back to article Crims unleashed IRS-stabbing malware in bid to rob 464,000 people

Crooks generated the keys necessary to file tax returns for 101,000 people in the US – allowing the crims to potentially siphon off their victims' rebates. All American citizens, and tax residents in the US, must submit their annual tax forms by April 18 for this year. Surprisingly, you can do this online using the IRS's e- …

  1. Anonymous Coward
    Anonymous Coward

    Was a Bot farm required to pull this caper off?

    * Did the IRS site even check if the requests were all coming from the same IP or same series of IP's?

    * This fraud has been going on for well over a decade, and with all the cuts there's no one guarding the doors.

    * So naturally you'd think the IRS would put the system on ice, until such a time as they can address the Inadequacies in their blunt auto-refund system.

    * But no that would kill fast-refund-payday-loan thinking, which is like some cult religion in the US! So one and on we go...

    1. Tom 13

      Re: Was a Bot farm required to pull this caper off?

      But think of all the money they save by not printing forms!

      /end sarc

      Where are the two bullets and bottle of vodka when you need them?

  2. Anonymous Coward
    Anonymous Coward

    Coming to a town near you...

    I used to live in the US, glad I don't anymore. But my new home is pretty interesting too. For instance, my bank sends my credit card statements via email. Those emails are password protected, but only by national ID number, which you can't sneeze without giving out.

    The statements also contain the full 16-digit credit card number, with no obfuscation whatsoever. In fact where I live now, is probably the home of fraud. Its on a whole other level here. Yet staff in shops / restaurants etc, don't even check if your signature matches the credit card. What's the future going to be like??? ... Ugly!

    1. Tom 13
      Unhappy

      Re: don't even check if your signature matches the credit card.

      Mostly that stopped in the US about 10 years back.

      These days we're up to, under $25 you don't even have to sign because it's cheaper for them to eat the fraud than it is to pay to keep the tracking paperwork. Granted I expect half the time they foist the fraud charges back to the users who mostly don't challenge them.

  3. a_yank_lurker

    A Solution

    A solution to this to eliminate income taxes, replacing them with excise and other consumption taxes. The Infernal Ripoff Service will pay lip service to security; remember they are a part of the same bunch that had all personal information of current feral employees stolen.

    1. Graham Marsden
      WTF?

      Re: A Solution

      > replacing them with excise and other consumption taxes

      So your solution would be to tax practically *all* the income of the lowest paid (who cannot afford to save and need to spend most of what they earn just to keep a roof over their head and eat) whilst the highly paid get taxed on only a tiny fraction of their income whilst the rest of it gets shuffled off abroad into tax havens...

    2. MD Rackham

      Re: A Solution

      Good thing there are no tax returns involved in collecting excise, sales, and other consumption taxes.

      Sheesh. Another overly simplistic solution hiding a massive tax break for the wealthy.

  4. skeptical i
    Unhappy

    So much for that year of free credit monitoring.

    Apparently the scum don't need to wait for the year to end before cashing in on pilfered data, just the next tax filing cycle.

  5. allthecoolshortnamesweretaken

    This is what data mining is all about - correlating data from various sources to filter out a specific group of people. You might do it in order to sell something to them, you might do it in order to steal from them, you might do it in order to single them out for - what?

  6. Peter 26

    Similar issue with Tax Software used by Accountants

    Tax software used by accountants records passwords and keys required to file a tax return on behalf of a customer. There could be thousands of people in each DB depending on the size of the accountancy business. There has been cases before where this has been pilfered. There is no way to completely protect the information even if the software encrypts it in the DB as it need to be decrypted before it can be transmitted.

    A proper process needs to be in place to avoid fraud.

    Letters and emails should be sent on submission of a tax return and on advice of a refund on your tax.

    There should be a delay in the refund to allow any fraud to be detected.

    Address changes should have a process to avoid fraud, e.g. letter to old address informing them of the change, contact us if you didn't authorise this.

    Bank details for refund, any changes again need to be written in a letter and a delay added to ensure any fraud is detected by the letter.

    Agent bank details changes should require extra monitoring of any changes as the repercussions are so enormous.

  7. David Pollard

    Send for IDS

    There's an urgent need for full investigation at the highest level of the ways in which crooks and villains are manipulating new technologies in order to get their hands on government pay-outs. The underlying problem is clearly international and he may need to spend quite some time away from the UK in order to gain a thorough understanding of the complete picture.

  8. Tom 13

    You'd think someone filing your tax return for you would be doing you a favor.

    Not if you're a 'Merkin you don't.

    For us, the IRS is sort of like National Healthcare is for you Brits: the unavoidable place all your vital information is kept with complete crap security on the front end. A fair number of Americans qualify to use the EZ form. Someone with a 4th grade education in math can complete it, especially on paper. But they don't distribute those once ubiquitous forms forcing these same people into online forms. Worse, the state have done the same thing, only they don't put up the online forms. Thus forcing people to use Quicken (in the form of TurboTax), H&R Block, Jackson Hewitt, or some other very overpriced agency to file their taxes ($250 once because I had three jobs and three bank accounts. I paid it because H&R comes with a small bit of liability shielding and there was unemployment income in that set.)

  9. tom dial Silver badge

    I have avoided this particular issue for years by consistently underpaying my estimate, requiring a payment to be made when filing. If someone else files a fraudulent return ahead of me and gets a refund I probably will not know about it, and I expect the IRS and state tax agencies will accept the valid return and payment without question. The (very) small amount of interest on the underpayment covers about half the cost of the tax preparation software.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like