5 ms·

The IRS said the thieves accessed a system called “Get Transcript.” In order to access the information, the thieves cleared a security screen that required know

by byoung2 11y ago

The IRS said the thieves accessed a system called “Get Transcript.” In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address. Do we know if the system was compromised, or if the thieves just had access to the personal information of those taxpayers?

ceejayoz 11y ago
If the system were compromised I'd expect more than 100k attacked in this manner. Bet they were phishing victims or something.
- NoMoreNicksLeft 11y ago
  Funny, I'm more inclined to believe that the IRS is underreporting the number.
seanp2k2 11y ago
This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.
- eli 11y ago
  That's a much larger problem than this current breach in the linked article. People have been filing early fraudulent returns for a long time because it's not that hard to do. I seem to recall reading the tricky part if figuring out how to actually get the money, since it will be issued in the name of the person who filed. The good news is it's often detected when people file their real return. I'm sure it's a giant hassle though.
- dragontamer 11y ago
  USPS is rumored to be working on such a system actually. http://securekey.com/press-releases/securekey-technologies-wins-contract-with-u-s-postal-service-to-implement-federal-cloud-credential-exchange/ http://securekey.com/press-releases/securekey-technologies-w... SecureKey IIRC is used by Canada. USPS is in a unique position in that they have a ton of employees literally who can verify mailing addresses by brute force. Every day (except holidays). Rain, Snow or shine. Having USPS in charge of the US's future "online identity" would be a good way of transforming the ailing agency and giving them a very useful purpose that only USPS can do. There's a lot of win/win potential here.
  - r00fus 11y ago
    This is/should be the main offering of the USPS - secure identity location verification. It's too bad their hands are so tied by Congress (and a malicious one at that - having to pay pension fund 75 years early)... they might have made this move a decade or so earlier.
    - xrange 11y ago
      ...isn't that 75 year thing incorrect? http://www.cnbc.com/id/45018432 http://www.cnbc.com/id/45018432
  - deleted 11y ago
    [deleted]
  - elihu 11y ago
    I believe that verifying and vouching for the identity of it's citizens is one of the legitimate roles of government. I find it odd that we can have government issued social security numbers, passports, and driver's licenses, but I can't go to some office and have the US government sign my public key or SSL certificate. For some reason, if it's electronic, government is expected to defer to the free market.
- bitJericho 11y ago
  The SSN was never designed or intended to be an ID number for anything but social security.
  - scrollaway 11y ago
    As a french citizen, and on behalf of everybody I know who doesn't live in the US (and some that do), the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous.
    - iak8god 11y ago
      > the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous Especially since they get passed all around like that's not the case by employers, insurers, creditors, etc, etc.
    - __z 11y ago
      Someone fraudulently used my social security number. It is such a sick and terrible feeling knowing that your number is "out there" and can be used by anyone for a whole host of things. It feels horrible and really, really violating.
      - scrollaway 11y ago
        I'm really sorry to hear that. Being a victim of an ill-designed system you're forced to be a part of is not a great feeling. :/
        __z 11y ago
        Thank you for the empathy. The problem is it wasn't a designed system, it just came about by itself slowly over time. Social security numbers were never designed to be used in any way outside of social security.
      - seanp2k2 11y ago
- jws 11y ago
  This isn't about the normal theft of someone's tax refund by fraudulently filing a tax return. This about the IRS itself divulging the sensitive data required to fraudulently file tax returns. Someone tried about 200k times and got about 100k sets of people's tax histories. In the more mundane act of fraudulently bypassing the IRS's trivial security to steal a tax return… thieves got me, probably as a result of Anthem's inadequate security. The thieves didn't even have the courtesy to pay what I owed! I say you file my tax return, you take your chances. The maddening part, aside from the scramble when the April 14th filing from the tax people failed, is that no one in law enforcement is the slightest bit interested in enforcing the law.

by byoung2 11y ago

ceejayoz 11y ago

If the system were compromised I'd expect more than 100k attacked in this manner. Bet they were phishing victims or something.

NoMoreNicksLeft 11y ago
Funny, I'm more inclined to believe that the IRS is underreporting the number.

seanp2k2 11y ago

This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.

eli 11y ago
That's a much larger problem than this current breach in the linked article. People have been filing early fraudulent returns for a long time because it's not that hard to do. I seem to recall reading the tricky part if figuring out how to actually get the money, since it will be issued in the name of the person who filed. The good news is it's often detected when people file their real return. I'm sure it's a giant hassle though.
dragontamer 11y ago
USPS is rumored to be working on such a system actually. http://securekey.com/press-releases/securekey-technologies-wins-contract-with-u-s-postal-service-to-implement-federal-cloud-credential-exchange/ http://securekey.com/press-releases/securekey-technologies-w... SecureKey IIRC is used by Canada. USPS is in a unique position in that they have a ton of employees literally who can verify mailing addresses by brute force. Every day (except holidays). Rain, Snow or shine. Having USPS in charge of the US's future "online identity" would be a good way of transforming the ailing agency and giving them a very useful purpose that only USPS can do. There's a lot of win/win potential here.
- r00fus 11y ago
  This is/should be the main offering of the USPS - secure identity location verification. It's too bad their hands are so tied by Congress (and a malicious one at that - having to pay pension fund 75 years early)... they might have made this move a decade or so earlier.
  - xrange 11y ago
    ...isn't that 75 year thing incorrect? http://www.cnbc.com/id/45018432 http://www.cnbc.com/id/45018432
- deleted 11y ago
  [deleted]
- elihu 11y ago
  I believe that verifying and vouching for the identity of it's citizens is one of the legitimate roles of government. I find it odd that we can have government issued social security numbers, passports, and driver's licenses, but I can't go to some office and have the US government sign my public key or SSL certificate. For some reason, if it's electronic, government is expected to defer to the free market.
bitJericho 11y ago
The SSN was never designed or intended to be an ID number for anything but social security.
- scrollaway 11y ago
  As a french citizen, and on behalf of everybody I know who doesn't live in the US (and some that do), the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous.
  - iak8god 11y ago
    > the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous Especially since they get passed all around like that's not the case by employers, insurers, creditors, etc, etc.
  - __z 11y ago
    Someone fraudulently used my social security number. It is such a sick and terrible feeling knowing that your number is "out there" and can be used by anyone for a whole host of things. It feels horrible and really, really violating.
    - scrollaway 11y ago
      I'm really sorry to hear that. Being a victim of an ill-designed system you're forced to be a part of is not a great feeling. :/
      - __z 11y ago
        Thank you for the empathy. The problem is it wasn't a designed system, it just came about by itself slowly over time. Social security numbers were never designed to be used in any way outside of social security.
    - seanp2k2 11y ago
jws 11y ago
This isn't about the normal theft of someone's tax refund by fraudulently filing a tax return. This about the IRS itself divulging the sensitive data required to fraudulently file tax returns. Someone tried about 200k times and got about 100k sets of people's tax histories. In the more mundane act of fraudulently bypassing the IRS's trivial security to steal a tax return… thieves got me, probably as a result of Anthem's inadequate security. The thieves didn't even have the courtesy to pay what I owed! I say you file my tax return, you take your chances. The maddening part, aside from the scramble when the April 14th filing from the tax people failed, is that no one in law enforcement is the slightest bit interested in enforcing the law.