Intuit Failed at ‘Know Your Customer’ Basics
Summary: Krebs on Security reported that Intuit's TurboTax did not require new users to verify email addresses or mobile numbers, did not perform identity proofing at signup, and until recently allowed multiple accounts to be created with the same Social Security number. Intuit announced changes in February and March 2015 - email notification of profile changes, removal of the multiple-profile password reset display, and out-of-wallet questions for password recovery - after unlinked state-only returns rose between three and 37-fold in that filing season.
Key Takeaway: Two former Intuit security employees said they demonstrated the account recovery weakness by hijacking the TurboTax account of CEO Brad Smith, and the company's own data shows unlinked state returns climbing as much as 37-fold in a single season.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026