Unable to use Selenium to automate Chase site login

Question

When I try to log into the Chase website using Selenium (Python), I'm hit with the following error message:

However, using "human" login works fine. It seems that when Selenium finds an element it triggers the issue.

Am I missing something? I've tried to find the answer on stackoverflow but to no avail.

Update:

The expected result is that the script would successfully allow me to login programatically.

Here's the code sample below:

import time
import os

from selenium import webdriver

CHASE_USER_ID = os.getenv('CHASE_USER_ID', None)
CHASE_PASSWORD = os.getenv('CHASE_PASSWORD', None)

assert CHASE_USER_ID is not None, 'Chase user id not set'
assert CHASE_PASSWORD is not None, ' Chase password not set'


def main():
    chrome_options = webdriver.ChromeOptions()
    driver = webdriver.Chrome(r'./chromedriver', chrome_options=chrome_options)

    try:
        driver.get('https://secure07c.chase.com/web/auth/#/logon/logon/chaseOnline?')

        time.sleep(2)

        user_element = driver.find_element_by_id('userId-input-field')  # Finding an element here seems to make the login process fail 
        user_element.send_keys(CHASE_USER_ID)

        password_element = driver.find_element_by_id('password-input-field')
        password_element.send_keys(CHASE_PASSWORD)

        time.sleep(2)

        password_element.submit()

        time.sleep(10)
    finally:
        driver.quit()


if __name__ == '__main__':
    main()

Chase may just be blocking your Selenium operations. The intuition behind it is that they are trying to combat the threat of cyberhacking (brute-forcing into people's accounts) — Chipmunkafy, Dec 04 '18 at 05:14
bot detection is pretty common, and selenium is trivial to detect.. not sure what the actual question is here. — Corey Goldberg, Dec 04 '18 at 06:39
Thanks for the responses. My question is whether there's a way to bypass their "selenium detection". At the comment in the code block, whenever I run past that line (presumably anything selenium-related), Chase will block the login with the aforementioned screenshot. — jsmiao, Dec 04 '18 at 16:06
@jsmiao I can't tell you want to do, but 'scraping' a national regulated bank will obviously show a red flag to the higher ups, and might get you in legal trouble. So I wouldn't recommend you to bypass their 'Selenium detection'. — Chipmunkafy, Dec 04 '18 at 20:34
The purpose is purely pedestrian and innocent. I would like to programatically pay bills faster than the auto-pay. Thank you for your input though! — jsmiao, Dec 05 '18 at 03:03
@jsmiao, have you found a work around for this? I am experiencing the same problem. — J. Dykstra, Dec 11 '18 at 15:53
@J.Dykstra, unfortunately I haven't. My guess would be there's some front end code getting triggered. I suppose a workaround would be using a macro recorder tool. In the past I've used this, which I think is the cleanest: https://www.jitbit.com/macro-recorder/ — jsmiao, Dec 12 '18 at 16:09
So I am able to record and replicate any action do on my computer with this tool? Pretty neat. Thanks @jsmiao — J. Dykstra, Dec 12 '18 at 16:37
Did you find a solution for this? I'm having the same problem — RollRoll, Jan 20 '19 at 01:01

undetected Selenium · Accepted Answer · 2020-01-28T09:24:11.357

I took your code and simplified the structure and ran the test with minimal lines of code as follows:

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support import expected_conditions as EC
from selenium.webdriver.support.ui import WebDriverWait


options = webdriver.ChromeOptions()
options.add_argument("start-maximized")
options.add_argument("--disable-extensions")
driver = webdriver.Chrome(chrome_options=options, executable_path=r'C:\Utility\BrowserDrivers\chromedriver.exe')
driver.get("https://secure07c.chase.com/web/auth/#/logon/logon/chaseOnline?")
WebDriverWait(driver, 20).until(EC.element_to_be_clickable((By.CSS_SELECTOR, "input.jpui.input.logon-xs-toggle.clientSideError"))).send_keys("jsmiao")
driver.find_element_by_css_selector("input.jpui.input.logon-xs-toggle#password-input-field").send_keys("hello")
driver.find_element_by_css_selector("button#signin-button>span.label").click()

Similarly, as per your observation I have hit the same roadblock with the error as:

Chase Login Failure Image

It seems the click() on the element with text as Sign in does happens. Though the username / password lookup is initiated but the process is interupted. While inspecting the DOM Tree of the webpage you will find that some of the <script> tag refers to JavaScripts having keyword dist. As an example:

<script src="https://static.chasecdn.com/web/library/blue-boot/dist/2.20.3/blue-boot/js/main-ver.js"></script>
<script type="text/javascript" charset="utf-8" async="" data-requirecontext="_" data-requiremodule="blue-vendor/main" src="https://static.chasecdn.com/web/library/blue-vendor/dist/2.11.1/blue-vendor/js/main.js"></script>
<script type="text/javascript" charset="utf-8" async="" data-requirecontext="_" data-requiremodule="blue/main" src="https://static.chasecdn.com/web/library/blue-core/dist/2.16.3/blue/js/main.js"></script>
<script type="text/javascript" charset="utf-8" async="" data-requirecontext="_" data-requiremodule="blue-app/main" src="https://static.chasecdn.com/web/library/blue-app/dist/2.15.1/blue-app/js/main.js"></script>

Which is a clear indication that the website is protected by Bot Management service provider Distil Networks and the navigation by ChromeDriver gets detected and subsequently blocked.

Distil

As per the article There Really Is Something About Distil.it...:

Distil protects sites against automatic content scraping bots by observing site behavior and identifying patterns peculiar to scrapers. When Distil identifies a malicious bot on one site, it creates a blacklisted behavioral profile that is deployed to all its customers. Something like a bot firewall, Distil detects patterns and reacts.

Further,

"One pattern with Selenium was automating the theft of Web content", Distil CEO Rami Essaid said in an interview last week. "Even though they can create new bots, we figured out a way to identify Selenium the a tool they're using, so we're blocking Selenium no matter how many times they iterate on that bot. We're doing that now with Python and a lot of different technologies. Once we see a pattern emerge from one type of bot, then we work to reverse engineer the technology they use and identify it as malicious".

Reference

You can find a couple of detailed discussion in:

Thanks! Additional questions: I found my Safari browser blocked accessing www.whitepages.com, and based on this answer concluded it was Distil doing it. Inspecting, there is a page "dstl-wp.js" and it has some Safari-specific code in there. I wasn't scraping, just browsing. Eventually I figured out my ExpressVPN location in the USA was affecting it, and it finally worked shifting to different locations. 1) Any idea why it fails out presumably based on my IP location; seems like a false positive? 2) Any further useful reference information? — learning2learn, Aug 14 '20 at 19:57
I came across this answer and wanted to point out that `dist` is not an indication of the the `Distill` network, the actual meaning of `dist` in these urls is `distribution` and it is a common practice to have `dist` folder in the libraries that refer to the code which is intended for distribution purpose. You can find more info on this pattern [here](https://stackoverflow.com/questions/23730882/what-is-the-role-of-src-and-dist-folders) — asimhashmi, Aug 19 '21 at 13:39
@learning2learn It's not the location per se, it's that ExpressVPN (and all VPNs) rotate through shared IP address pools. So somebody did "bad" behavior with that IP address before you used it and it's been marked on some blacklist. It's really annoying, happens to me all the time even though it's just me using a normal browser. Because of bots, sites assume VPN users are bad even though we just value our privacy. /soapbox — Joel Wigton, Oct 19 '21 at 15:40

Unable to use Selenium to automate Chase site login

Update:

1 Answers1

Distil

Reference

Linked

Related