My Treasury Direct experience

[porcupine]

It was a breeze!

I had not logged into Treasury Direct in over a year, and have only been vaguely been following the threads of lockouts, invalid/non-existent card, etc. So, when I did try to log on during the weekend, I found out that the procedures have changed, and the first thing that happens is that a code is mailed to the e-mail address on record. Well, I requested the e-mail, and did when I realized, after checking all my active e-mail accounts, that I must have had an older e-mail address on record with them.

I was prepared to wait for an hour or two on the phone and have a generally unpleasant experience. However, once I clicked the right numbers on the phone in response to the automated questions, within a couple of minutes, I was speaking with an agent who - after confirming my identity via the security questions - reset my e-mail address. I would assume that he had the power to unlock my accounts as well (had I run into that issue).

- Porcupine

[3504PIR]

Treasury Direct difficulties are over-rated on this forum, not sure why but I've assumed it is the less computer savvy posters who have the issues.

[porcupine]

Treasury Direct difficulties are over-rated on this forum, not sure why but I've assumed it is the less computer savvy posters who have the issues.

Well, nisi has over 16,000 posts on Bogleheads!

nisi:

You might want to try calling them early in the morning like I did yesterday.

- Porcupine

[3504PIR]

good point. I'm now back to having no clue why so many have issues.

[willwheels]

The issue I had was that I didn't realize that they are very, very serious about not using the browser's Back button. It's so ingrained, I didn't even realize that I was doing it, but now that I've learned to relax and use their buttons, my experience is much smoother.

[Epsilon Delta]

good point. I'm now back to having no clue why so many have issues.

There is only one reason many people have trouble with a web site: The web site is badly designed.

[MarcMyWord]

There is only one reason many people have trouble with a web site: The web site is badly designed.

What do you personally think of the design of the TreasuryDirect site? I find it functional but somehow just a little bit clunky--for reasons I can't quite explain because I don't know much about site design or graphic design. I guess that a good site somehow feels very "natural" or "intuitive."

[bourg]

Treasury Direct difficulties are over-rated on this forum, not sure why but I've assumed it is the less computer savvy posters who have the issues.

I'm a Computer Scientist who architects custom web applications for a living and also does Project Management work for a website security firm. I quit using the site a few months ago, sold all my bonds, and moved them to a vanguard account. My main reasons were the unreasonable amount of security at the sacrifice of usability and the terrible user interface design. The cost of my worry about remembering how to access the site properly and having to call them all the time to get my account "unlocked" was not worth having bonds there. It was painful every time I logged in to do anything at all - all the way from the login process to trying to actually do anything inside the account.

But its a personal choice. If you like it, go for it. Its just not for me.

[Noobvestor]

Treasury Direct difficulties are over-rated on this forum, not sure why but I've assumed it is the less computer savvy posters who have the issues.

I make a living with computers. I am in my early 30s and grew up on BBS's and free AOL discs. Here were my issues today (yes, coincidentally, today):

1) I was called upon to not only remember ANSWERS to security questions, but also to remember WHICH security questions I had answered. The former is easy, the latter hard - did I pick 'town of birth' or 'favorite author'? Who knows?!

2) So I tried, and failed, to recall *the questions* I had answered - not the answers. After thus locking myself out (only had two shots at it!) I had to call in and wait for half hour on hold (yes, a full half hour of hold music - never had that outside a phone company). I then answered the questions, and a number of other questions, to convince them I am who I say I am.

3) They had some difficulty locating my account, because I have both a Legacy and regular Treasury Direct account. Thankfully, they did ultimately, when I pushed to ask whether both would show up on the screen (we easily could have miscommunicated here, and had him convince me that I had only the Legacy account).

4) I gave out every security answer to every question, as well as my social, driver's license and bank account numbers - frankly, I find that *less secure* if anything - now this guy if he were industrious could basically access anything I own.

5) When I finally got all of the information (i.e. the questions I had answered) and got off the phone, whoops, it turns out there was a password they didn't re-give to me when they told me my security questions/answers, so I had to get a temporary code sent to me by email (twice, long story, but it had to be twice,).

6) I finally get into the system, and wow, right there, in front of me, so easy, I just put in the number and say 'buy $X in I Bonds' - but wait, I do it, and it warns me I've refreshed/reloaded or gone back a page and that I shouldnt' do that (yes yes, we all know secure accounts work this way ... except ... I did no such thing!). So I try clicking to something, anything, else and it tells me TreasuryDirect is currently unavailable.

7) I try logging out, to which I get, again, inexplicably, that the service is unavailable - what, I can't even log out? Except, it DID log me out, because when I loaded a new page I was able to log back IN, and THIS TIME I was able to buy my $#!$#!ing I Bonds.

8) There was also no confirmation page to 'commit' me to this action - fortunately, I knew exactly what I wanted to buy, and correctly guessed it was tied to the right account, but I was only told *after* my purchase that it was tied to account # ending in XXXX - this is the most minor and final complaint I have.

This is hands down the most difficult, cumbersome, and error-laden process I have ever encountered on the internet.

[TrustNoOne]

I have had a few problems with T-direct, but generally overcame them. I'm not a professional ITguy, but use computers a lot. As for the problem of remembering passwords, and security question answers, there is a very simple solution - I have a file which I keep on a jump drive that has my passwords, account numbers and security answers etc. Whenever I log in I plus it in and pull what I need from it. Now, of course, I suppose someone could break into my house and steal my jump drive, but I think the odds of that are lower than having someone steal my passords, etc on my computer. Plus, I can hide my jump drive in plain sight since I have so many of them.

Aside from writing it all down on paper (which also suffers the same problem, with far less convenience) I see no way a normal person can possibly remember every password, security question etc for all the various accounts they have floating around.

One thing that is a problem is case sensitive passwords, and answers. The jump drive solves that too.

[bourg]

Aside from writing it all down on paper (which also suffers the same problem, with far less convenience) I see no way a normal person can possibly remember every password, security question etc for all the various accounts they have floating around..

I like LastPass.com for that. Nifty Chrome and Firefox extensions for it too.

[tetractys]

I think that at one extreme there are people who don't mind looking all around and figuring things out, whereas at the other extreme are people who want direction of various kinds at every step. The former seem to do better online where every new website can be like stepping into a whole new environment. So for some TD is just another web site to learn to navigate without any outside help; but for others screaming HELP! where that help is limited, it can be tough.

Passwords and security questions? Of course these have to be written down or documented, and kept secure. That's just common sense. -- Tet

[Noobvestor]

Passwords and security questions? Of course these have to be written down or documented, and kept secure. That's just common sense. -- Tet

You're kidding, right? For work and personal things, I have around a dozen passwords. Half of those I wouldn't write down anywhere for security reasons, but I have no trouble remembering them. NONE of them is hackable by conventional means - all are ones that I derived through a series of random processes, then made memorable (I won't go into more detail, but they are foolproof to any dictionary or variant attack). In my book, not writing your key passwords down is common sense.

And I *never* have had a website ask me to answer security questions, then *remember which questions I answered too* - I can answer ANY security question they throw at me, but someone sure should have warned me I'd have to remember which questions I answered to. And writing it down is NO solution - defeats the purpose of security. How does it make *any sense* to demand I remember which questions I answered? I can answer all of them if they want, but the task is misleading from the start - they set you up to remember your answers, not your questions!

Sorry, but unless you can find me another site that puts up this many hoops, I will continue to maintain that they are cruel and unusual

[Noobvestor]

I have a file which I keep on a jump drive that has my passwords, account numbers and security answers etc.

The absolute worst thing you can do for personal security is put all of those things in one place. I don't care what that place is. At the *very least* you should separate out the passwords from the accounts from the security questions, etc... so that there isn't a skeleton key lying around from which someone could hijack your whole life.

[getRichSlower]

In my book, not writing your key passwords down is common sense.

Normal people, or 99% of the population, can't remember cryptographically secure passwords. Of course, they have to write their passwords down.

[Noobvestor]

In my book, not writing your key passwords down is common sense.

Normal people, or 99% of the population, can't remember cryptographically secure passwords. Of course, they have to write their passwords down.

Yes, write it down in a secure location maybe, not on a jump drive alongside all of your other relevant information. I have a *few* passwords for things that don't need as much security and are less frequently accessed written down, but they are split up and not given context, so that at *least* someone would have to try and sort out what they go to were they to find them (presuming they were even able to infer what they were looking at was a password). Note: you can also encrypt your own when you put them to paper.

Wikipedia:

mnemonic passwords: Some users develop mnemonic phrases and use them to generate high-entropy (more or less random) passwords which are nevertheless relatively easy for the user to remember. For instance, the first letter of each word in a memorable phrase. Silly ones are possibly more memorable.[31] Another way to make random-appearing passwords more memorable is to use random words (see diceware) or syllables instead of randomly-chosen letters.

after-the-fact mnemonics: After the password has been established, invent a mnemonic that fits.[32] It does not have to be reasonable or sensible, only memorable. This allows passwords to be random.

It's like phone numbers - you figure out a way to remember them despite their randomness, after the fact, you don't derive them from something memorable in the first place. I'll admit, studies show that going past ~7 is hard, but there are ways around that (phrases, etc...) and sufficiently-random seven-figure passwords at least beat what most people use for most of their passwords.

[porcupine]

In my book, not writing your key passwords down is common sense.

Normal people, or 99% of the population, can't remember cryptographically secure passwords. Of course, they have to write their passwords down.

For example, nannaDikraOkaTimoonudoN - that is a password encrypted in five languages! Plus you will need to know the name of someone's relative ... and then figure out the username

For the record (as the OP), I logged in and logged out without any issues. My old password worked. I did notice a dramatic fall in the customer satisfaction. I remember back in the days when you could use a credit card, the satisfaction ratings were in the 70+% range for excellent, 10-20% range for good, and a handful for fair and negligible for poor, Now, when I logged out, the distribution was 47-30-11-12!

One more point - my OP was really about reaching customer service to resolve issue. Not the issue as such. Most of what I remember reading here was folks complaining that they were on hold for 30 minutes or more. Like I said, my hold time was minimal - maybe others ought to try calling early Monday morning, like right around 8 am (I forget whether I called before or after). Obviously, all this comes with a YMMV disclaimer - I might not have won the jackpot, but maybe I lucked out on my TD call!

- Porcupine

PS: I am not telling whether or not a) it is case sensitive b) it really is a password!

[Epsilon Delta]

Security questions were originally used as a human friendly method to identify yourself to a human at the help desk. Treasury Direct has turned this into a perverse anti-Turing test. They should stop calling them "security questions" and call them what they are really are: "secondary and tertiary passwords". If TD identified them correctly it would be more obvious how the user should treat them.

[tetractys]

Passwords and security questions? Of course these have to be written down or documented, and kept secure. That's just common sense. -- Tet

You're kidding, right? For work and personal things, I have around a dozen passwords. Half of those I wouldn't write down anywhere for security reasons, but I have no trouble remembering them. NONE of them is hackable by conventional means - all are ones that I derived through a series of random processes, then made memorable (I won't go into more detail, but they are foolproof to any dictionary or variant attack). In my book, not writing your key passwords down is common sense.

No I'm not kidding. Since you've got a perfect memory for passwords but not for security questions, maybe you should think about documenting the security questions in a secure way--might save you headaches. Lot's of financial sites use the security questions, and they don't always fit the user, who may just have to pick one in a procrustean way and assign it some random answer. Personally I'm not so perfect remembering even the passwords, so I document the whole kit and caboodle, questions, answers, and even the passwords. But I do keep that stuff secure; it would be hard for someone to find it, and even if they did, close to impossible for them to utilize it.

Bottom line though, I like my ibond ladder which is earning around 5%. -- Tet

[Noobvestor]

Passwords and security questions? Of course these have to be written down or documented, and kept secure. That's just common sense. -- Tet

You're kidding, right? For work and personal things, I have around a dozen passwords. Half of those I wouldn't write down anywhere for security reasons, but I have no trouble remembering them. NONE of them is hackable by conventional means - all are ones that I derived through a series of random processes, then made memorable (I won't go into more detail, but they are foolproof to any dictionary or variant attack). In my book, not writing your key passwords down is common sense.

No I'm not kidding. Since you've got a perfect memory for passwords but not for security questions, maybe you should think about documenting the security questions in a secure way--might save you headaches. Lot's of financial sites use the security questions, and they don't always fit the user, who may just have to pick one in a procrustean way and assign it some random answer. Personally I'm not so perfect remembering even the passwords, so I document the whole kit and caboodle, questions, answers, and even the passwords. But I do keep that stuff secure; it would be hard for someone to find it, and even if they did, close to impossible for them to utilize it.

Bottom line though, I like my ibond ladder which is earning around 5%. -- Tet

I'm kinds of assuming at this point that you simply misunderstood my point. I have no trouble remembering or figuring out how to save things I'm told I will need to remember (e.g. the answers to security questions, passwords I use for websites, etc...) but I have a *major issue* being asked to recall *questions* (NOT ANSWERS) that I was asked on a particular site. I was given NO reason to believe that part of the quiz was to later remember which questions were ON the quiz - I thought the ability to answer them was enough!

[acr123]

I will be opening a TD account shortly. If I understand the prior "discussions" I should make a mental note ( or write down) which security questions I chose to answer since if there is a problem in the future I will be asked which security questions I originally answered. I agree with others that no other site I have visited asked me which of the following security questions I originally answered. It seems that it used to be good enough to remember only the answers to questions.

Al

[MariaT]

Just got off the phone with Tresury Direct (security dept) and good to go. Acquired my one-time pass code and they reset my old email address to a new one.
Here's the number to call (DO NOT USE THE 800# - this will get you nowhere) - 304.480.7711 (Dept of Public Debt Security). The agent I talked to was very helpful and nice. He did suggest to call early in the morning before everyone gets bogged down. Like Porcupine said, "it was a breeze."

Warm regards,
Maria

[bourg]

In my book, not writing your key passwords down is common sense.

Normal people, or 99% of the population, can't remember cryptographically secure passwords. Of course, they have to write their passwords down.

correcthorsebatterystaple

http://www.xkcd.com/936/

"Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess."

[porcupine]

Just got off the phone with Tresury Direct (security dept) and good to go. Acquired my one-time pass code and they reset my old email address to a new one.
Here's the number to call (DO NOT USE THE 800# - this will get you nowhere) - 304.480.7711 (Dept of Public Debt Security). The agent I talked to was very helpful and nice. He did suggest to call early in the morning before everyone gets bogged down. Like Porcupine said, "it was a breeze."

Warm regards,
Maria

I did not know about the 800#, else I would have specified the number I used. I used the above number as well (though I did not talk with my agent about a good time to call). Maybe therein lies the difference?!

- Porcupine

[Noobvestor]

I will be opening a TD account shortly. If I understand the prior "discussions" I should make a mental note ( or write down) which security questions I chose to answer since if there is a problem in the future I will be asked which security questions I originally answered. I agree with others that no other site I have visited asked me which of the following security questions I originally answered. It seems that it used to be good enough to remember only the answers to questions.

Al

That is correct, and was my sticking point. I was locked out because I failed twice to remember which questions I answered, despite knowing the correct answer to all of the questions. I was able to whittle down the list based on things that could have multiple answers (knowing that I would have avoided those questions as a result), but not enough to be sure I had the right three.

[expat]

Treasury Direct works fine until it doesn't.

They don't consistently answer their phones, or even return phone calls and they follow draconian and unusual security practices.

[TheGreyingDuke]

Wondering if some of the difficulties may be attributable to browser choice. Reading this thread prompted me to try to log into TD, without thinking I used Chrome and hit a wall, the site wouldn't give me a place to enter my password. Switched to my usual Firefox (that is usual for Vanguard and the like) and no problem.

One other thought, I don't get asked secret questions, I always require that a one time passcode be sent, that may obviate the need for the security questions?

[Dick D]

I have been logging on to the site quarterly for the past 5 years with no issues.

[porcupine]

Wondering if some of the difficulties may be attributable to browser choice. Reading this thread prompted me to try to log into TD, without thinking I used Chrome and hit a wall, the site wouldn't give me a place to enter my password. Switched to my usual Firefox (that is usual for Vanguard and the like) and no problem.

One other thought, I don't get asked secret questions, I always require that a one time passcode be sent, that may obviate the need for the security questions?

For what it is worth, I have been using Chrome about 90% of my internet time in the last few months.

The once I logged back in after using the passcode, I don't remember having been required to figure out what my secret questions are. But I cannot be more definitive as I have not logged in too often ...

The only issues I have had with Chrome is with printing online PDF files and with the "print to PDF" option. But this is not related to TD.

- Porcupine

[blevine]

Use Chrome lately. While I have no problems logging in today,
I seem to get that request for a one time password via email once in a while.
Don't recall if I see this problem with other browsers too, today I can login
easily using MSIE and Chrome.

I think if you don't login for a period of time, the "cookie" is expired
and you need to reset it via their email of single use pwd.

[neurosphere]

Use Chrome lately. While I have no problems logging in today,
I seem to get that request for a one time password via email once in a while.
Don't recall if I see this problem with other browsers too, today I can login
easily using MSIE and Chrome.

I think if you don't login for a period of time, the "cookie" is expired
and you need to reset it via their email of single use pwd.

I frequently need to get that "one-time" passcode with Chrome, even if I select "remember this computer". I don't know if it's because the cookies expire, or because I occasionally log in from another computer (and perhaps this 'resets' the original computer). It is mildly annoying, but takes less than 5 extra seconds of my time, and it IS an extra level of security.

NS

[getRichSlower]

It's like phone numbers - you figure out a way to remember them despite their randomness, after the fact, you don't derive them from something memorable in the first place. I'll admit, studies show that going past ~7 is hard, but there are ways around that (phrases, etc...) and sufficiently-random seven-figure passwords at least beat what most people use for most of their passwords.

These days the only phone numbers anyone really remembers anymore is their own. The rest get saved in contacts. More to the point, a seven digit phone number only has 10^7 possibilities, which equates to about 24 bits of data. Maybe twenty years ago, that was secure. These days, it isn't secure against any hacker with a couple of high end work stations that can run overnight in an offline attack.

[imagardener]

I just spent a frustrating 10 days attempting to access our TreasuryDirect account that previously worked well although I haven't logged on for a couple months. The site no longer recognized my computer so sent temporary passcodes. Unfortunately it spewed out THREE of them and I unknowingly entered the first one which it wouldn't accept, only the last one is acceptable and since I didn't know there were more in incoming email it shut me out of my account and said to call them.

I called and waited, called again 3 days later and waited, called again in 3 days. No response in 10 days. So I dug up a direct line to a real person I spoke to 2 years ago and he returned the call. Turns out the new website is a Treasury fiasco and he has been working 12 hours days including Saturdays since December. No it is not a enduser (that's me) lack of computer savvy it is a TD problem.

I managed to make one purchase request but it would not complete the second one and locked me out again. No I did not use a "back" button, no I did nothing wrong. The TD interface is just not functional and without a way to purchase I Bonds any other way than TD it seems like a big problem for small investors like me.

I hope my story will make others feel better if they are having problems while others say it's their lack of capability. It's not you, it's them (Treasury Direct).

[chohmann]

I had the same experience. I tried logging into my account from a different computer, used the wrong one-time-password (OTP) and received a message indicating that my account had been locked for security reasons. I've been trying to contact then everyday since last Tuesday. I've waited on the automated phone line, left voice mails and tried contacting them via the website. Not once did I receive a response. Finally, yesterday, I was able to get through to an operator after waiting for ~30 minutes. They unlocked my account and I am now able to login. From a user experience perspective TD is one of the most poorly designed sites I have ever come across. FYI, for others who may encounter similar problems, it appears that the automated phone system was finally changed so that you are not automatically kicked out to voice mail after two notices indicating all operators are busy. Now you can wait on hold indefinitely until you get through to an operator.

[englishgirl]

I am SO glad to be done with TD. I thought I was done last year, actually, but then they didn't send me a 1099, so I had to try to log in again in order to do my taxes. It took an AGE, and again went through so many ridiculous levels of security, but at least I didn't get locked out again or have to call. Although the one time I did call they were very nice and helpful, but still. I SHOULDN'T HAVE TO CALL! Especially not after entering my name, address, date of birth, social security number, driver's license number, plus whatever else, then after that several security questions, and THEN going through the hoop of getting one time passwords (several times).

I am not using TD again unless they radically overhaul their site and "security theater."

Haha, sorry, I had nothing useful to add, I'm just piling on. But it was traumatic trying to log in last week with the tax deadline looming and reading about the difficulties of getting through by phone.

[KarlJ]

After reading about some of the negative experiences with the new TD security arrangement, I was not looking forward to dealing with logging in after the many months of inactivity since I last logged in. However, using Internet Explorer, in my case, the process of logging in was accomplished without a hitch using the one-time password I received via email as soon as the logon screen appeared. Overall I found the process of logging into TD to be relatively painless, certainly better than the previous procedure using code matrix card.

[John151]

I agree that Treasury Direct's website is quirky and clunky, but this wouldn't be a serious problem if Treasury Direct provided enough representatives to answer telephone calls promptly. On the rare occasions that I've had website problems with Vanguard or my bank, my phone calls have been answered within a minute or two, and the problems were quickly resolved. The same should be true for Treasury Direct.

[imagardener]

I agree that Treasury Direct's website is quirky and clunky, but this wouldn't be a serious problem if Treasury Direct provided enough representatives to answer telephone calls promptly. On the rare occasions that I've had website problems with Vanguard or my bank, my phone calls have been answered within a minute or two, and the problems were quickly resolved. The same should be true for Treasury Direct.

I was told by a Treasury worker that their office is relatively small. This may be because the bulk of customers are electronic and prior to that most/all made purchases through their bank. The employees I've talked to have been uniformly pleasant even in the face of this difficulty and to quote one "We have always taken pride in our courteous service".
I've been an electronic customer for several years starting when the Treasury was paying better rates than bank CD's and I didn't have to slog to each bank and sit and sit and sit for the privilege of opening a CD. With the Treasury I don't have to worry about FDIC limits and don't have to leave home.

[Epsilon Delta]

I agree that Treasury Direct's website is quirky and clunky, but this wouldn't be a serious problem if Treasury Direct provided enough representatives to answer telephone calls promptly. On the rare occasions that I've had website problems with Vanguard or my bank, my phone calls have been answered within a minute or two, and the problems were quickly resolved. The same should be true for Treasury Direct.

Some people give high customer scores to organizations that deal with problems well. I don't. I give high customer service scores the organizations that don't have problems. In other words having more representatives would be a bandage, not a fix.

[rustymutt]

Treasury Direct difficulties are over-rated on this forum, not sure why but I've assumed it is the less computer savvy posters who have the issues.

I to had some initial issues with Treasury Direct, but have since had none. As to your assumption that less computer savvy posters had the issues. I'm computer savvy, and they had issues.