{"action":"opened","issue":{"url":"https://api.github.com/repos/plaid/support/issues/124","labels_url":"https://api.github.com/repos/plaid/support/issues/124/labels{/name}","comments_url":"https://api.github.com/repos/plaid/support/issues/124/comments","events_url":"https://api.github.com/repos/plaid/support/issues/124/events","html_url":"https://github.com/plaid/support/issues/124","id":67842102,"number":124,"title":"BofA stops asking MFA questions too early","user":{"login":"pgorsira","id":1266295,"avatar_url":"https://avatars.githubusercontent.com/u/1266295?v=3","gravatar_id":"","url":"https://api.github.com/users/pgorsira","html_url":"https://github.com/pgorsira","followers_url":"https://api.github.com/users/pgorsira/followers","following_url":"https://api.github.com/users/pgorsira/following{/other_user}","gists_url":"https://api.github.com/users/pgorsira/gists{/gist_id}","starred_url":"https://api.github.com/users/pgorsira/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgorsira/subscriptions","organizations_url":"https://api.github.com/users/pgorsira/orgs","repos_url":"https://api.github.com/users/pgorsira/repos","events_url":"https://api.github.com/users/pgorsira/events{/privacy}","received_events_url":"https://api.github.com/users/pgorsira/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-11T22:58:51Z","updated_at":"2015-04-11T22:58:51Z","closed_at":null,"body":"Have seen this with 2 of our users. The user logs into BofA and we send that info to Plaid. Plaid indicates that there is MFA required. User completes MFA. Plaid indicates there is no more MFA. Attempt to list accounts for user by hitting `/auth/get`. Plaid gives the following response:\r\n\r\n{\r\n  \"code\": 1215,\r\n  \"message\": \"mfa reset\",\r\n  \"resolve\": \"MFA access has changed or this application's access has been revoked. Submit a PATCH call to resolve.\",\r\n  \"access_token\": \"<user's access token>\"\r\n}\r\n\r\nWhy did Plaid stop asking MFA questions? Technically, we could handle this situation, but to do it elegantly would require some persistence of user bank login credentials (which is also bad) - we can't ask the user to re-login right after they just logged in. Instead, it seems like \"MFA access\" should not change right after onboarding a user into Plaid. Correct me if I'm wrong, but it seems like the idea is to get all of the MFA out of the way right away.\r\n\r\nCan provide access tokens upon request."}}