Every year, like clockwork, tax season arrives, and as Benjamin Franklin proclaimed, “In this world, nothing can be said to be certain, except death and taxes.” This undeniable fact has driven the growth of tax software companies, which help households offload what can often be an intimidating, time-intensive exercise.
Using software means faster preparation, fewer errors, a lower chance of an audit, and refunds issued faster (averaging 21 days from the filing date).
The fiscal year of 2023
In the fiscal year of 2023, the IRS (Internal Revenue Service) processed more than 162 million federal individual tax returns and supplemental documents. American taxpayers spend 1.7 billion hours and $31 billion on tax preparation, with the average person spending 13 hours and $270 to file per year.
A survey commissioned by The College Investor of 1,200 Americans found that 46% use tax software to file, 27% use a full in-person service, and 16% still use pen and paper. The majority of software users used TurboTax 51% of the time and H&R Block 14% of the time, with several other software vendors in the 4%-5% range.
The biggest reason users chose a software option was ease of use.
Taxes and customer data
While tax preparation software has become an indispensable tool for convenience and efficiency, that convenience also brings inherent risks, particularly around safeguarding Personally Identifiable Information (PII).
Users use credit cards to pay for the software each year or for auto-renewals, home addresses to set up accounts and make payments, and Social Security numbers for identity verification.
The problem is that third-party vendor tags secretly monitor and collect the PII entered to purchase the software and file the tax return, putting both the user and the tax preparation software business at risk.
Popular tax software tools and risks
Leading tax software tools for consumers and businesses include Intuit’s TurboTax, H&R Block, Jackson Hewitt, and TaxAct, which millions rely on during tax season.
They save users time and money, but their widespread use and popularity also make them prime targets for data leakage and malicious actors seeking to exploit them.
Here are a few areas that need to be actively addressed when attempting to mitigate consumer data leakage, data privacy issues, malicious threats, and non-compliance with PCI:
1. Software Purchases & Digital Skimming
Tax software companies routinely handle transactions that require collecting and storing users’ credit card information.
When purchasing software online through a tax preparation software vendor’s website, users commonly use a credit or debit card for a one-time purchase or annual subscription.
Digital skimming has grown over the years as a common online threat actor practice for collecting and exfiltrating credit card information for malicious purposes.
2. PCI DSS Compliance
Companies like tax preparation software vendors that transact and store credit card information must also comply with PCI DSS v4.
The two new payment page security requirements, 6.4.3 and 11.6.1, require organizations to justify and validate that scripts have a business purpose, maintain their integrity, and alert personnel when scripts change.
3. Personal Information & Data Leakage
Tax software platforms often require users to input sensitive personal details such as filing status, Social Security numbers, and addresses.
Unauthorized access to such information can have severe consequences, ranging from identity theft to financial fraud. Any third-party tag on the website or software has unfettered access to this information and can collect and send it back to the vendor site.
4. Seasonal Account Creation and High Traffic Volume
Creating an account on tax software platforms can inadvertently expose users to data breaches, as user profiles store a wealth of personal and financial information.
As tax season builds, so do website traffic and software updates, including third-party scripts that become unmanageable for security and development teams to handle manually.
Client-side security risks
Each of these tax preparation software use cases has significantly increased risk to consumers and businesses, since this data is collected uncontrolled on the client side of the transaction.
As users enter data into open-field forms, they do so blindly, unaware that third-party vendors are also collecting this sensitive information.
Often, the vendors collecting this information are analytics, performance, marketing, or payment service JavaScript tags.
Others may be digital skimming attacks that inject JavaScript to maliciously monitor, collect, and monetize consumer information.
The urgent need for enhanced security measures
What can be done to avoid these malicious or inadvertent data breaches?
Tax software companies must fortify their defenses against potential breaches and cyberattacks. In 2023, a US Senate report found that some of the country’s largest tax-prep companies spent years sharing Americans’ sensitive financial data with tech corporations such as Meta and Google, potentially violating federal law.
Beyond typical personal details like names, phone numbers, and email addresses, the shared information included specific taxpayer data on individuals’ filing status, adjusted gross income, the extent of their tax refunds, and even insights into the buttons and text fields they clicked and entered during tax form submissions.
The report highlights the pressing need for tax software companies to prioritize security enhancements, leveraging cutting-edge solutions and best practices to fortify their platforms against emerging threats.
Comprehensive control with expertise that instills customer trust
Still, like many other merchants in different industries, tax companies need to collect and store sensitive customer data to operate their business efficiently.
The question ultimately lies in how tax preparation software vendors can effectively protect customer data while also enabling their businesses to operate and innovate.
When researching security vendors to support these requirements, every tax preparation software vendor should be evaluating a client-side protection solution based on the following criteria:
1. Comprehensive Platform
First-Party JavaScript Obfuscation
The platform should support standardized, state-of-the-art code obfuscation for all internally developed JavaScript throughout the product life cycle, from development to runtime.
Fine-Grained Third-Party Tag Control
The platform should offer consistent, fine-grained visibility and control over the behavior and data consumption of all third-party tags’ JavaScript across the entire business.
2. Best of Breed & Quality
The ideal client-side protection and compliance platform should focus entirely on client-side security and compliance. It should provide a comprehensive solution that protects businesses from emerging client-side risks and mitigates security threats, data leakage, IP theft, and compliance breaches.
This includes controlling credit card data on the payment page, as well as access to personal information often entered, including name, address, filing status, and Social Security numbers.
3. Top Notch Tax Season Performance
The platform must scale and support the largest and most demanding websites without slowing or disrupting the online user experience.
Because tax preparation software sees seasonal spikes in web traffic, the solution must scale up or down based on performance needs.
4. Sweeping Client-Side Security & Compliance Policies
A key feature of the ideal solution ought to be its ability to support the formulation by all involved teams (e-comm, product management, software development, fraud mitigation, security, digital, marketing, as well as governance, risk, and compliance) of a centralized security policy encompassing all client-side related risks and regulatory compliance requirements, including PCI DSS.
5. Client-Side Expertise
The chosen vendor should provide full customer support at every step.
Clients can get help choosing the right first-party JavaScript obfuscation techniques for their needs. For third-party tags, skilled consultants can guide them in setting up the best risk-mitigation strategies, including suitable data-fencing tactics. And if desired a fully managed service should be offered.
A vendor with the right level of expertise can support business operations while building customer trust.
By adopting a proactive stance on security, companies can strengthen their defenses against evolving cyber threats and ensure a safer, more secure, and more trusted tax filing experience.
