Turbo Tax, again

[BOBOT]

It seems that hackers have compromised TT users' accounts and filed in their names, claiming refunds.

I'm using the (downloaded) desktop version, as in the past, and had planned to e-file as I have for years.

Now I'm not so sure.

Is it known if the fraud includes users of the desktop version who e-file, or is it only those who use the online version & hence have their sensitive info on TT servers?

I may just print the d@mn thing & mail it in. Grrr.

 

[braumeister]

If some fraudster has already filed electronically in your name, what difference would it make?

 

[audreyh1]

It seems that hackers have compromised TT users' accounts and filed in their names, claiming refunds.

I'm using the (downloaded) desktop version, as in the past, and had planned to e-file as I have for years.

Now I'm not so sure.

Is it known if the fraud includes users of the desktop version who e-file, or is it only those who use the online version & hence have their sensitive info on TT servers?

I may just print the d@mn thing & mail it in. Grrr.

They didn't need to hack into the TT account to use someone's credentials to file.

But some accounts have been accessed.

From what I have read, TT accounts have been accessed by phishing and trying passwords from other compromised systems.

TT doesn't do the basic check that a social security number has already been used. That would require them to police the accounts and they aren't interested in taking those kinds of steps.

Read Krebs on Security if you want to understand more.

 

[Rothman]

I noticed today when I logged into TT it asked to verify by sending an email to my account registered and I had to enter the 6 digit code from the email to continue. I owe money a small amount and filed with payment taken April 15th from my bank account. I don't have to worry about anyone else filing. I've read if someone filed using TT you would get the filing email and could react quickly to report fraud prior to any rebate being processed.
BTW need to log into TT from the Fidelity site taxes tab to get your $20 discount. Worked great.


Sent from my iPad using Early Retirement Forum

 

[audreyh1]

Yes, they are finally coming into the modern (i.e. year 2000) age by doing a basic email verification on your account.

But, honestly, that does not protect you from someone else filing using your name, age, and social security number, with or without TurboTax.

And TurboTax doesn't prevent someone from creating a different account with a different email using your name, age, and social security number.

 

[samclem]

I just filed my Ohio taxes and have a refund coming. The state mailed DW and I letters with an authentication code--we had to go to a state web site and enter that code and amt of refund, then fill out a quiz with items based on our financial records (previous addresses, price paid for home, etc).

So, the mailing address was verified as belonging to the person who filed the return (since we got the letter and knew the code), and quiz helped verify that the person at that address was probably me. The refund should come in a few weeks.

A hassle, but not a big one. Still, it's probably easier and just as fast to just get a check next time, and then I don't have to provide bank acct info when I file (exposing it to theft).

 

[Kabekew]

From what I have read, TT accounts have been accessed by phishing and trying passwords from other compromised systems.

Nope, all they had to do was know your name and SS#. The identity thief could simply click "forgot user name" and it would only ask for the name and SS# and let them in without any other verification. Then they could view what you had filed, or file an amended return except wiring the refund to their anonymous debit card, unlikely to raise flags because the data is otherwise authentic. That's how I found the Turbotax return of someone who filed a false return with my identity (including their email and bank account#/debit card).

To Turbotax's credit, when I called them a month or two ago and told them how easy it was for anyone to do that, they took it seriously and escalated it up to a security specialist. Hopefully they've fixed it now, but you never know. I don't trust the security of anything stored "on the cloud."

 

[audreyh1]

Nope, all they had to do was know your name and SS#. The identity thief could simply click "forgot user name" and it would only ask for the name and SS# and let them in without any other verification. Then they could view what you had filed, or file an amended return except wiring the refund to their anonymous debit card, unlikely to raise flags because the data is otherwise authentic. That's how I found the Turbotax return of someone who filed a false return with my identity (including their email and bank account#/debit card).

To Turbotax's credit, when I called them a month or two ago and told them how easy it was for anyone to do that, they took it seriously and escalated it up to a security specialist. Hopefully they've fixed it now, but you never know. I don't trust the security of anything stored "on the cloud."

Oh, wow, I remember you reporting this a while back. Wow, just wow!

 

[Sunset]

I used to use TT , until I found out H&R Block software does the same thing for about $30 less.
I use the desktop version of H&R.

 

[2B]

I used to use TT , until I found out H&R Block software does the same thing for about $30 less.
I use the desktop version of H&R.

I got a free version in the mail and am using it this year. I get free TurboTax as a Vanguard Flagship member but originally getting Sch D was going to cost me $20 or $30. Because of all the turmoil, it was later made free.

I'm waiting to see what happens to TT next year. If they try the Sch D rip-off again, it may be the end of TT.

 

[ejman]

I got a free version in the mail and am using it this year. I get free TurboTax as a Vanguard Flagship member but originally getting Sch D was going to cost me $20 or $30. Because of all the turmoil, it was later made free.

I'm waiting to see what happens to TT next year. If they try the Sch D rip-off again, it may be the end of TT.

Similar here. I used Taxact this year which has worked just fine. I'll see what TT does next year. If they keep up these shenanigans I'm totally done with TT even if free (thru hoops) @ Vanguard

 

[jazz4cash]

After many attempts at of trying to efile, I gave up several years ago and just file a paper return using the Block sofware.

We received notice from IRS that "Your refund cannot be direct deposited as you directed because the financial institution would not accept the deposit". They are going to mail our refund. Problem is, we have not filed. There is not much we can do. Fill out an IRS form (Identity Theft Affidavit) and mail it in. OTOH, we may be receiving a refund whereas we actually have taxes due.

We do use the state's online filing system and they also sent us a letter saying an attempt was made to file a return but they caught it.

 

[REWahoo]

NBC Nightly News (Lester Holt) has a segment on the vulnerability of TT tonight.

Meh. Very little substance.

Two recommendations for those efiling: use a unique password and file early. Nothing new.

 

[W2R]

NBC Nightly News (Lester Holt) has a segment on the vulnerability of TT tonight.

Thanks. Just listened to it, but found it less than informative. Lots of "blame game" but I didn't notice any actual, factual information beyond what was already discussed in this thread, AFAIK. If there was any then I missed it.

Not your fault; I'm just getting pretty cynical about the quality of news reporting lately.


Edited to add: I see that you simultaneously came to the same conclusion.

 

[audreyh1]

We can never eFile early. We have to wait on 1099s.

Our return was accepted - yay! At least no one managed to file fraudulently with our credentials this year!

I thought this Krebs story showing some of the modus operandi of a tax fraud filer was interesting: Tax Fraud Advice, Straight from the Scammers - Krebs on Security

 

[gerntz]

I used to use TT , until I found out H&R Block software does the same thing for about $30 less.
I use the desktop version of H&R.

Wow! Thirty bucks saved!! Just wow!

 

[samclem]

Wow! Thirty bucks saved!! Just wow!

Hey, it all adds up to beer and pizza.

 

[meierlde]

I should be noted that Amazon gives a good discount over TT direct for Premier it is $55 versus 89, and for Business it is 104 vs 149. I need to call TT and ask if they will match Amazon next year.

 

[gerntz]

Hey, it all adds up to beer and pizza.

Can't go. Trying to figure out how to save $30 on my tax return. Have to fill taxes out on both programs to see if they give me the same result & which is easier. Hours and hours, oh my!

 

[gerntz]

I should be noted that Amazon gives a good discount over TT direct for Premier it is $55 versus 89, and for Business it is 104 vs 149. I need to call TT and ask if they will match Amazon next year.

Wow! Now up to $40 savings! Oh my! Wonder how much time it will take to figure this out.

 

[audreyh1]

The reason we used TurboTax this year was Fidelity let us download it for free.

 

[Shagger56]

Someone used TurboTax to file my 2014 return

It happened to me. Someone filed a return using TurboTax to collect my expected refund. The return was filed by Turbotax on March 9, 2015 and was accepted by the IRS minutes later. The return included only items I had put in earlier and included only my W-2 and pensions - nothing from Vanguard. The return filed was a 1040A which I haven't used in years, if ever, as I itemize deductions. Anyway I received a nice letter from the IRS on Saturday saying they had upped "my" refund since I forgot to include my Estimated Tax Payments and they would be sending me a MUCH large refund. According to the notice if I agreed with their calculations I would be getting the refund in 4-6 weeks. Well the IRS outdid themselves and direct deposited the refund to the perp's account on March 18th. I don't have any idea how this happened but I never received any notice from TurboTax that I had filed so I guess the perp "stole" my TurboTax information and had any correspondence sent to his e-mail.
From the IRS standpoint there is an easy way to prevent this. Beware!!!!

 

[aja8888]

It happened to me. Someone filed a return using TurboTax to collect my expected refund. The return was filed by Turbotax on March 9, 2015 and was accepted by the IRS minutes later. The return included only items I had put in earlier and included only my W-2 and pensions - nothing from Vanguard. The return filed was a 1040A which I haven't used in years, if ever, as I itemize deductions. Anyway I received a nice letter from the IRS on Saturday saying they had upped "my" refund since I forgot to include my Estimated Tax Payments and they would be sending me a MUCH large refund. According to the notice if I agreed with their calculations I would be getting the refund in 4-6 weeks. Well the IRS outdid themselves and direct deposited the refund to the perp's account on March 18th. I don't have any idea how this happened but I never received any notice from TurboTax that I had filed so I guess the perp "stole" my TurboTax information and had any correspondence sent to his e-mail.
From the IRS standpoint there is an easy way to prevent this. Beware!!!!

Were you using the online version of TT and had a partial return completed?

 

[braumeister]

I just filed my Ohio taxes and have a refund coming. The state mailed DW and I letters with an authentication code--we had to go to a state web site and enter that code and amt of refund, then fill out a quiz with items based on our financial records (previous addresses, price paid for home, etc).

We just got our verification letters today. When we went to the website for the quiz, we found some of the most arcane questions we've ever seen. Far harder to answer than any question on the credit bureau tests.

One of them required knowledge of an obscure three word phrase in the middle of our home's legal deed description, which runs to a page and a half of single spaced type. If I didn't have a good memory, and I wasn't the type of person who actually reads such things, I never would have passed.

Very impressive work from the Ohio tax department!

 

[lemming]

this is from the Turbotax answer forum. They have a FAQ but have not fixed the problem in 2 weeks!! Not a security issue but if it made my bank account blow up from excess withdrawal I would be crazed mad.Notice that TT throws the responsibility back on the user.

quote VThis is a known issue and we are working to have it corrected. We do recommend that you still contact the IRS and they can assist you with getting this corrected. In the meantime, please sign-up in the FAQ below to be notified of any updates on this issue.

Some customers are experiencing a greater amount due being generated when filing with Easy Extension. When customers enter a decimal in the amount due box i.e. $500.00 the amount transferred is $50,000.

**NOTE** This is only occurring when a decimal is entered into the lower payment field