PSA: Unauthorized API use can disable your FordPass account

[kennelh]

I bet we can all think of some incorrect utterances.

The ironic part was the account was somehow unlocked in mid-August.

Sponsored

 

[Herb]

The API used in Home Assistant's FordPass integration is the approved, public API though. Credentials aren't passed to some outside service; they're on my own machine from my own IP address. I don't have the FordPass terms of use link handy right now, but there's nothing in there that mentions we're doing anything wrong.

The way I read it, you are impersonating Fordpass when you send the API requests and the TOS say that you are not allowed to impersonate a Ford app

 

[Mach-Lee]

I'm going to add the Emporia Energy app to the bad list. There is an optional step during EVSE setup to add your car (used to view % SoC in the app), and this uses Smarcar integration (again spoofing as FordPass) unfortunately. Reading this topic it should be clear that Smartcar is a known offender that gets your account locked. If you are using the Emporia app, make sure you skip setting up the vehicle integration to avoid that risk.

 

[mkhuffman]

I'm going to add the Emporia Energy app to the bad list. There is an optional step during EVSE setup to add your car (used to view % SoC in the app), and this uses Smarcar integration (again spoofing as FordPass) unfortunately. Reading this topic it should be clear that Smartcar is a known offender that gets your account locked. If you are using the Emporia app, make sure you skip setting up the vehicle integration to avoid that risk.

That must be new. I just checked mine and there it is:

 

[mkhuffman]

@EmporiaEnergy - can you remove the MME from your list of SmartCar enabled integrations?

 

[EmporiaEnergy]

SmartCar is aware of this issue that stems from Ford's transition to a new API. SmartCar is in contact with Ford and working on a solution that we hope will come soon, but unfortunately, we have no way to exclude the MME from the supported cars in the Emporia app. We will post updates when we have more information from SmartCar and Ford.

I'm going to add the Emporia Energy app to the bad list. There is an optional step during EVSE setup to add your car (used to view % SoC in the app), and this uses Smarcar integration (again spoofing as FordPass) unfortunately. Reading this topic it should be clear that Smartcar is a known offender that gets your account locked. If you are using the Emporia app, make sure you skip setting up the vehicle integration to avoid that risk.

That must be new. I just checked mine and there it is:

@EmporiaEnergy - can you remove the MME from your list of SmartCar enabled integrations?

 

[Mach-Lee]

SmartCar is aware of this issue that stems from Ford's transition to a new API. SmartCar is in contact with Ford and working on a solution that we hope will come soon, but unfortunately, we have no way to exclude the MME from the supported cars in the Emporia app. We will post updates when we have more information from SmartCar and Ford.

Do not believe what Smartcar tells you, they lie to many developers about being an authorized user of Ford’s API. They are not authorized by Ford whatsoever to be doing what they’re doing. They are spoofing Ford’s website to illegally collect user credentials in violation of Ford’s terms of service. They should never be asking for the user’s FordPass password. I suggest you completely sever ties with them like other developers have done until an authorized API method is available from Ford.

Again, no 3rd party API use is currently authorized by Ford. If you were told Ford allows access, that is not true. Be skeptical of what they are feeding you. It is not ethical to continue to allow your users’ Ford account credentials to be stolen by Smartcar through your app with the current implementation.

 

[ThatGuyLando]

Ford's ecosystem is so messed up people have to be wary what brand of charger they buy...

 

[Mach-Lee]

This is interesting, looks like Hyundai also is having the same 12V drain issues caused by 3rd party apps spamming the Ioniq 5:

https://insideevs.com/news/658984/hyundai-finds-causes-for-ioniq-5-12v-battery-drain-reveals-fixes/

They said some of the 3rd party apps were pinging the car 5000 times per day! Recurrent and Optiwatt seem to be some of the apps causing problems with Hyundais, so good 'ol Smartcar is up to their dirty tricks again...

Hyundai added an API request limit of 20/day and also blocked certain apps from their servers like Ford did.

PSA - Don't ever use an app that uses Smartcar API to access your vehicle data. Seeing them continue to excessively ping other brands of vehicles cements that they are up to no good.

 

[Eric_C_Boston]

I lost access as well, after using both Tronity and the Home Assistant integration. Just to be safe I disabled both - having access to the FordPass app on a new phone outweighed any benefit from those two services. I just wanted to outline what I did to get access back, as it took about two weeks when doing it the *wrong* way with no success. Skimming through the threads here led me to this path:

1. Call the customer service 800 line - this was very quick and got me to an actual human.

2. Tell them you are locked out of the FordPass app and need to speak with a FordPass Guide. DO NOT go into detail about being locked out of the website, etc.

3. When you get to the FordPass guide, tell them you are seeing the an error when attempting to log in to the app. They will ask for the message, read them the CSIAH0320E code. When they enter this on their side, they will see it needs escalation. They will ask for a few details and file a ticket.

4. Wait for a callback. This will be someone who knows what they are doing - the person I spoke with actually uses Home Assistant. They will then berate you for giving away your account info (nicely, of course), and then file a ticket with the IT security team.

5. Wait for an email about the IBM login information being updated. At this point, you should have access back. Huzzah!

From start to finish, this approach took less than 24 hours to get me back online. Previous attempts where I confused the agent led to multi day waits, the wrong team being sent the ticket, and told that I needed to go to a dealer so they could update me to the universal SYNC 3 update. Seriously.

Some additional notes on the steps:

1. The 800 number was very quick to answer. I had tried the online chat and failed to get through. Alternatively, if you still have access to the FordPass app (I didn't - new phone) you can attempt to contact a FordPass guide directly. If so, skip to step 3.

2. This step is just to get you past the first level of support. They may ask you a few questions (app version, system version). Just answer as concisely as possible. Try not to engage in small talk about why you had the problem, where else you are seeing it, what services may have caused it. This will just confuse the agent, who is largely operating from a script.

3. Same story with this agent. Don't confuse them, you just want to get to the escalation step as fast as possible. Answer their questions as succinctly as possible, with as little detail as needed.

4. This agent actually understands technology. I am not sure if they are an agent or someone drawn from their engineering group, or perhaps someone higher up in the support chain (eg a support tech lead). They will caution you about giving out your account info. If you want to try and complain to this person about about how bad the third party integration is, this may be your best bet. But consider doing it politely. I didn't bother, I was just happy to get my access back.

Thank you for the procedure! My FordPass got locked out today so I made sure my Charge Smart MA account was disconnected from the car. I had to email ev.energy support to have them do this manually as there is no way to disconnect in the application. I also applied to deactivate my account.

There was an automated attendant at the initial call-in. I said that I am locked out of FordPass and needed to talk to a FordPass Guide. The next person I talked to was a FordPass Guide. I mentioned the error code and with a couple of brief periods of me on hold, created the ticket and said I should get an email in 24 to 48 hours when my account is reinstated.

 

[Eric_C_Boston]

I did not receive an email so I called back this morning. The representative found my ticket and had to talk to the team a couple of times. I had to tell them again that I discontinued the third-party app. The representative said to wait 24 to 48 hours for my account to be enabled.

I checked and no email until I checked in the spam folder. I got the message a short while after I hung up the phone. I signed on via the website and changed my password.

I was able to sign into FordPass! I got a message telling me to enable connectivity functions in the car. I went out to the car and most of the connectivity settings like sending location was disabled. I had to turn navigation and Ford Assistant on again. I do not know how they got turned off.

The last charge log is from August 7th and several charge sessions since then were not picked up. I have been having a problem since May of the Est. distance added being in KM instead of miles. I noticed the August 7th log now shows miles instead of KM. I suspect these were side effects of my account being disabled. FordPass worked for several months longer because it remained logged in.

Thanks again for the information on how to get my account back. Fortunately I have logs from my home charger to fill in some of the missing blanks.

Sponsored