H&R Block

UPDATE (4.12.08): The bug mentioned here has been resolved. Read the post and the updates at the bottom for the entire story.

I’ve been using H&R Block’s online tax services to do my taxes this year. While corresponding with one of their tax professionals through their online message center, I discovered a very serious security hole in their software. I won’t describe the exact steps here because I don’t want anyone to take advantage of this, but by clicking through the tax software in a specific order, I found that all of the messages in my message center were replaced with random messages between other customers and their tax pros. Many of these messages contained confidential information and had very sensitive attachments, like W2s and other financial documents, that I was fully able to download. The process of doing this is repeatable, so it’s definitely a bug.

I tried reporting this to H&R Block, but I don’t think I was very successful. Here’s how it went…

I called the H&R Block tech support number and spent 20 minutes on hold. A young woman finally answered and said, How may I help you? I explained that I was calling to report an urgent issue, where I could see other customer’s private information in my message center. Her only response was to give me another phone number to call.

I called the new number and spent another 20 minutes on hold. A young woman finally answered and said, How may I help you? I explained that I was calling to report an urgent issue, where I could see other customer’s private information in my message center. Her only response was, So… how may I help you? I repeated that I was calling to report a serious bug in their system to which she replied, I can open a support ticket for you, if you like? At this point I asked for her supervisor. After 40 minutes on hold, the supervisor came on the line and said, How may I help you?

By now, I’m pretty pissed off. I can’t believe I just spent an hour and a half on the phone trying to relay this issue and I’m no closer than I was when I started. I gave the supervisor the facts, and he asked me for my username. He logged into my account, but for whatever reason the screens he sees are different than the ones that I see, so he couldn’t click on the required items. My only option was to verbally describe the screens and steps required to reproduce the bug. He put me on hold for a few minutes, and then came back on and thanked me for reporting this issue. That’s it.

When I relayed the procedure to the supervisor, I rattled it off fairly quickly. I actually expected him to escalate the issue to a higher level tech support and I would be repeating it in more detail to someone else. But, he didn’t, at least not with me still on the phone. He didn’t appear to be taking any notes either, so I don’t know if he actually got it or not. It’s possible they were recording the call, but there was no standard message about that at the beginning, so I don’t know.

In addition to the security bug itself, I can’t believe I had such a hard time communicating the seriousness of this problem. Not only is H&R Block potentially screwing its customers, but they’re also opening themselves up to a giant lawsuit. One thing is for sure… I will NOT be using H&R Block Online again next year.

UPDATE (4.10.08): I don’t know if my support call yielded any results, but I did forward this blog post to the tax pros I had interacted with through the H&R Block website, and they are taking action. I was contacted by two different support people and we ran through the procedure to replicate the bug. They’re looking into it now. I’ll continue to update this post with any new information I receive.

UPDATE (4.11.08): H&R Block has informed me that they’ve identified the cause of the bug and are working on the fix now. They hope to have it implemented by late tonight. I’ll be testing this later to confirm the fix. They’re also doing research to determine how many people may have been impacted by the bug. They told me that initial data suggests it was a relatively small number of users. I’ll update this post when I know more.