TurboTax accounts hacked, delaying tax refunds, compromising personal information, impairing credit rating

So you want to file your taxes online by using TurboTax, by Intuit?  Perhaps you should think again.  An audacious gang of online criminals have been systematically targeting TurboTax, filing fraudulent tax returns of individuals, and diverting their tax refunds to prepaid debit cards. The vulnerability of online tax preparation services became apparent last month when the Utah Tax Commission and the Minnesota Department of Revenue found thousands of potentially fraudulent returns. Those returns were filed using TurboTax, the popular program made by Intuit.

This kind of fraud associated with fictitious tax returns has risen sharply in recent years with some states seeing a thirty-seven fold increase in fraudulent returns this year.  But Intuit does not immediately alert taxation authorities even after it flagged many of the returns as “suspicious,” denying its responsibility to determine whether these suspicious tax returns are fraudulent, reasoning that it could not stop fraud in the industry.

But critics said Intuit and other tax software providers have a responsibility to protect the integrity of the tax filing system. And several security experts said the company is only now adding security measures that have been used by e-mail and social-media companies for years.

“They [e.g., Intuit] can’t blame everything on the IRS. That’s ridiculous,” said Ed Mierzwinski, consumer program director at the U.S. Public Interest Research Group.

Among Intuit’s critics are two former employees who said they protested Intuit’s decision not to do more to halt seemingly fraudulent returns when they worked at the company.

One of them, Shane MacDougall, who was a principal security engineer at Intuit until last month, recently filed a whistleblower complaint with the Securities and Exchange Commission that alleges Intuit chose not to take needed security measures because executives worried those actions would cut into the company’s market share.

“One of the main reasons that I left was that Intuit was seemingly unwilling to implement even the most basic safeguards to protect their users that we were recommending,” MacDougall said. “Something like preventing multiple people from using the same Social Security number is extremely simple to do and that would stop a ton of fraud dead in its tracks, and that was one of many recommendations that we made that they would not implement.”

An internal strategy presentation obtained by The Washington Post showed that the number of “suspicious” customers who successfully filed a return grew from about 900,000 in 2010 to about 2.5 million in 2012. About 29 million people used TurboTax last year.

Intuit declined to comment about the document.

Tax entities have observed that Intuit and its rivals in the self-preparation software business — H&R Block and Blucora, the maker of TaxAct — do not have a financial incentive to erect the strongest possible security protections for consumers. Such steps can make accessing accounts less convenient.

“Commercial tax preparation software vendors have a much different primary objective than tax agencies. They are driven by profit,” Julie Magee, commissioner of the Alabama Department of Revenue, wrote in a public letter this week. “The easier they make it to file a return, the more customers they can get and the more profitable they will become. There is no incentive for them to stop fraud.”

The hackers who targeted TurboTax this year appeared to use two techniques. Some seemed to already have people’s personal information and created fake accounts to submit phony tax returns. Others figured out users’ log-ins and passwords, by trying multiple iterations, and gained wide access to their accounts.

Indeed, many Americans will not discover that they have been victimized until they attempt to file returns in the coming weeks.  And after they report the fraud to the IRS, it could be at least six months, if not much longer, before the agency is able o verify their identities and issue their refunds.  They are also often required to file their tax returns through paper.

In addition to the considerable delay in obtaining a tax refund, another concern resulting from hackers gaining access to one’s account on TurboTax is their access to one’s personal information, and the impairment of one’s credit rating.

So do you still want to file your tax returns using TurboTax ?  LOL!