Hacker News Reader

Comment by sp332 | Hacker News Reader

If Intuit wasn't breached, that means the problem could affect everyone in those states, not just TurboTax users.

It sounds like someone has collected personal information and has a script filing fraudulent tax returns through TurboTax.

We know an enormous amount of PI was leaked from various major breaches last year, if that is what happening TurboTax is really just a tool being exploited for profit.

Fraudulent tax refunds are a huge issues that the IRS has not kept up with. The IRS itself estimates it paid $5.2 billion to identity theives[1]. Protecting taxpayers without creating too much of a hurdle to tax paying is a very hard problem to solve.

[1] http://time.com/money/3419136/identity-theft-social-security...

This doesn't seem to affect federal tax returns or anything related to the IRS. (This time.)

It's an easy problem to solve but the solutions (Estonia style national identity cards or a flat PAYE tax on all forms of income) are not politically viable in the US.

Why is PAYE unviable? It wouldn't have to be flat.

Because there is an entire industry of which Intuit is part of that profits off the complexity of current tax system. Simplify the system and profits go down.

HR Block was caught lobbying against simplification of the tax system for this very reason.

Because Congress never votes for a reform of tax codes because the lobbying from Intuit and HR Block et al is too strong, while there's no lobby for the populace at large to say "This sucks."

I would imagine that the sort of politics involved is Lobbying rather than ideological.

I'm sure people would be very happy to not have to file tax returns.

A mandatory national identity card would be an ideological non-starter to the small government wings of both parties, despite the fact that the information industrial complex would love a government project of that scale to attach pork to.

Oh, yeah the ID card side of things is a problem, same here. But we do have a national PAYE system that no-one complains about - they might moan about the levels of taxation but I've never heard of anyone bemoaning the mechanism.

Taxes should not be collected on income or in any way that requires individuals to "file" anything. Problem solved.

> Fraudulent tax refunds are a huge issues that the IRS has not kept up with. The IRS itself estimates it paid $5.2 billion to identity theives[1]. Protecting taxpayers without creating too much of a hurdle to tax paying is a very hard problem to solve.

Eliminate advance tax withholding and pay all taxes in arrears with allowance for a no-penalty payment plan for up to one year after the end of the tax year. You have significant one-time cost from shifting obligations forward, and a bit of an ongoing cost from the time value of money, but you eliminate the problem of fraudulent refunds by simply eliminating routine refunds.

States also claim they weren't breached. They just said data was filed through "third party" tax filing services.

As others pointed out, it does look like one of those two entities above were breached, as data filed in forms is very similar to data from 2013.

People reuse the same user names and passwords all over the place. Most likely criminals have gathered a large list of user credentials from breaches of other web sites and then found that some of those credentials also worked on TurboTax.

I would guess this is happening largely because Intuit started offering free state filing to a greater subset of users. This has been an ongoing problem at the federal level, but just started this year with the various states. Strong correlation between fraudulent returns filed and it costing $0 for a fraudster to take a shot.

Reply on news.ycombinator.com