Intuit to share payroll data from 1.4M small businesses with Equifax
krebsonsecurity.com
krebsonsecurity.com
1- Head to https://theworknumber.com/view-my-data-sign-up
2- Create an account: you must create an account and make note of your account ID (that you choose yourself). You will be asked for it.
3- If you're curious, download your report (I did, it was interesting to know what they have on me)
4- Then go here https://theworknumber.com/employee-data-freeze/
5- You have the choice of using Email, Mail, or Fax, or you can call the number: 866-222-5880
6- I chose to call 866-222-5880
7- Press 1 for English
8- You will be presented with 3 options
9- Option 3 "To report a possible identity theft" is what you want
Someone will answer your call, ask your name, phone number, email address and finally ask why you are calling. Tell them "I'd like to put a freeze on my employment data". They will ask you for a reason; just say "It's personal".
You will be asked for your account ID and other information to verify your identity (they will ask your SSN).
Finally you will receive a text message with a code. You will give this code back to your interlocutor.
They will put a freeze on your data.
Note: Sometimes that rep is not from the department you want to reach, but I've found their call transfer happens faster than calling via the typical process. I also haven't used the service in over a year, so I don't know how much this process has changed.
"I've slogged through it and, after much trouble and time spent, have come upon the golden path. Here is the map of it; deviate from it at your peril."
Sometimes when I try to do this, people don't take it well; perhaps they think poorly of me for what they feel is me infantilizing them. I hope nobody feels that way about your comment.
If this isn't a serious violation of your privacy I don't know what is.
https://www.nbcnews.com/technolog/exclusive-your-employer-ma...
As an example, CA might use The Work Number to check if you are working in NV but not claiming or under reporting that income on your CA medicaid application.
In addition - some people don't file returns that they should.
In addition - sometimes their are crazy backlogs govt / IRS side (transcript services have been very off and on, 35 million paper filed returns still pending processing).
Work number does pay day to pay day updates, so is current to within a few days usually.
The original purpose of the interstate commerce clause was to ban state and local governments from collecting sales taxes on transactions cross state lines, so that states had to compete to keep excise taxes as low as possible, and rely more on direct land taxes on property owners instead. This was because Madison and many of the other early federalists and democratic-republicans were influenced by the Physiocratic school of economics which thought there should be no internal taxes on trade and labor, that all internal taxes should be direct taxes on land.
So if state and local payroll taxes and the work number system are the new rakeoff allowing state and local governments to fund property tax cuts for the rich, it would make sense for federal government to continue its grand historical tradition of using the interstate commerce to suppress this nonsense, in order to encourage any states with broken property tax systems that are struggling to raise revenue to appoint commissioners to redo their assessments instead, in order to discourage state and local governments from taking the easy way out and imposing regressive taxes on workers with the least leverage to complain.
The issue is more about privacy rules. Local governments have to compartmentalize data and avoid impermissible use. They often buy data from third parties because the data isn’t “infected” with IRS compliance rules.
Luckily - in some cases you can send folks to go talk to someone at a child support agency or they do part of eligibility screening - but many of those folks never come back because they get gobbled up by the hassle factor over there (already disorganized / not stable in their situations).
I've become convinced that some of the eligibility screening hoopjumping is just to save money by making it damn difficult to get through the paperwork - even if you are actually poor (which is often obvious). I remember when some programs went to QUARTERLY eligibility verification on services delivered quarterly - so every visit practically was a re-screen on eligibility (the overhead of this is monumental).
So the desire / demand for private solutions to all this is there for sure. Some folks just do front-ends for systems like IRS transcript requests!
Fat chance. I'm sure many people would take the $50 McD gift card in a heartbeat.
You're more likely to get 2-3 months of some sort of their protection service that will be "value-equivalent" to $50, not anything tangible or liquid in value.
Never purchased anything with them since I saw that.
Beyond the difficulty of opt-out, you have to send them more info (including your SSN, a copy of a government ID, and a proof of address that they offer can include your W-2 or paystub).
If only Equifax were even 1% as diligent about avoiding data breaches as they are at making sure no one can maliciously opt you out of them sharing this data that no one wants shared.
I had to call Equifax, spent 1.5 hours on the phone with multiple confused reps until I found someone who could change my record. I thought there would be some kind of validation process, but nope they just asked me where I worked and how much I made.
It is such a broken system. I'm dumbfounded that Equifax hasn't been sued out of existence.
https://www.pbs.org/newshour/nation/equifax-breach-congress-...
https://www.cbsnews.com/news/equifax-data-breach-was-entirel...
Imagine for a moment that your current employer is paying you significantly less than the market value for your role based on your skills and experience, and attempts to request a review of your compensation have been rejected. You may then consider looking for work elsewhere. It’s likely that the question of your current salary will come up at some point during the interview process with a potential employer.
What would you do in this situation? On the one hand, if you’re honest about how much you currently earn, the potential new employer may be reluctant to offer a significantly higher wage… even if it is the “market value”. On the other hand, if you exaggerate your current salary to reflect a figure that’s on-par with what you should be earning, you risk getting caught in a lie when that employer screens you using The Work Number. Clearly, neither situation is ideal.
This is why places like California and NYC have made this question illegal. Candidates can still volunteer this information if they want, and employers can verify it in that case.
But, as another commenter already said, there are ways people can learn to deflect that question toward what they're looking for instead of what they're already making. Recruiters usually accept this after a certain amount of pushback, though not always.
Then they can ask for my current salary but I have largely invalidated the question.
I was once being paid way below market, and while I couldn't get a substantial raise, I eventually got a promise of a market salary in the near future. So I immediately started interviewing outside the company and told them about my promised salary when they asked what I was making.
Deflecting the question this way did work to get me hired at a more reasonable amount, without being dishonest according to my conscience. However, things rapidly soured, and it's possible they checked what my salary had been and never asked me to clarify, so I may have outsmarted myself.
You can also see which credit card issuers run an inquiry on The Work Number if you pull your file, but you don’t get any sort of notification and there’s no way to monitor it.
In my previous role at a large payroll provider, Equifax and few other players in the space over last two years were extremely interested in getting access to SMB payroll data, as it was the most economical way at scale to verify income for half of US labor force employed by SMBs.
Equifax was by far the most aggressive in both offering very generous compensation for that data and insistence as part of the deal on an opt out mechanism.
The employers software vendor Intuit steals the data and sells it to Equifax for their own profit. The employer gets nothing, but could decide to opt-out. The employee who's privacy is being grossly violated gets nothing and cannot even opt-out of sharing the data?
GDPR doesn't sound like such a bad idea now...
To be fair employees do get ~some~ value out of this, in form of of less paperwork verifying their employment during mortgage and rental applications. It's a different question whether it's valuable enough with all privacy downsides.
What's more, any time you remove the freeze to allow someone to verify the data, you have to remember to put it back again if you want it to remain otherwise private, instead of lifting it temporarily for hours or a day or one inquiry or one verifier.
Government employees’ pay information is public information, and they seem to function fine in the world. I like Norway’s public tax record system, price transparency would certainly help the vast majority of participants in the labor market.
Only Equifax having access and selling info to other large organizations is the worst of all worlds, though.
Narf! Poit! Egad!
How about leaving the free market alone?
Intuit has been aggressively anti-consumer and this particular instance is no different. They exist to benefit themselves at the expense of the average joe. Until the free market stops operating in said fashion, your question will continuously earn a resounding, "Nah," from me.
Edit: I am particularly perplexed by this post, given that OP recently suggested governments start "selling, if not mandating, its own operating system software to consumers and businesses alike" because they felt like consistent OS churn resulted in too much unnecessary e-waste. I don't disagree with the concern about e-waste, but I'm having trouble squaring away the dueling perspectives here.
Well, if the free market worked, Equifax would have been sued into oblivion right now and no other company would be stupid enough to try BS like this.
But the free market doesn't work, so you need to protect yourself. The only way we can protect ourselves from greedy corporations is through onerous regulations with teeth.
I asked these people how constituents are to reach out toward their representatives for issues that matter to them, and to be honest what they said was that the only way you are going to get a response is if you are representing an organization or a corporation capable of financing advertising campaigns that can influence large swaths of the electorate in question. A single voter will never be answered by a state level or higher rep, if you are lucky you might just get a canned response from the staff outlining the candidate's platform on the issue. If you are a representative from a special interest lobbying group though with thousands in the war chest, that will get you a long phone call or even face time with the representative. This is how the game is played on both sides of the aisle.
Does Gusto sell them your salary data as well?
How does that work in comparison?
I really don’t have the time and energy to switch to a different payroll provider.
Thank you!
Also, for the sake of completeness, you can do it yourself ...
--- -payroll provider +accounting firm
In yesterday's news, "Intuit sabotages the Child Tax Credit": https://pluralistic.net/2021/06/29/three-times-is-enemy-acti...
I just looked to see what they had on me. It was:
1) 11 checks in 5 days from the re-finance company I used about a year ago to refi my home. Not sure why they had to check so many times. (from about 1.5 years ago)
2) A part time job from over 20 years ago
3) Past 5 years total salary & bi-weekly pay stub including gross & net take-home pay.
4) Missing a bunch of jobs & positions I've had over the years.If I had to do payroll, I'd probably try to find a SaaS that I could contractually lock to strict confidentiality. I wouldn't be in the business of saving pennies by selling out my employees' privacy.
This does not even remotely exist.
Getting anybody to do payroll for you means signing reams and reams of fine print where you absolve them, indemnify them, hold them harmless, and agree to bear their children. Well, maybe not the last part.
It's a nightmare.
It's somewhat expectable though. They're selling a service to people who don't want to deal with red tape (i.e. payroll) and read fine print (which is basically what doing your own payroll amounts to -- a lot of that). So their customer base is strongly self-selected for being susceptible to fine-print abuse.
For example, since many other small businesses use them, you may be paying your invoices through their payment portal for bills sent to you.
They've done deals with bill.com (which bought divvy for 2.5B).
Your payroll provider may provide payroll information to assist employees with their intuit turbotax filings.
Not paying them directly for services is very different than never engaging in transactions which involve something as a third-party. And it means this person isn't directly paying them to do anything.
I just took that to mean what they said and pointed out it's hard to avoid using these bigger players software.
I can't say too much because I don't want to expose anything confidential, but there's definitely good money in this. We've declined advances from similar companies. At least no-one has asked us for data proactively, which would be an insane thing to agree to, and which is what's being reported in TFA. In fact, the only way I'd agree to something like this is if the there was a simple approval step (e.g. employee gets an e-mail that says "Company X is attempting to access your payroll history, click this link if you agree."). But some people believe that negates the usefulness of their offering. Well, so be it. No sharing our data then.
Hell no is my visceral response (both initial and final).
I employ people and must act to keep their trust. I wouldn't want this, ever, and most people I have spoken with agree.
Is it? I don't think there is any law that says an employer can't just publish your salary data, which would imply it is their data. And in some cases they are required to share it, such as with the IRS, SEC, social services, state IRS, child support, (Edit: this might be wrong -- and in some states they are even required to share it as part of a reference request).
It of course would not be a smart way to retain employees giving the data out willy nilly, but the law seems to say that it is the employers data to do what they want.
Whoa, hold on. Is that really true? I found this list of states which have banned asking for salary data as part of a job application, but are there states where you're required to share it with a company just because they've asked on the application and are requesting it for verification?
https://www.hrdive.com/news/salary-history-ban-states-list/5...
Which states?
"Please redact or conceal any compensation related information on any documentation you submit. It is not permissible (either by law and/or company policy) for <new company> to view such information as part of your background check."
So can the new company actually get access to the compensation information? Is that perhaps a state law?
If separate companies agreed on a ceiling for how much they would pay developers, there would be criminal charges, but if it's done through an intermediary like Equifax, somehow it's now legit?
Presently it reports I make significantly less than minimum wage. Additionally, it thinks I've been working for some engineering firm in New York since I was in high school.
1. https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
2. This is my intuition talking here -- I am not a lawyer. If you have legal questions, talk to one. But, IMO it would be utterly bizarre if USPS record of when a specific piece of mail was received were not admissible as proof of claiming that company got your request.
PRETRIAL:
Sender (in a sworn pre-trial affidavit): I mailed this letter.
Addressee (ditto): I never got it.
Judge: We now have sworn evidence to controvert the Mailbox Rule (which establishes a presumption of delivery after mailing). That means I'm not allowed to rule summarily on that question. That in turn means we have to let the jury decide whether the letter was received.
To quote one of my former students: That's a conversation I don't want to have, because of what follows:
TRIAL:
Sender (under oath): I mailed the letter.
Addressee (ditto): I never got it.
JURY DELIBERATIONS:
Juror N (during deliberation): I believed Sender but I also believed Addressee.
Juror N+1 (ditto): I didn't believe Addressee.
Juror N+2 (ditto): I didn't believe Sender and I did believe Addressee.
VERDICT:
Now it's a roll of the dice as to what the jury concludes about whether the letter was actually received.
LESSON:
Use certified mail or other service that will provide independent confirmation of receipt, refusal, or reasonable efforts to deliver. (The Three R's of Notice.)
Your employer may have some right to share aggregated data, but not data that identifies you.
Which is especially crappy considering it's a paid product, not some advertising-funded service.
GDPR is far from perfect, but we (the US) could really use something at least minimally comparable.
Can anyone really trust Equifax with our data, let alone Intuit feeding them more?
They use a subsidiary called The Work Number to keep this evil separated from their good name (ha).
You can and should freeze your Work Number file:
Paid invoices can't be added as transactions. Tax payments aren't correctly imported into TurboTax. The time tracker can't generate invoices.
There are so many sharp edges that can make their way into my Schedule C that I'm worried about being audited. This software clearly doesn't come from the "Have you even fucking tried using it?" school of software design.
And now on top of all that I have to worry about them selling my data to a credit agency that's a boil on the face of the economy.
Is there a better accounting/tax package out there? The only thing Quickbooks Self-Employed does well is scan receipts.
https://www.irs.gov/businesses/small-businesses-self-employe...
Theoretically you can get your hands on that information.
Intuit has my email address from an abortive attempt to use Quickbooks, about a decade ago. It sucked so hard, I ran screaming.
Every now and then, I get an email from them, suggesting that I “reactivate” My account.
The unsub link is worthless. I have to log in with the nonexistent account, in order to unsub. The reset password function doesn’t work (non-existent account). I am doomed to get these emails for eternity, but they aren’t frequent enough to be much more than an annoyance.
But Equifax has a crappy record on data integrity. I expect an avalanche of penis pill spam, soon.
I would consider this a CAN-SPAM violation. You can have your representative and AG apply some pressure.
So far, it has only been a slight annoyance.
Ah, hey, that's the same level of incompetence as British Airways. I'm in the same boat there, but that's why /dev/null exists, of course :)
It has a highly populated plugin marketplace to, which is where I think you need to go for the receipt evening part.
They had a good incentive program for accountants to bring on clients. My account was super disappointed I already had an account and knew how to give them just enough access to it to do their job, but no more.
Disclaimer: I used to work for them as a software engineer, but having used Xero when I was self-employed I can definitely say FreeAgent is better.
Not sure about receipt scanning though.
Switched to godaddy’s bookkeeping which still sucks but not many options out there.
I also remember attending a session that Intuit offered on the competitor landscape and being quite surprised that Wave wasn't covered. Intuit just doesn't take them seriously, but their products, to me, seem better than just about every competitor covered in the session, including Xero. They've got a self-employed offering [0] that might be worth experimenting with since you can start for free and only pay when you need the premium features.
Microsoft isn't sharing telemetry data with these companies yet but they've shared data from other organizations they own.
https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
If your bank or company or Equifax leaks all your SSNs the government won't take a shit, they'll just let people continue stealing your identity.
1. Municipality sets minimum lot size and maximum density rules so living in the "nice" neighborhood requires buying more land than you actually need. Originally this replaced race based zoning.
2. Can't afford that much land? Go live in the other neighborhood that allows fourplexes, apartments, and condos.
3. Now that your community is segregated, it's easy to adjust city services so schools, roads, and parks are better in the rich neighborhoods.
Equifax credit scores are part of the system, but the root of evil is in land use policy. Deep red and deep blue local governments are all doing this.
"More than 80% of America’s large metropolitan areas were more racially segregated in 2019 than they were in 1990" https://www.theguardian.com/us-news/2021/jun/28/us-racial-se...
The report that interview is based on, https://belonging.berkeley.edu/roots-structural-racism
[1] To clarify I am talking about "economic rent" in its wider meaning.
Most people understand this on some level and are not pissed off.
The municipal financial argument doesn't hold water. Urban areas generate tax revenue beyond their cost of infrastructure.
Talking to boomers, I don't get the sense that either racism or property values are the motivating force behind zoning restrictions. Rather, they want to preserve privacy, natural beauty, traffic, neighborliness, and the general aesthetic that they bought into. Racial discrimination, high housing values, and homelessness are consequences that fall out of that, but most people voting for these policies are not thinking about those. It's "fuck you I got mine", but out of apathy rather than malice.
1. The history is easy, these rules were created originally to maintain racial segregation. The Color of Law covers this in detail. For a shorter form, check out https://grist.org/cities/zoned-out-one-womans-half-century-f...
2. Upzoning a property makes it more valuable. It's giving back property rights to the owner. There's no cost to the owner, but now large developers are a potential buyer. The _real_ selfish move is to demand that ONLY my property is upzoned.
When municipalities consider upzoning, we don't see 2. Instead we get people talking about "destroying" the neighborhood. Renters are referred to as transients. Occasionally the mask comes of and we hear about "those people". When people genuinely think those things are going to happen, they also think their property value will go down.
It's like people talking about the civil war in terms of state's rights instead of slavery. Makes perfect sense if you think of slaves as property.
Edit: To be clear, I think there's a lot of people that think of single family housing as a "lifestyle" that they prefer and are not necessarily bad people. However those with the most visceral reaction that actually become activists tend to be a combination of racist and classist.
We know this to be the case in other areas.
We also desperately need a system that doesn't profit off the poor and hand it in the form of benefits to the rich.
As part of your contract, enumerate allowed uses of the data and forbid the rest.