Online Security, a global provider of computer forensics and information technology risk mitigation since 1997   Original Source:    http://www.miami.com/mld/miamiherald/business/national/8362463.htm Laykin featured in Miami Herald Author:  Richard J. Dalton Jr. and Tami Luhby More Americans Use Internet to File Federal, State Tax Returns Apr. 4 - With a home full of boxes in preparation to move, Lisa Marino wanted to receive her tax refund quickly to help her buy another house. So the Farmingville resident, who has always filled out her tax forms by hand, filed on the Web. "I filed on the fourth of March, and I received my check on the 19th, directly deposited into my account," said Marino, who filed at hrblock.com. "That was pretty good." Marino is among a growing number of Americans who are turning to the Internet to make taxes less taxing. Filing completely on the Web is catching on since its introduction in the late 1990s, more than a decade after filing via PC-based tax software was introduced. While refunds arrive quickly whether the taxpayer is filing electronically using software, the Web or a tax professional, several advantages are driving the push toward Web-based filing. Web filers don't have to install software; they just head to a Web site and enter the information. And it's cheap, starting as low as $4 for federal returns. Furthermore, 60 percent of people qualify for free filing. Under a three- year agreement begun last year with a consortium of online tax services, the IRS has agreed not to offer its own free-file service if the companies offer free service to certain customers. Each company can set its own qualifications for the program, called Free File Alliance. But some security experts remain leery, and an independent IRS organization has questioned whether the agency should refer taxpayers from the IRS Web site to commercial entities that promote services such as refund anticipation loans. 2.6 million file for free Still, the free-file program has drawn millions. More than 2.6 million Americans filed via the program through March 26, a 24 percent jump from the same period last year, when the total number of individual filers was 130.7 million. But many are willing to pay for the service. TurboTax, the leader, drew 2 million paying customers for its Web-based service through March 20, up 18 percent from the same period last year. "It printed the forms for you, double-checked them at the end and went through some sort of electronic check to make sure that everything is correct," said Robert Hackett, a Manhattan resident who filed at turbotax.com. Bob Mark, 71, of Nesconset, who filed online via TurboTax, said, "This year has been a rotten winter, so I started playing around on TurboTax, and it's done. It wasn't that difficult." H&R Block, No. 2 for online tax preparation, drew 895,000 free and paying customers last year, double the number of the previous year, and projects about 1.2 million this year. "As people become more comfortable with online transactions, they also become more comfortable with online tax preparation," said Tom Linafelt, spokesman for H&R Block. Both tax software and Web filing reduce mathematical errors and allow users to print forms or e-file. Software users can prepare and print an unlimited number of returns for free but may pay extra to e-file. Web-based tax preparation generally charges separately for each return but includes e-filing. Still, either option is far cheaper than going to a tax professional, which averages $135 at H&R Block offices. Online tax services also offer a la carte products and services, including refund anticipation loans, audit protection, IRAs and mortgage refinancings. But the services have brought scrutiny from the Taxpayer Advocate Service, an independent IRS organization formed to resolve problems and recommend changes. In a report to Congress, the advocate service said the IRS Web site shouldn't be in the business of referring taxpayers to commercial sites that market such services. Refund anticipation loans are especially questionable and have been the subject of numerous class-action suits. Pete Gorga, the taxpayer advocate for Manhattan, said the organization is still investigating the marketing of products. "We don't even know how the taxpaying public at this point is viewing this." But Linafelt of H&R Block said that as the tax code becomes increasingly complex, many people are willing to pay extra for services such as tax advice. Online tax data tech support The online services also offer technical support, sometimes for a fee. TurboTax users also might have questions about error 20635, but the online help offers a brief explanation that the error means the system crashed and tax data would be lost. Customers who then turn to live chat and still can't resolve the problem can receive free phone support. But those who go directly to phone support have to pay $19.95. H&R Block offers free phone support, but customers pay for the phone call. So far this year, the local taxpayer advocate's office hasn't received any complaints about online filing. Early in the tax season, the IRS had problems involving resubmitting rejected forms and processing acknowledgements. But it quickly fixed the problems. Online filers interviewed for this story expressed little concern about security. Scott Gulbransen, spokesman for TurboTax, said people who use the Web-based service are already comfortable doing financial transactions online. "For them, to make the jump from doing those activities to doing their taxes on the Web is not a scary thing," he said. Janet Kowal, 48, of Sayville, who filed online via H&R Block, said, "I'm the kind of person who does everything online. I do my banking; I pay my bills." But security experts weren't as comfortable as consumers. Stuart McClure, president and chief technology officer for Foundstone, a security software and services company based in Mission Viejo, Calif., said a security breach is "just a question of when, not if." Erik Laykin, president of OnlineSecurity, said filing online is "as safe as walking across the street. You still can get hit by a truck." And a "truck" hit some customers at H&R Block in 1999. Though the breach was short- lived and affected a limited number of customers, it was serious, said Jaime Punishill, principal analyst with Forrester Research, a technology research company in Cambridge, Mass. "When certain customers logged in, they actually saw somebody else's return," he said. "They [H&R Block] just got scorched for it." Experts agree the transmission of the data from the PC to the tax preparation service is secure. But problems could lie at either end: the PC or the computer at the tax preparation service. On the PC, a virus could install a malicious piece of software that tracks every keystroke the user enters, capturing personal information. Or hackers could enter an insecure system. But an individual's PC is small fry for a hacker, who would rather attack the tax service itself, experts said. And any system that requests information, such as an online entry form for taxes, becomes vulnerable to hackers, who might type erroneous entries that confuse the system and leave it open to attack, said Andy Pilato, network security engineer for SecureInfo Corp. in San Antonio. Lance Cottrell, president of Anonymizer, an online privacy service in San Diego, said, "It's very, very difficult to make your network impervious to an attack by a well-resourced, experienced and dedicated team." Company employees could also try to read the sensitive information. With online tax services, the data reside on a computer at the company, whereas those who use software store the tax return information on their own computer. Tax preparation services said they employ technology to prevent security breaches and limit or prohibit access to the information internally. Chance of breach called slim While a few security experts said they wouldn't file online, most agreed that the chances of being the victim of a security breach are slim. Bruce Schneier, chief technology officer for Counterpane Internet Security Inc. in Mountain View, Calif., said, "The odds of you getting into a problem are small -- small enough to be negligible. So my feeling is don't worry about it." Some third-party companies issue security and privacy certificates showing that the sites meet certain requirements, but those companies rarely decertify a business for falling short of the guidelines, said David MacDonald, partner in the New York office of the law firm Kirkland & Ellis. Even a company following all the guidelines could be hit with a completely new, unanticipated virus or hacker, MacDonald said. And the terms of use at some sites may disclaim liability in the event of a security breach, possibly offering merely a refund in the case of a security problem. So while a security certificate is better than nothing, MacDonald said, "at the end of the day you're on your own." --