State tax refund debit card data exposed to hackers
Sunday, December 08, 2013
The convergence of taxes and technology continues to run into trouble.
The latest issue is personal information of around 6,000 Louisiana taxpayers and another 7,000 or so in Connecticut.
Those estimated 13,000 individuals in the two states received their state income tax refunds via prepaid debit cards issued by the United States' biggest bank, JPMorgan Chase.
The card data, including taxpayer names, addresses, birth dates and Social Security numbers, could now be in the hands of hackers.
That security breach involving tax refunds is more than enough to make 13,000 this week's By the Numbers figure.
More than tax refunds: The total number of hacked accounts is even larger.
Around 465,000 prepaid cards nationwide were hacked, including folks who received other government payments such as child support and unemployment benefits via plastic.
So hacked taxpayer debit refund cards beyond Louisiana and Connecticut could come to light.
Delayed notification: Knowing that your personal data could be used by criminals is bad enough. But then discovering that they've had your info for months is worse.
That's right. The hacking apparently happened months ago, but Chase didn't notify the government offices or affected individuals until last week.
State Revenue Secretary Tim Barfield is among those who are curious as to why the delay.
"My question was 'Why are you just telling us this now?'" Barfield said of his conversation with the bankcard issuer on Dec. 4. "They indicated they'd been working on it with law enforcement, [but] I don't really have a clear answer on why they delayed."
Chase officials say there is no evidence that cardholders' information related to the preloaded cards was used improperly.
The hacked info came from cardholders who between July and September registered their debit cards online. Taxpayers who registered their cards by phone rather the Internet are not affected.
Chase officials believe the hacked data from the affected accounts is too limited to result in identity theft. That said, Chase has decided to make free credit monitoring available to impacted cardholders for a year.
The bank also is reportedly in the process of establishing a telephone hotline so cardholders can contact Chase directly to see if there is any problem with their accounts. The Connecticut Department of Revenue Services (DRS) also plans to provide its taxpayers with updates via the state tax website.
And if there are any losses to government issued cards, state officials say they will hold Chase responsible for making it up to the debit card holders.
More potential problems: As more of us rely on electronic transactions, the threat of hacking and subsequent identity theft also grows.
And the tax world will continue to be possible target when it comes to e-payments. While the Internal Revenue Service's foray into refunds via plastic failed, more states are turning to debit cards to issue state tax refunds.
In addition to Connecticut and Louisiana, tax refunds via debit card also are issued by Alabama, Georgia, New York, Missouri, Oklahoma, South Carolina and Virginia. Ohio is considering debit card for tax refunds for the 2014 tax season.
In some cases, the state tax departments give taxpayers the choice of getting refunds via plastic or paper. Others, however, issue refunds via debit card only.
The reasons, say state officials, is money. Many of the debit card recipients don't have back accounts into which refunds can be directly deposited. It's cheaper to issue them the cards, say state treasurers, than to print and mail paper refund checks.
Still, hacking and other security breaches are why many are leery of debit cards and other electronic financial transactions.
And while many of the affected taxpayers aren't the high-rollers that politicians tend to listen to, I suspect that lawmakers will want some assurances from their tax offices and the partnering financial institutions about how to make this process safer.
Connecticut DRS Commissioner Kevin Sullivan is already on the case.
While the affected taxpayers is roughly just 2 percent of the 360,000 total state-payment cards issued so far, Sullivan said he plans to work with state Treasurer Denise Nappier's office to "evaluate JPMorgan's future as a vendor, our remedies under the contract and the future security of income tax refund debit cards."
You also might find these items of interest:
I worked in Louisiana from 2010 to 2011 and filed taxes there. I was horrified to find that my refund was issued on a Chase debit card, thus (as Brian Huber pointed out) forcing me have an "account" at a bank I would not want to do business with. In effect, the state of Louisiana handed my personal information to Chase without my authorization. The state and a private business should not engage in this type of collusion.
Posted by: Sally | Monday, April 07, 2014 at 07:34 PM
No wonder I have so much difficulty ascertaining currency inflation by the Federal Reserve. Money in circulation has been replaced with “preloaded” plastic cards that are only used for spending after they are “registered.” Compounding the problem is that people are forced to have “accounts” for this so-called money at the biggest bank in the nation.
Posted by: Brian Huber | Monday, December 09, 2013 at 10:19 AM