How many eyes see bor­row­ers’ in­come taxes?

IRS li­censes ven­dors to ac­cess years of tran­scripts that are given to lenders.

Los Angeles Times - - REAL ESTATE - By Ken­neth R. Har­ney ken­har­ney@earth­ Dis­trib­uted by Wash­ing­ton Post Writ­ers Group.

WASH­ING­TON — You prob­a­bly heard about the mas­sive se­cu­rity breach the IRS dis­closed last month that al­lowed hack­ers to ob­tain de­tailed tax re­turn in­for­ma­tion on 104,000 tax­pay­ers.

But you might not have con­nected that event with a pro­ce­dure en­coun­tered by most home buy­ers seek­ing a mort­gage: Lenders rou­tinely re­quire them to sign an IRS form that al­lows un­der­writ­ers to ob­tain tran­scripts cov­er­ing mul­ti­ple years of past tax re­turns. The form in­volved is known as a 4506-T, and it’s part of the pa­per blitz that hits ap­pli­cants dur­ing the loan process.

Although the IRS said that just half of hack­ers’ es­ti­mated 200,000 at­tempts to ac­cess tax tran­scripts were suc­cess­ful, the sober­ing fact re­mains: Crim­i­nals were able to steal prodi­gious quan­ti­ties of pri­vate tax in­for­ma­tion.

Nowto the 4506-T sys­tem used for mort­gage ap­pli­ca­tions. You fill out the form, in­di­cat­ing which years of tran­scripts you au­tho­rize to be pulled. Your mort­gage bro­ker or lender then typ­i­cally pro­vides it to a third­party ven­dor that has signed up with IRS to ac­cess tax­payer tran­scripts un­der the In­come Verification Ex­press Ser­vice.

Some of th­ese ven­dors are large, well-known cor­po­ra­tions, in­clud­ing credit re­port­ing agen­cies. Oth­ers are lit­tle-known and small.

To sign up on the IVES sys­tem, ac­cord­ing to IRS in­struc­tions on­line, ven­dors must sub­mit ba­sic in­for­ma­tion about their busi­ness and check a box in­di­cat­ing that they agree to com­ply with an IRS pub­li­ca­tion spell­ing out pro­ce­dures to safe­guard tax­payer data.

The IRS pro­vided no com­ment to my re­quests for in­for­ma­tion on the 4506-T pro­gram, po­ten­tial vul­ner­a­bil­i­ties to data breaches and how many ven­dors par­tic­i­pate in the tax tran­script pro­gram. In­dus­try sources said the num­ber of ven­dors is sig­nif­i­cant.

Crit­ics say that although there have been no re­ported breaches of tax­payer in­for­ma­tion to date, the rel­a­tively low bars set by the IRS to qual­ify and mon­i­tor par­tic­i­pants are trou­bling. In 2011, the Trea­sury Depart­ment’s in­spec­tor gen­eral for tax ad­min­is­tra­tion con­ducted an in­ves­ti­ga­tion of the pro­gram and con­cluded that tax­payer in­for­ma­tion “is at risk of theft or mis­use when tax­pay­ers sub­mit IVES re­quests for tax re­turn in­for­ma­tion through third par­ties be­cause con­trols are in­suf­fi­cient….”

A key prob­lem, the in­spec­tor gen­eral said, is that the IRS did not have an ad­e­quate screen­ing process nor ad­e­quate min­i­mum re­quire­ments to en­sure se­cu­rity and pri­vacy. In re­sponse, the IRS promised to make im­prove­ments.

Curtis R. Knuth, ex­ec­u­tive vice pres­i­dent of one ma­jor tran­script ven­dor, New Jer­sey-based NCS, told me that his firm and oth­ers have urged the IRS to “toughen its stan­dards” and se­cu­rity con­trols for par­tic­i­pants, some of whom are sub­ject to “very min­i­mal screen­ing.” With­out stricter re­quire­ments, Knuth said, “there is the po­ten­tial” for breaches of mort­gage ap­pli­cant tax data.

The head of an­other large ven­dor, Nick Lim, CEO of Cal­i­for­nia-based Veri-Tax, said that “there is no sys­tem that is bul­let­proof.” But he said his com­pany“prides [it­self] on tak­ing se­cu­rity se­ri­ously” and that it com­pletes an­nual au­dits de­signed to test data se­cu­rity to the high­est stan­dards. NCS also un­der­goes rig­or­ous au­dits, Knuth said.

Based on the record so far, your tax data ap­pear to be safe. Then again, the IRS — and thou­sands of tax­pay­ers — thought the IRS’ own in-house tax tran­script sys­tem was well guarded from theft and fraud. That turned out to be in­cor­rect.

Jac­que­lyn Martin

JOHN KOSK­I­NEN of the IRS tes­ti­fies to Congress last week on the breach of 104,000 tax­pay­ers’ data.

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.