April 9: See UPDATE at the end of this article.
With tax time approaching, spammers, scammers and phishermen are kicking it up a notch - with kid leather toecaps. Not only are their fake phishing sites getting slicker and sexier, they've even got customer service departments to respond to your cries for help.
Recently I looked up from wherever I had my head buried to note the looming tax return D-Day. Despite attempting each year to do my own taxes, I've caved in to H&R Block, running to sit beside one of their certified caftan wearing grandmothers or MG restoration experts, leaving relieved that someone with a certificate ok'd my number crunching. This year I thought, if millions of others can do it themselves, why not save my $300 and do likewise?
Of course, the task sank immediately to the bottom of my to-do tray.
No problem, just file an extension, right? Except that I'm on the road Downunder.
Well, surely I can do the modern thing and file this unremarkable form online?
Googling about suggests no – one needs to print it out and mail it in. Wait, the IRS says yes … via some "partner" sites. I find it a little disturbing that more and more sites, including the IRS, are directing you away to someone else's cyber-backyard – feels a bit like pulling away from the mother ship in a patched rubber dinghy with the mist closing in …
I thus landed on (what I thought was) the Intuit TurboTax site
which seemed to offer what I was looking for - "TurboTax Extension Express" .
Clicking on the rather obscure link leads you to a promising page:
then to a page with a strange, lonely box, asking for your login and user id.
Like a fool I soldiered on, not thinking for a moment that perhaps, being Downunder, someone might have gotten in between me and the real Intuit. The technical term for this is "link-jacking".
I filled out the form.
It asked me for my social security number, which doh! I duly supplied.
I submitted the form, and soon received a suspicious "receipt" in my junk mailbox.
Who was this LYNETTE CHIANG, living in 1000 Main Street San Diego, a few thousand miles from where I live in the USA? Here's the receipt.
The system told me the request had been submitted, but strangely, I wasn't asked for any money. I rationalized they'd get me when I resumed my online filing.
On attempting to save the receipt as a PDF, I ended up with a blank page. I got uncomfortable, and wrote to Intuit via their Contact screen.
At least I thought it was Intuit.
Subject: RE: Customer Service (#6565-98874206-9263)
Date: April 7, 2008 9:22:27 PM GMT+10:00
Dear Lynette Chiang ,
Thank you for contacting TurboTax Customer Service & Support.
Lynette, I understand that you have followed a link from our web site to file an extension. And it asked your SSN. Also you received an confirmation email. However you feel that this was not a right one.
Lynette, please do not worry. I will surely help you to resolve your issue. I checked with the order number you have provided and found that you have file an Online federal Extension for 2007. So Please do not worry. The link you have provided is the right one to file an Extension. So I kindly request you not to worry about this.
I am glad that we have resolved your issue today. You may receive a survey from us through e-mail in approximately 24 hours asking you about my performance on today's contact,
as well as comments you may have in regards to the TurboTax product. So we can continue with our promise to provide our customers with the best support available, please take a few minutes to complete the survey.
TurboTax Customer Service & Support
Have a great day!
Here's what it looked like
Oh woe is me. The above email raises several flags, for sloppy language, punctuation and the fact that the email comes from "turbotax" rather than Intuit - they say in several places on their site, "all our correcpondence will come from Intuit". But since I've been on the line for three days to a fairly helpful Call Center in India about a separate problem - trying to get my wireless USB modem working - how can I say anything negative about Geetha and not sound xenophobic?
Net scammers could well be rejoicing that their giveaway bad spelling and grammar might now be their best weapon, given that customer service is increasingly farmed out to foreign language call centers.
Feeling concerned, I told Geetha that I was going to report this to the IRS, but … the email bounced.
Slightly panicking, I decided to try and place a 90 day fraud alert on my credit report.
Via the (hopefully) trustworthy Federal Trade Commission Site, I navigated over to Equifax.com, one of the three credit reporting agencies.
Lo and behold, another online link, with a smiling woman also asking you for your social security number. Doggedly I filled it in and was dismayed when "nothing happened" on hitting enter – another telltale sign of something phishy.
I tried to call Equifax but was led around a phone labyrinth – the kind that say "good bye" at the end and hangs up.
Even the FTC site looked suspicious, asking for a barrage of info to be typed into a rather rudimentary HTML page:
And then I read with dismay that fake credit card agencies are now the vogue:
Not to mention Turbotax admitting to being a target itself for internet fraud:
Now why didn't they tell me this is big bold letters on their homepage?
Finally, I thought I'd appeal to the Intuit/Turbotax community. I tried to go onto the TurboTax forum and ask the rabble for their smarts, but despite being logged in, it kept asking me to log in.
There was nothing about any of this under www.snopes.com either.
I really don't know what to do or what make of all this – calling anyone leads to endless phone menus. I've either been phished, scammed and spammed, or web designers are just getting sloppy – I'd normally berate them for that crime, but they'll get a stay of execution this one time.
Exhuming my long lost skills as a former software tester, I went back into the extension request site to repeat the steps using dummy data, and this time a brand new screen popped up asking me to pay $9.95 and enter credit card details. Hello Intuit, is that you?
I'll be damned if I'm going to stick in any more personal data!
Now if Intuit had a Customer Evangelist she'd be on the phone calling me right now on my Australian mobile 0420 968 967 or emailing me at my address galfromdownunder at gmail dot com to solve my problem before I did any more PR damage – rather than have me scrambling about trying to contact them with no success. And the whole tax community would rise up and squash the scammers ...
Remember, a community needs to be fed and watered – a slew of forums full of unanswered pleas does not a community make.
I'm a child of the electronic age, but after this, I'm going to start championing pencil and paper again. Make that a wax pencil, the kind the Russian astronauts adopted – rather than a space-age one that writes upside down in a vat of honey ...
UPDATE April 9: After 2 days of frustration, I was rescued by some tech-savvy and CPA customers in the Bike Friday community who jumped onto this and the end result, after Intuit initially thought it was a scam, is daft but innocent. Thank you to Fred W in California and Bjorn in Seattle for the sleuthing:
Good News — it was not a scam. I finally trickled down to the
department involved and here is what happened:
1) The Intuit programmer in San Diego when out an personally reserved
the website when the idea came up (so nobody else could take it).
That was against all company policy (but having worked for a large
corporation I can understand the desired to just "do something")
2) They also are not very happy about the email that was sent to you
— the security person I talked to (Glee, her info is below) said to
tell you "we really aren't idiots" and that the matter is being
So if nothing else, we've given the people at Intuit and interesting afternoon.
Later, after customers fingered Intuit's location, office, and helplines using whois.com and gethuman.com, I received a note from a human being called Glee, who sounded a little like Intuit's cyber-brunette:
I accept this message on behalf of Intuit. You will receive additional information directly from Intuit’s TurboTax Support. (Twice)
Before softening up:
Well, Lynette, we are indeed human. Some times we are so fast we trip over our own feet. J I’ve sent your note on to our wonderful director of Assisted Support and you will no doubt hear from him soon.
Good luck with your taxes and hope your time down under is fun.
Well, Glee it hasn't been fun thanks to you folks, but it brings a little smile to my face: Big Corp brought down a few notches to sit eye to eye with our fallible selves. It does make Intuit seem human, something I've been championing all along in this Work/Life blog. Now if they could just do it without frustrating their entrepreneurial staff and scaring the hell out of us. Consider this a case study in the dire importance of clear and present customer communication, from web to woe.
Later ... I still haven't heard from their director of Assisted Support, and my one remaining concern: has my application for extension to do my taxes been received by the IRS, or hasn't it? I did not sign up to be your beta tester, Intuit!
I guess it's time to take a trip to the post office with an airmail envelope and a stamp ... - LC