charge me for the paper statements I had always gotten in the past). But my wife was happy enough to stay put and loose paper statements. Moving my accounts was a PIA and Fidelity is still not perfect in its direct OFX downloading into MD. But I have since become ok with the situation until all of this Vanguard crap began.
I cannot help but feel we are seeing "the writing on the wall" for direct OFX (and possibly even manual OFX) downloads in the future. I have long ago had to deal with this at Chase and read again and again about other institutions dropping out. Plus I have had to deal with many banks that simply never had ANY OFX support at all - but those were all just CD accounts and needed manual entry only once a month - which I managed to tolerate (unhappily). If I had any degree of confidence that Fidelity will actually continue to support direct OFX well into the future, I would gladly go through the effort to change over my wife's accounts.
I mention the "writing on the wall" because it is clear that OFX integration - no matter if direct or manual - is seen by institutions as a "cost center", not a "profit center". And in these days of constant squeezing of everything to maximize (at least short term) profits, it is easy to see how/why the limited thinkers running institutions are simply giving up - and possibly - "farming out" this to 3rd parties. Personally, I find this short-sighted as such integration can also be seen as a marketing and competitive advantage IF ONLY the institutions would advertise and encourage the benefits of using these services. Clearly, those of us who might vacate Vanguard because of this demonstrate this fact - if only the institutions were listening - which they clearly are NOT.
My main problem with all of this is that I do NOT see direct OFX downloading as a mere convenience to avoid manual data entry. In these days of constant identity theft, corporate and personal computer data breaches, all without any consequences for anyone involved except the victim, I rely upon daily checks of ALL of my accounts to seek any signs of break-ins. It is not perfect but with direct OFX it is at least possible to try and keep up with most of my larger accounts. My concern is how can/will I accomplish this feat in the future? And even with all-manual OFX download (which is clearly not universally available), this would greatly increase the time needed to accomplish this chore EVERY DAY and there are only so many hours in the day...
I understand that this is not really MD's problem and that they are at the whim of the institutions. And I applaud MD for trying to find an alternative in MD+. But given my concerns about security and privacy, I don't really see how giving yet more information to yet more potentially-breached (and unaccountable) parties is really buying me much in the way of confidence (and it is adding a subscription cost to the equation as well - which, if data entry convenience was my only concern, might be worth while). I feel rather the same way about the "free" identity theft "protection" I am offered as the result of data breaches at least once a month.
I have to say that all of this presents a real conundrum to me. And I would appreciate any suggestions.
Thanks and sorry for all my rambling...
229 Posted by jonh on 27 Feb, 2025 08:37 PM
I agree w/ @whitedavidp. I only recently moved my wife's TIRA from Fid to Van just to consolidate with my other accounts in one place. Fid accounts always needed 'adjusting' after .ofx download. Although Van's .ofx download is a bit of a pain, with my 6 accounts it is not as easy as the MD ofx download.
David makes good points regarding security, something that I don't see very much concern about on this site. My suggestion is to make sure you have 2FA set up at Van so you know if your account gets accessed. Of course, this does not prevent someone from first taking over whatever you use for 2FA but there is only so much one can do to protect themselves from the ever evolving hacks.
I've considered writing a letter to Van CEO, since we, as customers, are supposedly also owners. Not sure if I'll bother with this.
230 Posted by dtd on 27 Feb, 2025 09:05 PM
I wish I could offer more than commiseration, but I'm in exactly the same boat as you.
1. OFX has been degenerating since about 2021 or so. I've been in the thick of it with USAA, Schwab, Chase, American Express, and now Vanguard (and a few other minor banks).- in 2021, all of these supported OFX direct connect. When I still had hope, I saw MD (prior to MD+) follow Schwab's specifications to keep OFX going, till Schwab changed their minds. Stuart Beesley and I worked to prop up USAA for almost a year in OFX - his USAA ONLY (NEW METHOD) still exists in Toolbox under online tools, though it is long obsolete/redacted. Folks in these 2-3 threads convinced Vanguard to put things back for about a month, till Vanguard reinstated the "kill OFX" bit.
2. Banks simply don't bother to tell their clients anything. Period. If you look at bheck11's comments about Vanguard:
"clown car approach to helping their customers. (1) They discontinued support for this option with zero notification to customers; (2) those responsible on the IT side have completely failed to communicate what's going on even to their own tech support operation, and (3) insofar as any communication has occurred, they have taken a "blame the victim" approach."
every single bank I mentioned above has done exactly the same thing. If they give any explanation it's about "security" (mostly about MFA), but are totally willing to give our personal data to an unassociated aggregator who we have no expectation of privacy other than what they say they will do.
3. Banks don't WANT you to maintain your information yourselves. They want you to come to their website, bill pay through their website, maybe even give THEM your information from other banks to maintain "for" you. Historical information? Well, ok, maybe for taxes, but no consideration of what the client wants.
4. And so it goes. So indeed it is a real conundrum, for which each person needs to decide what is as comfortable as possible for them, and what they can or cannot tolerate going forward.
I'm also in transition on this - so all I can say is where I'm currently at. I did not move to MD+ at first, for the concerns many know about - privacy, quality, paying for the privelege, etc.
But you can see the bank list and that's just my banks. I had to find an alternate way to get my data, with the standard choices: enter by hand, download manually (if possible), or an alternate download concept. Made me realize in an odd way how "good" we had it in the U.S., as most countries can't do automatic downloads at all.
I learned from that, and moved to a combination of hand entry and manual downloads for months, maybe a year.
Ultimately, I compromised and signed up for MD+ which works most of the time, is slower than OFX direct connect, and brings up the "who can see my data" bit.
Still a conundrum, and the changes are still occurring.
I wonder if I rambled even more than you....
231 Posted by whitedavidp on 27 Feb, 2025 09:10 PM
Thanks @jonh and @dtd. I will immediately enable 2FA. It is required by many of my institutions but not yet at either Vanguard or Fidelity. And while it is somewhat inconvenient, I know well that there is a trade-off between security and convenience. What is convenient for ME is VERY convenient for the bad guys.
From my security/monitoring perspective (versus the data entry perspective), in older days, monitoring monthly statements was quite good enough. But those days are gone for good and in the absence of direct OFX download, my only option -other than giving in to the 3rd parties - is to visit each institution's website daily for both my wife and myself, find/view/analyze the recent transaction history, and move on to the next one.
Clearly, this is made less painful via the consolidation into fewer institutions. But that, at least for me, reduces choice in selection of investments (for example, finding CDs with the best rate at any given time). All of this seems to serve both the never-ending force towards consolidation into fewer, mega-institutions and the lowering of costs (interest rates in this case) due to restricted choice.
I am not saying that there is some grand conspiracy afoot to do these things. But it does seem like that is what is happening all over our economy - at great potential harm in the future.
232 Posted by jonh on 27 Feb, 2025 09:19 PM
@whatedavidp, as long as you are enabling 2FA, go to the Alerts section and toggle on all (or most, depending on your preference) of the text alerts. At least that way, *maybe* if someone accesses your account you will know about it relatively quickly.
I don't find it that inconvenient. I use a Mac and the 2FA autofills within a few seconds and I simply acknowledge. For some sites I use email for 2fa rather than text because I don't want my number floating around out there. So email 2FA is inconvenient.
I don't use .ofx for any accounts except Van. and I only check it once a month, or if I make a buy/sell transaction, which I rarely do. My most manual labor intensive process is reconciling my credit card because I don't want to do it via download.
233 Posted by sth on 28 Feb, 2025 04:17 PM
MD probably has the best security of all the PFM software that I have looked at. Plaid uses OAuth IIRC which is a very secure transfer method that allows fine grain access to secure information. I regularly get reminders about that access and the ability to adjust/deny access for any of the institutions. Plaid has its drawbacks in terms of data handling and promptness but in general seems a good secure solution. Not perfect, but good.
Vanguard does use 2FA and I recommend everyone use that for any financial data. I have also been considering activating a hardware key as well. Vanguard and Schwab have use for a hardware key to control access to their services. (Yubikey? which has a biometric scan lock as well).
There is nothing inherently more secure about downloading an OFX file from Vanguard directly using 2FA or authorizing Plaid to download an OFX file from Vanguard for you using 2FA. The 2FA will be necessary to authorize Plaid as well.
234 Posted by whitedavidp on 28 Feb, 2025 07:04 PM
Thanks to all here. I do have one question for @sth: when you say "There is nothing inherently more secure about downloading an OFX file from Vanguard directly using 2FA or authorizing Plaid to download an OFX file from Vanguard for you using 2FA." and mention "Vanguard directly" are you saying that if I enable 2FA at Vanguard and if Vanguard somehow re-establishes direct OFX download into MD (as most of us here would appreciate), that I will have to perform 2FA during the MD download process? Thanks...
I am not well versed on how the whole MD+/Plaid thing will work. But it just seems like I must (1) end up giving some kind of auth info to Plaid for each of the accounts/institutions it interacts with, (2) that Plaid then gets a form of access that no other body will have had before in my current setup, (3) that I then must rely upon Plaid to keep that information and the information it retrieves on my behalf "safe and secure", and (4) I need to give MD credentials to access Plaid on my behalf. Is this correct?
Best
235 Posted by jonh on 28 Feb, 2025 08:17 PM
236 Posted by Jon on 01 Mar, 2025 01:08 PM
Done waiting for Vanguard, just initiated an asset transfer of the majority of my investments from Vanguard to Fidelity.
I started my Vanguard accounts to diversify across firms given the limits of SIPC protection, but I'll trade that for OFX for now and just pay closer attention to my classes of accounts under SIPC.
237 Posted by Tim on 01 Mar, 2025 03:41 PM
I think it would be good for anyone Transferring investments OUT of Vanguard that you let them know you are doing this, and WHY. Just send them a MESSAGE via their web site after you login. I did exactly that after initiating my first transfer.
238 Posted by whitedavidp on 01 Mar, 2025 05:15 PM
@Tim, wish I could find a way to send Vanguard a message as you mention. I have been all over. Even when I search for "Send Message", I end up in the Messages page but there is absolutely no way to send a message. I can see those that have been sent to me. There is a link to print a message that was sent to me. But no way at all for me to send one.
@236, I too made changes some time ago to try and deal with SIPC limits. Not sure what I will do at this point. At least, if Fidelity quits direct OFX access, Vanguard still has a manually-triggered OFX download which - for some reason - Fidelity does not. Alot of "if's"...
239 Posted by jonh on 01 Mar, 2025 08:28 PM
@whitedavidp wrote "I end up in the Messages page but there is absolutely no way to send a message."
On my browser logged in to my Van acct, on the page you mention, directly above the 'inbox' text there is a large oval button "compose". Click on that and proceed.
240 Posted by whitedavidp on 01 Mar, 2025 08:41 PM
Thanks much @jonh. I have tried both Firefox and Chrome. The page address is https://secure-messages.web.vanguard.com and in neither browser is there such a button. So strange!