Intuit Refutes Cyberfraud Allegations

Intuit refuted recent criticism of TurboTax's screening process for fraudulent tax returns and questions of its integrity in a statement.

“Allegations by two former employees are flat out wrong, and are based on their complete misunderstanding of the facts and total mischaracterization of our business,” Intuit said in the statement. “Any suggestion that Intuit or any of its leaders made decisions to sacrifice customer security for financial gain is untrue and without merit.”

The company is referring to the two former employees, interviewed by KrebsOnSecurity, alleging Intuit knowingly processed tax returns filed by cybercriminals. The ex-employees claim that Intuit made millions of dollars by delaying or not sending fraud numbers to the Internal Revenue Service and collecting the refund transfers (TurboTax's deducted filing fee) for those fraudulent filings.

“No one does more than Intuit to help the IRS fight fraud,” the company stated. “We do not get revenue from returns we have identified as suspicious and then the IRS rejects, and Intuit does not get paid through the refund transfer process unless the IRS accepts the return as valid and actually issues a tax refund. Moreover, Intuit’s market share is not based on submitted returns; it is based on accepted returns.”

The company went on to stress its emphasis on customer privacy and security.

“With the increasing criminal attacks on the U.S. tax system at both the federal and state level, and the constantly evolving methods that cybercriminals use, we recognize that we must continuously accelerate and strengthen the measures we take to fight fraud. We are working with the IRS and also fully committed to working with the states to aggressively combat cyberfraud.”

Intuit’s rebuttal also addressed its process of reporting this activity to the IRS.

“We provide reports of suspicious activity to the IRS, but we do not know the extent to which the IRS depends on our suspicious activity reporting to make its own determinations, and several reports from the Government Accountability Office (GAO) and IRS advisory committees corroborate this fact. We believe there is no industry partner that provides more or better reporting, or is taking a stronger leadership role both with the IRS and with the industry to help solve the cyberfraud problem than Intuit.”

Intuit’s full response to the allegations is available here.