While it shouldn’t come as a surprise to any of our long-time readers, millions of less savvy taxpayers might be shocked to discover their online tax filing software has been caught red-handed leaking sensitive information. As discovered and reported on by non-profit news organization called The Markup, several popular online tax-filing websites including TaxAct, TaxSlayer, and HR Block have been collecting and passing user information to Facebook, including names, income, refund amounts, filing status and even dependent names and scholarship amounts.
What does this mean for you?
Most people are unaware that just about every app and website out there that isn’t strictly not-for-profit (and even some of those as well!) has a side hustle they don’t overtly share with their users/visitors/customers: data collection and selling. If you dig into their “Terms of Service” or various other fine-print agreements normal people don’t read before clicking “Accept”, you will likely find some generic or vague language that essentially says you agree to share data with their “partners” in exchange for using their services. In the case of the tax filing services, you might have even paid for that “privilege.” Don’t you feel special? In their meagre defense, the data that was gathered was done so by a very widely used data-gathering tool called Pixel developed by the #1 data-glutton, Meta née Facebook, and in a couple cases, seems to have been inadvertent or perhaps careless implementation of the data collection tool. On top of this, when asked to comment on whether Facebook was soliciting this type of data (which is illegal to share without your explicit consent!), they of course responded that partners were expressly forbidden to send Meta that data, and that Meta has filtering in place to prevent the collection of this type of data, regardless of who was sending it. It’s also been reported earlier this year that Facebook collects so much data it doesn’t fully understand how it’s used, or where it goes within Facebook’s various systems and algorithms. Should you trust a company that doesn’t even have a handle on its own data to properly filter data it’s not supposed to collect? How would they even be able to report accurately on that?
Shortly after reporting on their findings, The Markup was contacted by the named tax websites who shared that the data collection pixel had been removed from their services. Is it safe to use these services now? Probably, at least going forward. If you’ve used these services in the past few years, the damage is already done – data collection has been done on your returns and the data leaked to Facebook, regardless of whether you have a Facebook account. Unfortunately, as before, there is not much you can do about the leaks except to let your congressperson know that you expect them to take better care of your privacy. You can also contribute to organizations like the ACLU who have been fighting this fight longer than most of us realize.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
In 1986, Ronald Reagan is quoted as saying, “The nine most terrifying words in the English language are, ‘I’m from the government. I’m here to help you.'” As relevant as that sentiment was in his day, it’s still ringing true, this time with at least three government websites that are doing you no favors in terms of protecting your identity. Krebs on Security has an alarming report of identity theft and fraud via the IRS.gov website wherein he shares the story of a taxpayer who discovers someone has already filed a fake tax return under his name, for the purposes of stealing his tax refund. At fault is a identity authentication standard known as KBA, or “knowledge-based authentication” which is pretty widely used in the credit reporting and finance industries. Basically, you prove you are you by answering questions that supposedly only you would know, including former addresses, loan amounts or payments, and other personal data that is – surprise, surprise – readily found on the internet. By anyone.
What this means for you:
Ironically, people avoid creating accounts on websites because they are afraid of their data being leaked. And now you get to be afraid of NOT creating an account on a website for fear of someone else creating it for you, with the added “bonus” of this fake account further decreasing the probability of you being able to prove you are actually who you say you are. “Invasion of the Body Snatchers” anyone? What makes this situation alternately terrifying and ludicrous is that it’s our own government creating this mess in an effort to provide better reporting, accountability, and accessibility. The other two sites that are also potentially weak to this “account snatching”? How about the Congress-created AnnualCreditReport.com and another federal behemoth: the Social Security Administration website. Brian Krebs’ recommendation is to make sure you get an account established for these three website pronto, if only to prevent someone else from pretending to be you and creating accounts that will be used to commit fraud and money laundering. Unfortunately for most of us, the surge of interest created by this article (and blogs like this one) have essentially paralyzed (are you surprised?) the account creation process of these websites, but keep trying, if only to let them know we actually care about our identities enough to want properly secured government websites.