Krebs on Security

In-depth security news and investigation

Brian Krebs

  • About the Author
  • About this Blog
  • How Not to Buy Tax Software

    Scott Henry scoured the Web for a good deal on buying tax preparation software. His search ended at Blvdsoftware.com, which advertised a great price and an instant download. But when it came time to install the software, Henry began to have misgivings about the purchase, and reached out to KrebsOnSecurity for a gut-check on whether trusting the software with his tax information was a wise move.

    Five days after Henry purchased the product, blvdsoftware.com vanished from the Internet.

    Several red flags should have stopped him from making the purchase. Blvdsoftware.com claimed it had been in business since 2005, but a check of the site’s WHOIS registration records showed it was created in late October 2011. The site said that Blvdsoftware was a company in Beverly Hills, Calif., but the California Secretary of State had no record of the firm, and Google Maps knew nothing of the business at its stated address.

    Henry said that in years past, he’d always bought a CD version of the software. But this year, he opted for digital download.

    “I was going to download from Amazon — they sell a download-only version — and then I saw the cheaper site and went with them,” he said in an email. He installed the program, but said he didn’t enter any of his sensitive data. For one thing, he never received a license key from Blvdsoftware, and the program he installed didn’t request one. Now he’s wondering if the program was — at the very least pirated — and at worst — bundled with software designed to surreptitiously snoop on his computer.

    The errant buy was doubly insulting because Henry bought the software using a prepaid debit card, and now finds himself unable to dispute the charge.

    Buying software from random sites or companies you know nothing about and haven’t researched is a bad idea all around. But fail to do due diligence on a bargain site that sells tax return software and you could be handing your identity and computer over to cyber thieves.

    If you’re in the market for tax software downloads, save yourself the worry and hassle, and stick to known and trusted outlets online. Search for any of the titles listed at the cached version of Blvdsoftware’s site and you will probably discover that after the first page of results the vendors start to look pretty sketchy. Also, avoid using debit cards for online purchases.

    If your income is $57,000 or less, you can file your taxes online for free using IRS’ Free File software, available at no charge here. And remember that the IRS does not initiate contact with taxpayers via email. If, however, you do receive a snail mail notice from the IRS about more than one tax return being filed in your name, or that you were paid by an employer you don’t know, someone may be trying to fraudulently file a tax return on your behalf. See this page from the Federal Trade Commission for more information on tax related identity theft.

    Bookmark and Share

    Related posts:

    1. Software Cracks: A Great Way to Infect Your PC
    2. Software Pirate Cracks Cybercriminal Wares
    3. Energizer Battery Charger Software Included Backdoor
    4. New Software Turns iPad into iSpy
    5. Renewal Buddy: Comparison Shopping for Anti-Virus Software

    Tags: blvdsoftware.com, Federal Trade Commission, free file, irs, tax software, turbotax

    This entry was posted on Wednesday, February 22nd, 2012 at 1:31 am and is filed under A Little Sunshine, Latest Warnings. You can follow any comments to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

    27 comments

    1. Rich
      February 22, 2012 at 1:37 am

      How did that person who is familiar with your website buy from that site? Doh!? You would think this person would of known better ugh…

      Well-loved. Like or Dislike: Thumb up18 Thumb down14
      • Observer
        February 22, 2012 at 8:45 am

        Not everyone’s at the same level of awareness. People make mistakes…

        At least he trusted his gut feeling and reached out to someone he felt was knowledgeable.

        That’s the sort of thing you’d want to encourage, not chastise!

        Well-loved. Like or Dislike: Thumb up37 Thumb down3
    2. Scott
      February 22, 2012 at 8:42 am

      Brian,

      I had noticed advertisements for them back in January. Is this their new name?

      “www.blvdsoft (dot) com”

      Network Solutions is handling the DNS.

      Well-loved. Like or Dislike: Thumb up7 Thumb down1
      • EJ
        February 22, 2012 at 8:55 am

        I’d say there’s a good chance. The WHOIS record shows it was registered on 2/17/12, and lists a PO Box in Drums, PA, as an address.

        Clicking on the Contact link, you get:
        Blvd Software
        8950 Olympic Boulevard
        Beverly Hills, CA 90211

        Phone: (323) 952-8171

        Well-loved. Like or Dislike: Thumb up7 Thumb down1
        • EJ
          February 22, 2012 at 8:57 am

          The Drums, PA address is associated with Network Solutions, not the actual registrant. Apparently their going to hide their contact info.

          Well-loved. Like or Dislike: Thumb up6 Thumb down1
      • BrianKrebs
        February 22, 2012 at 9:34 am

        Sure looks like it. Nice find. When I called them, I got a default “MagicJack” voicemail message, not the most reassuring sign.

        Well-loved. Like or Dislike: Thumb up11 Thumb down1
    3. Bernardo
      February 22, 2012 at 10:45 am

      Hi Brian.

      While I do agree that buying online with a Debit Card is a bad idea I think doing it with a prepaid Debit Card is not a bad choice. Of course I’m still talking about buying from trusted sites. But even trusted sites might be vulnerable from a data breach. If such event occurs you don’t want hackers (or buyers for such data) to have access to your whole credit, you might suffer a lesser or even no damage if the card number they got is for a card that has no more money left and might never have.

      Well-loved. Like or Dislike: Thumb up9 Thumb down1
      • heron
        February 22, 2012 at 11:15 am

        The advantage to using a credit card is that money doesn’t come out of your account when you make a purchase, so you don’t have to appeal to the bank to get your money back if fraud occurs.

        Prepaid debit cards incur monthly fees, so while they’re an option, they should be an option of last resort.

        Well-loved. Like or Dislike: Thumb up7 Thumb down0
        • Nick P
          February 24, 2012 at 1:24 pm

          Agreed. Additionally, credit card laws allow you to do a no-cost “stop payment” on a purchase. Last I checked, you have to try to resolve the issue “in good faith” with the vendor if 60 days have passed since the payment. Make sure you send it in writing through certified mail so they can’t “loose” it. ;)

          Like or Dislike: Thumb up2 Thumb down0
      • John
        February 27, 2012 at 1:31 pm

        With any card you use you should be sure to read all disclosures and fees before using. I agree prepaid debit cards can be a good way to go for one time purchase. Like Hanks case it sucks there is no way for him to get his money back but he also does not have to go through the hassle of filling out dispute forms for debit or credit cards. That is the nice thing about prepaid cards. If it is stolen all they get is what is on the card and nothing more.

        Like or Dislike: Thumb up0 Thumb down0
    4. heron
      February 22, 2012 at 11:19 am

      If you make more than $57,000, you can use the Free File Fillable Forms option from the IRS. No bells and whistles, but it works, and you’ll get your refund much quicker with e-filing and electronic deposit than you would if you were to send in the paper forms.

      Well-loved. Like or Dislike: Thumb up5 Thumb down0
      • d
        February 22, 2012 at 12:26 pm

        Yes, but I just hate the third-party site.

        Please note that by clicking on this link, you will leave the IRS web site and enter a privately owned web site created, operated and maintained by a private business.

        Like or Dislike: Thumb up5 Thumb down2
    5. John
      February 22, 2012 at 12:09 pm

      Hidden due to low comment rating. Click here to see.

      He need to know, what is torrents!

      Poorly-rated. Like or Dislike: Thumb up3 Thumb down25
    6. Matt
      February 22, 2012 at 12:20 pm

      Just to set the story straight, I have download TurboTax each year for two previous years from Amazon and the legit software also does not ask for a key, nor does Amazon or Intuit provide a key in the Amazon Software Library. I was also concerned about this, so I called Intuit and asked both years. They assured me that downloads of Turbo Tax from Amazon do not need a Key, and I assume other volume Intuit sellers work the same way. So, while a lack of a key can be a good indication of bogus software, it’s not always the case. Certainly the most obvious sign for the OP should have been the unknown bizarre looking website. Scary!

      Well-loved. Like or Dislike: Thumb up13 Thumb down0
      • BrianKrebs
        February 22, 2012 at 1:05 pm

        Interesting, Matt, thanks for sharing that. I have never purchased downloadable tax software before, but I also can’t recall purchasing a software title for download that *didn’t* require the entry of some kind of license or activation key.

        Well-loved. Like or Dislike: Thumb up5 Thumb down1
        • Michael
          February 27, 2012 at 10:09 pm

          Brian, with respect, I can think of a number of cases where there aren’t keys. Steam actually comes to mind, where a key actually exists, but the user is never asked to input it, and would actually need to go digging to determine if it exists at all. Impulse used to sell key-less software, in those cases, I suspect, it was the same, there was actually a key, but the user never saw it. Granted, most of my online purchases aren’t productivity software…

          Like or Dislike: Thumb up0 Thumb down0
          • JC
            February 28, 2012 at 1:25 pm

            Symantec used to sell a lot of their enterprise software without a key.

            Like or Dislike: Thumb up0 Thumb down0
    7. Matt
      February 22, 2012 at 2:53 pm

      This may explain why they dont bother with a key:

      from the TurboTax FAQ

      “Can I Install TurboTax on Multiple Computers?”

      “You sure can! The TurboTax End User License Agreement (EULA) for the Basic, Deluxe, Premier, and Home & Business CD/Download versions allows you to install TurboTax on all computers owned by you.”

      http://turbotax.intuit.com/support/iq/Install-Product/Can-I-Install-TurboTax-on-Multiple-Computers-/GEN12968.html

      Since this software isnt restricted to a single instance maybe they find it not worthwhile to ask for a key? I wish I could find something more offical so I could backup from phone call to TurboTax. I certainly had legit software from Amazon though, already filed, accepted, and received refunds.

      Like or Dislike: Thumb up2 Thumb down0
      • AlphaCentauri
        February 25, 2012 at 12:54 am

        Part of what you purchase with Turbotax software is the e-filing itself (as well as support and the accuracy guarantee). You get a certain number of free federal and state e-filings included with your purchase, then you are charged for additional ones. So if you share your disk with too many friends, they will still have to pay Intuit a fee at the end of the tax preparation process. There’s not much chance they’ll balk at paying a few bucks after they’ve done their entire returns. It’s probably a pretty good way to increase the Turbotax user base while limiting the effect of piracy.

        Like or Dislike: Thumb up0 Thumb down0
    8. Matt
      February 22, 2012 at 4:15 pm

      Not to beat a dead horse, but I emailed Amazon support to triple check and here is what I got back:

      “Hello,

      I’m sorry for the issue with the product key for “TurboTax Home & Business Federal E-file State 2011 for PC.” I understand that you are unable to see the product key in your Games & Software Library.

      I have looked into the requirements for TurboTax Home & Business Federal and it does not require a product or an installation key. You can always re download TurboTax from your Games and Software Library and there is not need for a product key for TurboTax.

      The games and software you purchase are stored in Your Games & Software Library on Amazon.com…”

      I’ll stop researching this now… P.s. Great blog, thanks!

      Like or Dislike: Thumb up3 Thumb down0
    9. Menham
      February 22, 2012 at 4:38 pm

      Hidden due to low comment rating. Click here to see.

      @ Brian: Did “Scott Henry” get the software he purchased? Was it infected with anything? Did it work? Or are you just touting Amazon and other big name retailers as sources for paid downloads of software?

      Poorly-rated. Like or Dislike: Thumb up1 Thumb down15
    10. Daniel
      February 22, 2012 at 9:13 pm

      Brian writes, “Also, avoid using debit cards for online purchases.” Note that just a paragraph above you state that he used a *prepaid* debit card. The distinction is important.

      There are several advantages to using prepaid debit cards for on-line purchases. First, it’s relatively easy to mask your identity with a prepaid card because you can use a fake address and name. Many prepaid card don’t require any official identification whatsoever. Second, if you keep the balance low on the card the amount of potential loss is limited to the balance on the card.

      I’ve personally stopped using credit cards entirely for on-line purchases that don’t require an actual physical good to be sent via the postal mail to me. The big disadvantage of credit cards is that they require one to use the same address and telephone information tied to the credit card on the third-party website in order for the charge to go through. So if third-party website is compromised the hackers now have vital demographics….perfect for use in synthetic identify theft.

      Too often people focus solely on the monetary hit of the compromise of one’s financial data. But in the right hands the demographic data gleaned is often just as valuable. Because prepaid debit card allow one to both disguise my identity and limit my losses they are the ideal solution for on-line purchases that don’t require a physical mailing.

      Well-loved. Like or Dislike: Thumb up10 Thumb down3
    11. Alex
      February 23, 2012 at 7:16 pm

      Thank you for the tip about the under 57 thousand filing options. I’m a college student who interns at an IT department and I love the articles you write. I was about to file with turbotax this weekend, but free is a pretty good deal :D

      Like or Dislike: Thumb up2 Thumb down0
    12. Linda
      February 27, 2012 at 10:22 pm

      but what about state taxes?

      Like or Dislike: Thumb up0 Thumb down0
      • heron
        February 29, 2012 at 5:25 pm

        At least some states let you e-file for free, on their own revenue sites.

        Like or Dislike: Thumb up1 Thumb down0
    13. Doug
      February 28, 2012 at 10:20 am

      I want to know, why do normal people actually buy the TurboTax or whatever brand of tax preparation software? Does everyone have businesses or itemize their taxes or file really complex forms other than the standard 1040EZ or 1040 that you honestly need the advanced features of the “Deluxe” versions of software?

      I have been filing my federal and state taxes online since 2001. I’ve never used actually software, I just use the company’s website to do it all online. (I have been using Tax Act.com for example for many years.)

      It’s completely free for federal filing, and then for my State of Ohio, I use Ohio’s electronic website to efile….completely free for state too.

      I have a pretty basic tax filing each year so it’s not a big deal, but I find it absurd why people have 10 versions of TurboTax for each year going back 10 years installed on their computer, when it’s completely unnecessary for probably 90% of the people that purchase the software. These companies websites do the same exact thing for free, and if you do need the “Deluxe” features, there are numerous prompts to upgrade as you fill out your information.

      And to the guy that went to “Blvdsoftware” to buy software…..sorry buddy but get real. You have Amazon, a trusted retailer for years, or your local Best Buy to buy software from, but you want to save a few bucks on a program you don’t even need, and that crappy site actually looked legit to you? Come on I’m sorry but hopefully you learned your lesson. You can’t fix stupid.

      Like or Dislike: Thumb up0 Thumb down0
      • Doug
        February 28, 2012 at 10:29 am

        It’s funny too…TurboTax.com has the “Deluxe” version on the official Intuit website, for only $29.95…..

        This “BlvdSoft” on the screenshot Brian provided has it for $32.95…??! So you aren’t even saving money versus the legitimate offical company site??!

        Amazon has the “Deluxe” federal for $25.95….so both of these sites are cheaper than the fake site….

        I don’t understand how you got swindled…I’m sorry but if it’s truly this easy to make money from people by putting up fake sites then I am in the wrong line of work!

        Like or Dislike: Thumb up1 Thumb down0