White Collar Posts

Potential Class Action Highlights Cyber-Identity Theft Issues in the Tax Industry

April 29, 2015
By: Abraham J. Rein and Carolyn H. Kendall

The tax industry has an identity theft problem. According to the Government Accountability Office (“GAO”), the IRS estimates that in 2013 it paid out approximately $5.8 billion in tax refunds to filers later determined to be identity thieves.

Very generally, the basic scheme is that thieves use stolen identities to file early tax returns using the names and social security numbers of unsuspecting taxpayers, which claim low amounts of income and high amounts of deductions and withholdings, in order to take advantage of the earned income tax credit and obtain the resulting tax refunds. The IRS has acknowledged that the true amount of false tax refunds paid annually likely is much larger than its 2013 estimate, given that much identity theft goes undetected.

Now, a pair of taxpayers is seeking to hold responsible the software makers who serve as an intermediary between the IRS and the taxpayer through a class action lawsuit, thereby suggesting that the problems of the IRS can become the problems of private businesses.

The Lawsuit: Diaz vs. Intuit

The case – a putative class action lawsuit recently filed against Intuit, Inc. (“Intuit”), the company behind the popular TurboTax return preparation software – underscores the problem and highlights practical areas of concern for tax industry professionals. In the complaint, two taxpayers argue that TurboTax did not effectively protect them against fraudsters who filed returns in their names.  The first plaintiff alleges that she last used TurboTax for her 2010 joint returns; the second alleges that she never has used the service. Nonetheless, according to the complaint, in March of 2015 both plaintiffs received bills from TurboTax for the purported e-filing of their 2014 returns. The complaint alleges various state law claims, including breach of contract (stemming from allegations that defendants did not adhere to TurboTax’s terms of service), negligence, violations of California’s unfair competition and consumer records laws, and aiding and abetting and negligent enablement of fraud. Ultimately, the complaint asks the court to certify a class action against Intuit, in which plaintiffs would represent taxpayers who either (1) had fraudulent tax returns filed in their names through TurboTax, or (2) had their “data . . . accessed by unauthorized persons” “while that data was being held by Intuit.”  

The complaint further catalogs recent high-profile security breaches, purportedly impacting hundreds of millions of individuals and small businesses. Nonetheless, it does not rely on any express allegation that TurboTax or Intuit have themselves ever been victim to a mass data breach. Rather, the plaintiffs seem primarily focused on the problem of imposters accessing TurboTax using data apparently stolen from elsewhere, and the allegation that Intuit obtained increased fees from the use of Turbo Tax by fraudsters and failed to take steps to curb such use. (Intuit maintains that it does not get paid through the refund transfer process unless IRS accepts the return as valid, so Intuit’s incentive is to minimize fraudulent use of its services.)

For its part, Intuit – after briefly suspending filings of state tax returns in February due to high numbers of suspicious filings detected by state authorities – announced that it did not believe that the activity resulted from a breach of Intuit’s own systems. The FBI has launched its own investigation into the source of the sham returns. 

The estimated loss of $5.8 billion in detected fraud, plus unquantified additional undetected losses, arises in part from the increased prevalence of e-filing (which the IRS requires most paid tax return preparers to use), along with the IRS’s policy of prompt refund payments. The IRS seeks to pay refunds within 45 days of a return’s filing (thereby avoiding paying interest under the Internal Revenue Code). To meet this goal, the IRS must disburse refunds before returns have been completely vetted. This practice inevitably results in payments quickly being distributed to filers who are belatedly found to be imposters.

These developments serve as a reminder to return preparers and other tax professionals to remain vigilant and follow best practices when it comes to protecting their clients’ data. Although the complaint against Intuit appears to focus on an alleged failure to prevent fraudsters from using previously-stolen data to file false tax returns claiming refunds, the collection, storage, and transmission of sensitive client data can itself represent an opportunity for such data to be stolen in the first instance. Accordingly, return preparers and other tax professionals should develop a data protection policy appropriate to their operation, and – importantly – ensure that it is consistently followed.

At a minimum, that policy should require them and their agents to store client data securely, judiciously limit and carefully track who can and does access it, avoid sending private data via unprotected channels such as unencrypted email, and dispose of records properly. The policy should likewise require return preparers and other professionals to identify and react appropriately to red flags suggesting that a client’s data has been compromised. Other measures that should be considered include mandatory security training and/or background checks for employees, password requirements, strict controls to avoid malicious attacks (such as through malware or phishing), and rules governing storage of sensitive information. Finally and crucially, if a return preparer or tax professional suspects a breach or other fraud with respect to their clients’ data, they should run the issue to the ground and ensure that, at a minimum, they follow all applicable state and federal reporting requirements if a suspected breach has occurred.

Should you have any questions about this matter, or about related issues, please contact Abraham J. Rein at (215) 587-1057, or arein@postschell.com, and/or Carolyn H. Kendall at (215) 587-1470 or ckendall@postschell.com.

Disclaimer: this E-Flash does not offer specific legal advice, nor does it create an attorney-client relationship. You should not reach any legal conclusions based on the information contained in this E-Flash without first seeking the advice of counsel.