Hacker News new | past | comments | ask | show | jobs | submit login
Intuit to share payroll data from 1.4M small businesses with Equifax (krebsonsecurity.com)
565 points by todsacerdoti on July 1, 2021 | hide | past | favorite | 207 comments



How to put a freeze on your employment data:

1- Head to https://theworknumber.com/view-my-data-sign-up

2- Create an account: you must create an account and make note of your account ID (that you choose yourself). You will be asked for it.

3- If you're curious, download your report (I did, it was interesting to know what they have on me)

4- Then go here https://theworknumber.com/employee-data-freeze/

5- You have the choice of using Email, Mail, or Fax, or you can call the number: 866-222-5880

6- I chose to call 866-222-5880

7- Press 1 for English

8- You will be presented with 3 options

9- Option 3 "To report a possible identity theft" is what you want

Someone will answer your call, ask your name, phone number, email address and finally ask why you are calling. Tell them "I'd like to put a freeze on my employment data". They will ask you for a reason; just say "It's personal".

You will be asked for your account ID and other information to verify your identity (they will ask your SSN).

Finally you will receive a text message with a code. You will give this code back to your interlocutor.

They will put a freeze on your data.


Opt out all you like, it'll still be in their next data breach.


Can I just say: unfathomable. This should not be even 1/10th this hard.


It shouldn't be necessary at all.


Or if you're in California, send Intuit a CCPA deletion request before this happens. Here's how: https://yourdigitalrights.org/d/intuit.com


Would this also delete all your TurboTax data?


It seems like you can't create an account if you don't have an employer they can find. Several of my previous employers are listed, but that just redirects to a sign on screen for those employers. The current employer is not listed.


As an aside, I really wish there was a public repository of corporate customer service hacks. Maybe it already exists?


My go-to used to be GetHuman[0], where they ask your number and the company you want to reach and (I'm assuming) robotically spam their customer service line to get any human on the phone and call you when a human is reached to connect you. I've received a call as late as 30 minutes after submitting a request on the website. When I pick up, I have to speak right away because it seems like the customer service rep has been on the phone for a few seconds.

Note: Sometimes that rep is not from the department you want to reach, but I've found their call transfer happens faster than calling via the typical process. I also haven't used the service in over a year, so I don't know how much this process has changed.

[0] https://gethuman.com/


Once it becomes well known and the steps get easier they’ll change the procedure. The whole point is to make it obscure and impractical.


This comment is the absolute pinnacle of... I don't even have the words to describe it.

"I've slogged through it and, after much trouble and time spent, have come upon the golden path. Here is the map of it; deviate from it at your peril."

Sometimes when I try to do this, people don't take it well; perhaps they think poorly of me for what they feel is me infantilizing them. I hope nobody feels that way about your comment.


This takes a while, but it does work. The agent I spoke with initially directed me towards completing and mailing in the form (BTW, they ask for your SSN on the form and think it's okay to send that via email), but when I asked if I could complete this via the phone call, she confirmed that I could.


I'm fine with sharing this data.


Thanks, took a minute but I'm set up.


Equifax and their "The Work Number" service limit your ability to negotiate a higher salary when you get a new job. The Work Number has your salary info — your current employer gave it to them. And your new employer knows your current salary — they get it from The Work Number.

If this isn't a serious violation of your privacy I don't know what is.

https://www.nbcnews.com/technolog/exclusive-your-employer-ma...


Their data can also be seriously flawed. When I went to apply for a mortgage a few years ago I was nearly rejected because "The Work Number" told my lender that I worked at Arby's and made $11.75 / hour. I've never worked for Arby's and my name is pretty unique (so I don't think it was a duplicate name issue). In any case I searched all 4 other people in the U.S. who share my name, and none of them had worked at Arby's either to the best of my knowledge.

I had to call Equifax, spent 1.5 hours on the phone with multiple confused reps until I found someone who could change my record. I thought there would be some kind of validation process, but nope they just asked me where I worked and how much I made.

It is such a broken system. I'm dumbfounded that Equifax hasn't been sued out of existence.


Congress explicitly protected Equifax when they had the massive data breach. The government chooses winners and losers indirectly through legislation, but this time they explicitly picked a winner because they chose not to punish them or make new laws.

https://www.pbs.org/newshour/nation/equifax-breach-congress-...

https://www.cbsnews.com/news/equifax-data-breach-was-entirel...


This seems odd. When I applied, they asked me for my W-2 to get my income.


But hey, when you win the inevitable class action lawsuit, you might get a $50 McDonalds gift card and a 1 year subscription to LinkedIn Premium.


More like a $50 credit at Experian/Intuit/The Work Number(parent corp. Experian). It's pretty common for class actions to actually benefit the defendant when plaintiff lawyers take their $millions in exchange for driving more business towards the services they were fighting. Which then simply change their ToS to allow the behavior they were sued over anyway.


Man I was furious when the Zappos settlement a few years ago was a 10% off a future purchase coupon. I don't see any possible way that was a punishment.

Never purchased anything with them since I saw that.


From Equifax?

Fat chance. I'm sure many people would take the $50 McD gift card in a heartbeat.

You're more likely to get 2-3 months of some sort of their protection service that will be "value-equivalent" to $50, not anything tangible or liquid in value.


And in order to get it, you have to click through a ToS that allows them to share your salary with future potential employers.


Heh I just got my $79 settlement from the last Equifax breach.


This page explains the problem with this very well: https://www.inlinereferencecheck.ca/blog/is-the-work-number-...

Imagine for a moment that your current employer is paying you significantly less than the market value for your role based on your skills and experience, and attempts to request a review of your compensation have been rejected. You may then consider looking for work elsewhere. It’s likely that the question of your current salary will come up at some point during the interview process with a potential employer.

What would you do in this situation? On the one hand, if you’re honest about how much you currently earn, the potential new employer may be reluctant to offer a significantly higher wage… even if it is the “market value”. On the other hand, if you exaggerate your current salary to reflect a figure that’s on-par with what you should be earning, you risk getting caught in a lie when that employer screens you using The Work Number. Clearly, neither situation is ideal.


> It’s likely that the question of your current salary will come up at some point during the interview process with a potential employer.

This is why places like California and NYC have made this question illegal. Candidates can still volunteer this information if they want, and employers can verify it in that case.

But, as another commenter already said, there are ways people can learn to deflect that question toward what they're looking for instead of what they're already making. Recruiters usually accept this after a certain amount of pushback, though not always.


My answer to this is that I work at a giant monster mega bank. As a benefit of employment I have exclusive access to many various financial products with the option to personally refer people directly to financial advisors at the bank’s expense. It’s hard to put a value on that. To compete with the benefits from a mega bank I expect a salary of XXX.

Then they can ask for my current salary but I have largely invalidated the question.


>if you exaggerate your current salary

I was once being paid way below market, and while I couldn't get a substantial raise, I eventually got a promise of a market salary in the near future. So I immediately started interviewing outside the company and told them about my promised salary when they asked what I was making.

Deflecting the question this way did work to get me hired at a more reasonable amount, without being dishonest according to my conscience. However, things rapidly soured, and it's possible they checked what my salary had been and never asked me to clarify, so I may have outsmarted myself.


In order to leave my current position I'd need an offer of $XXX. My current salary does not include additional side benefits that company X offers that you don't.


Also you can say you have other offers (or even go ahead with multiple applications) and therefore you want a competitive offer.


You could also make it clear that you are leaving your current position because you expect to be paid market rate or better.


Here's how to freeze this information:

https://theworknumber.com/employee-data-freeze/


It seems transparently slimy how Equifax tries to discourage opting-out.

Beyond the difficulty of opt-out, you have to send them more info (including your SSN, a copy of a government ID, and a proof of address that they offer can include your W-2 or paystub).

If only Equifax were even 1% as diligent about avoiding data breaches as they are at making sure no one can maliciously opt you out of them sharing this data that no one wants shared.


Not only do they have your salary info, they have it all broken down by frequency, gross pay, net pay, benefits, etc.

You can also see which credit card issuers run an inquiry on The Work Number if you pull your file, but you don’t get any sort of notification and there’s no way to monitor it.


And since governments themselves use it to look for tax and benefits fraud, they are unlikely to to do anything about it.


This comment makes no sense to me. Why would the government need to buy this data from third party? Both employers and employees have to disclose this information to the government and if they don't match, there's a problem.


States normally don't share data with each other or the feds.

As an example, CA might use The Work Number to check if you are working in NV but not claiming or under reporting that income on your CA medicaid application.


Local agencies (which often administer programs) very commonly DO NOT have easy direct access to your IRS tax filings.

In addition - some people don't file returns that they should.

In addition - sometimes their are crazy backlogs govt / IRS side (transcript services have been very off and on, 35 million paper filed returns still pending processing).

Work number does pay day to pay day updates, so is current to within a few days usually.


In that case, it sounds like it would be a good idea for the federal government to use the interstate commerce clause to start dismantling the work number system?

The original purpose of the interstate commerce clause was to ban state and local governments from collecting sales taxes on transactions cross state lines, so that states had to compete to keep excise taxes as low as possible, and rely more on direct land taxes on property owners instead. This was because Madison and many of the other early federalists and democratic-republicans were influenced by the Physiocratic school of economics which thought there should be no internal taxes on trade and labor, that all internal taxes should be direct taxes on land.

So if state and local payroll taxes and the work number system are the new rakeoff allowing state and local governments to fund property tax cuts for the rich, it would make sense for federal government to continue its grand historical tradition of using the interstate commerce to suppress this nonsense, in order to encourage any states with broken property tax systems that are struggling to raise revenue to appoint commissioners to redo their assessments instead, in order to discourage state and local governments from taking the easy way out and imposing regressive taxes on workers with the least leverage to complain.


Not at all true. Taxation, Labor, and Child Support agencies have real-time access to IRS data.

The issue is more about privacy rules. Local governments have to compartmentalize data and avoid impermissible use. They often buy data from third parties because the data isn’t “infected” with IRS compliance rules.


The many nonprofits supporting this space are largely locked out. If you want to do a financial eligibility screening for anything - you are either in hoop jump hell to get access to IRS data OR you use a service that makes it damn easy to cross check.

Luckily - in some cases you can send folks to go talk to someone at a child support agency or they do part of eligibility screening - but many of those folks never come back because they get gobbled up by the hassle factor over there (already disorganized / not stable in their situations).

I've become convinced that some of the eligibility screening hoopjumping is just to save money by making it damn difficult to get through the paperwork - even if you are actually poor (which is often obvious). I remember when some programs went to QUARTERLY eligibility verification on services delivered quarterly - so every visit practically was a re-screen on eligibility (the overhead of this is monumental).

So the desire / demand for private solutions to all this is there for sure. Some folks just do front-ends for systems like IRS transcript requests!


they buy data under the stupid assumption that you gave it to whoever therefore its been legally made free game.


Who says they buy it? They probably just call up a buddy over at the NSA and have them send it over


Wow. It’s shocking that this is legal.


Like it’s super super scummy but I can’t think of an a priori reason it would be illegal for me to share how much I’m paying an employee with a 3rd party. Since although my employee might want it to be secret it’s as much my information to tell as theirs.


Maybe in some anonymous form. Maybe. I absolutely don’t think “we’re paying Bob Smith $X,000” is an employer’s information to share.


This data shows how much your gross is per pay period and shows all bonus payments.


Posting from throwaway.

In my previous role at a large payroll provider, Equifax and few other players in the space over last two years were extremely interested in getting access to SMB payroll data, as it was the most economical way at scale to verify income for half of US labor force employed by SMBs.

Equifax was by far the most aggressive in both offering very generous compensation for that data and insistence as part of the deal on an opt out mechanism.


As in, they were insisting that employers have to opt out of the data sharing instead of opt in?


Yes. During initial meetings Equifax cited that their ADP deal has single digit opt out rate.


Doesn't the employee have anything to say in this?

The employers software vendor Intuit steals the data and sells it to Equifax for their own profit. The employer gets nothing, but could decide to opt-out. The employee who's privacy is being grossly violated gets nothing and cannot even opt-out of sharing the data?

GDPR doesn't sound like such a bad idea now...


So Equifax has a separate brand for this: TheWorkNumber. Technically each employee can opt out here: https://theworknumber.com/employee-data-freeze In practice nobody knows that opt out exists.

To be fair employees do get ~some~ value out of this, in form of of less paperwork verifying their employment during mortgage and rental applications. It's a different question whether it's valuable enough with all privacy downsides.


That isn't an opt out on data collection, is it? Like, the data freeze only stops people from accessing the data, but doesn't stop Equifax from adding data newly received from employers to the file? And then any data breach they have includes that new data.

What's more, any time you remove the freeze to allow someone to verify the data, you have to remember to put it back again if you want it to remain otherwise private, instead of lifting it temporarily for hours or a day or one inquiry or one verifier.


> The employee who's privacy is being grossly violated gets nothing and cannot even opt-out of sharing the data?

Government employees’ pay information is public information, and they seem to function fine in the world. I like Norway’s public tax record system, price transparency would certainly help the vast majority of participants in the labor market.

Only Equifax having access and selling info to other large organizations is the worst of all worlds, though.


This is the same Equifax that could not keep hackers from accessing your data. https://en.wikipedia.org/wiki/2017_Equifax_data_breach


Intuit and Equifax is like a duo of truly horrible companies that I'm definitely not surprised to know are working together. It's like Minus and Cortex except neither has big brains and the whole thing is not a funny joke.


For people like me who don’t recognize the names “Minus and Cortex” - I just learned that those are alternate names for “Pinky and The Brain”

Narf! Poit! Egad!


This screams for implementation of financial data privacy legislation. Please consider emailing your Congressional rep using Krebs’ link as a citation.


I wish there were a better way to actually get an answer from your rep. These emails really don't work. Even when they come in en masse they don't work. I know people who work for representatives and manage these email accounts. They have filtering rules to pick these sorts of emails up and and throw it in a folder never to be read. Especially those websites that automatically generate the email for you, those are almost guarenteed to not even have a low level staffer see them. Catch some choice lines from the body and straight to spam.

I asked these people how constituents are to reach out toward their representatives for issues that matter to them, and to be honest what they said was that the only way you are going to get a response is if you are representing an organization or a corporation capable of financing advertising campaigns that can influence large swaths of the electorate in question. A single voter will never be answered by a state level or higher rep, if you are lucky you might just get a canned response from the staff outlining the candidate's platform on the issue. If you are a representative from a special interest lobbying group though with thousands in the war chest, that will get you a long phone call or even face time with the representative. This is how the game is played on both sides of the aisle.


Great. Another several hundred pages to the legal code, another several hundred pages of regulations that all but 3 people will have the time to read and understand. No thank you. This country already has too many laws and regulations. We don't need more.

How about leaving the free market alone?


>How about leaving the free market alone?

Intuit has been aggressively anti-consumer and this particular instance is no different. They exist to benefit themselves at the expense of the average joe. Until the free market stops operating in said fashion, your question will continuously earn a resounding, "Nah," from me.

Edit: I am particularly perplexed by this post, given that OP recently suggested governments start "selling, if not mandating, its own operating system software to consumers and businesses alike" because they felt like consistent OS churn resulted in too much unnecessary e-waste. I don't disagree with the concern about e-waste, but I'm having trouble squaring away the dueling perspectives here.


> How about leaving the free market alone?

Well, if the free market worked, Equifax would have been sued into oblivion right now and no other company would be stupid enough to try BS like this.

But the free market doesn't work, so you need to protect yourself. The only way we can protect ourselves from greedy corporations is through onerous regulations with teeth.


Intuit aggressively lobbies to keep the IRS from doing tax reforms. Who's actually messing with the free market here?


Nope. I am in the free market too and my "best alternative to negotiated agreement" (BATNA) is dog droppings, ergo I have a vested interest to level the freedom of the playing field.


The free market is me emailing my representative and asking them to change this.


If you don't like democracy in action, I suggest you move to Somalia.


> In selling payroll data to Equifax, Intuit will be joining some of the world’s largest payroll providers. For example, ADP — the largest payroll software provider in the United States — has long shared payroll data with Equifax.

Does Gusto sell them your salary data as well?


We most certainly do not


I noticed that you all have a similar feature integrating with truework.

How does that work in comparison?


As someone who used to work at Gusto: Two separate opt-ins are required - one from the employer for adding Truework to their account, one from the employee to share the information for every request.


As someone whose pay is processed by Gusto, thanks. That was straightforward.


Oh thank goodness! Absolutely my first question when I saw this thread, and such a relieving answer.

I really don’t have the time and energy to switch to a different payroll provider.

Thank you!


Good answer.


Thanks for the direct answer.


Thank you.


Wow. I’m moving my company away from Intuit immediately and I’d encourage others to do the same. This is a massive violation of privacy.


And what are the other options?


For payroll ? We (rsync.net) have always had our payroll done by our private accounting firm. There are tons of providers - small and large - to whom you can outsource your payroll ...

Also, for the sake of completeness, you can do it yourself ...


And your accounting firm is likely using Intuit so...

--- -payroll provider +accounting firm


Gusto's a great option (I'm a bit biased, having worked there for like 5 years).


Screw Intuit with a chainsaw. I literally never see them on the news for doing something good that benefits average people.

In yesterday's news, "Intuit sabotages the Child Tax Credit": https://pluralistic.net/2021/06/29/three-times-is-enemy-acti...


Example of The Work Number data:

I just looked to see what they had on me. It was:

    1) 11 checks in 5 days from the re-finance company I used about a year ago to refi my home. Not sure why they had to check so many times. (from about 1.5 years ago)

    2) A part time job from over 20 years ago

    3) Past 5 years total salary & bi-weekly pay stub including gross & net take-home pay.

    4) Missing a bunch of jobs & positions I've had over the years.


How do you check?


Can we start including the names of the directors and VPs who are agreeing to these deals? This isn't just a faceless company, there are really people who are ethically compromised and we need to know who they are.


If you followed around the people responsible and posted everything they did, everywhere they went, and posted pictures of them it is called “stalking”. If you do it for everyone it would be called a “unicorn”.


They’re aggregating massive databases about us, so maybe it’s time for a database detailing the private data of the wealthy. I wouldn’t mind some naming and shaming.


I own a small business, and have resolved to NEVER use any Intuit product. It's not very hard, and actually opens one up to possibilities that make life a lot easier.


What do you use for accounting software?


If anyone has a one-person small business without payroll, I liked GnuCash for my consulting work (including abusing the invoicing system for time-tracking). https://gnucash.org/

If I had to do payroll, I'd probably try to find a SaaS that I could contractually lock to strict confidentiality. I wouldn't be in the business of saving pennies by selling out my employees' privacy.


> If I had to do payroll... that I could contractually lock to strict confidentiality.

This does not even remotely exist.

Getting anybody to do payroll for you means signing reams and reams of fine print where you absolve them, indemnify them, hold them harmless, and agree to bear their children. Well, maybe not the last part.

It's a nightmare.

It's somewhat expectable though. They're selling a service to people who don't want to deal with red tape (i.e. payroll) and read fine print (which is basically what doing your own payroll amounts to -- a lot of that). So their customer base is strongly self-selected for being susceptible to fine-print abuse.


Thanks. That explanation makes a lot of sense. :(


Some of my friends use Xero.


Gusto. They automatically pay my taxes, employees, do all the HRIS functions, and file forms with government entities. This is my first year with them, but so far, I'm pretty happy.


Very likely you will be using them in some form I'm afraid. Hard to avoid - especially for smaller businesses.

For example, since many other small businesses use them, you may be paying your invoices through their payment portal for bills sent to you.

They've done deals with bill.com (which bought divvy for 2.5B).

Your payroll provider may provide payroll information to assist employees with their intuit turbotax filings.


I think you are willfully misinterpreting what the parent said.

Not paying them directly for services is very different than never engaging in transactions which involve something as a third-party. And it means this person isn't directly paying them to do anything.


They said very simply that they "have resolved to NEVER use any Intuit product".

I just took that to mean what they said and pointed out it's hard to avoid using these bigger players software.


(Background: I own a payroll software company, not in the USA though).

I can't say too much because I don't want to expose anything confidential, but there's definitely good money in this. We've declined advances from similar companies. At least no-one has asked us for data proactively, which would be an insane thing to agree to, and which is what's being reported in TFA. In fact, the only way I'd agree to something like this is if the there was a simple approval step (e.g. employee gets an e-mail that says "Company X is attempting to access your payroll history, click this link if you agree."). But some people believe that negates the usefulness of their offering. Well, so be it. No sharing our data then.


As an employer, how do I prevent this.

Hell no is my visceral response (both initial and final).

I employ people and must act to keep their trust. I wouldn't want this, ever, and most people I have spoken with agree.


This is awful, especially since there are a number of startups in the "Plaid for payroll" space that are explicitly making it up to the employee whether they want to share their data, instead of it just getting vacuumed up by Equifax for everyone. That is, if you are applying for a loan, the loan website could pop up a "verify your employment data immediately with your payroll provider", you log in using your payroll creds, and then the loan company gets your data directly without having any access to your other payroll info.


"New service that will let millions of small business employees get easy access to employment and income verification services" It feels so very old school to have to share a data dump with a single "trusted third party". 1. There's plenty of payroll API aggregators out there. Launching a more powerful Intuit API would have sufficed. 2. People can already use open banking to verify their employment/income levels with their bank account.


The Work Number pays for this access.


Damn it feels good to live in the EU some days!


If they'll sell our QuickBooks data they'll sell our TurboTax data too.


Or give it away for free via data breech.


The government would never allow it.


So, an employer can opt out, but can an employee opt out? It’s their data, after all.


> It’s their data, after all.

Is it? I don't think there is any law that says an employer can't just publish your salary data, which would imply it is their data. And in some cases they are required to share it, such as with the IRS, SEC, social services, state IRS, child support, (Edit: this might be wrong -- and in some states they are even required to share it as part of a reference request).

It of course would not be a smart way to retain employees giving the data out willy nilly, but the law seems to say that it is the employers data to do what they want.


> and in some states they are even required to share it as part of a reference request.

Whoa, hold on. Is that really true? I found this list of states which have banned asking for salary data as part of a job application, but are there states where you're required to share it with a company just because they've asked on the application and are requesting it for verification?

https://www.hrdive.com/news/salary-history-ban-states-list/5...

Which states?


I honestly don't know. I've been told that by HR folks that I know but never looked into it since I'm in California and it's illegal here. It's possible that it is bad information. I'll update my comment and remove it since neither of us can verify it.


Personally, I don't take anything coming from HR as gospel.


Yes, you can, and I encourage everyone to do so:

https://theworknumber.com/employee-data-freeze/


Anyone create an opt-out service that scans business/news releases and percolates that info up in a presentable way?


Can anyone confirm this information is actually shared? Last month, I went through a background check for a new position which used The Worknumber. Not all data was present & correct (a previous employer was acquired and that goofed some data). When I was asked by The Worknumber to correct it, they wanted a W2 and said (direct quote from web form):

"Please redact or conceal any compensation related information on any documentation you submit. It is not permissible (either by law and/or company policy) for <new company> to view such information as part of your background check."

So can the new company actually get access to the compensation information? Is that perhaps a state law?


There are several states which prevent asking about current compensation (MA allows it only after making an offer of employment; other states likely have their own wrinkles).


What's crazy is this thing also will also create an immigration employment letter on behalf of your company (with a fake letterhead). I can't imagine many companies would appreciate this.


Fuck both of these companies.


What about an employer sharing your salary level is not price fixing for labor costs?

If separate companies agreed on a ceiling for how much they would pay developers, there would be criminal charges, but if it's done through an intermediary like Equifax, somehow it's now legit?


Well it provides a very very useful negotiating position, but there's no sense in which they are coordinating what to offer you with other potential employers.


Sounds a lot like coordination to me.


Well, I don't have to worry too much about this as it turns out.

Presently it reports I make significantly less than minimum wage. Additionally, it thinks I've been working for some engineering firm in New York since I was in high school.


Might be worth putting an employee data freeze in place: https://theworknumber.com/employee-data-freeze/


Email, mail, or fax a PDF form. Nice. /s


If it was only fax or snail mail only I'd be more outraged. The hassle associated with email is roughly symmetric. In other words, the hassle you having to fill out a form and attach it in a email is roughly equal to the hassle of equifax having to hire someone to manually process the emails. This is as opposed to something like fax/mail which is much more of a hassle for the average consumer (digging up a fax machine, or having to print something off and buying stamps/envelopes) than equifax (getting the mail delivered to their doorstep). Having an email rather than a web form was probably because they figured there wouldn't be enough request to justify building a CRUD app to manage it.


Snail mail can be a hassle, but on the flip side, with snail mail, you can send in the request via certified mail with a requested return receipt. This creates a legal record of when they received your request. Thus, if they don't act on it in a timely fashion, you can prove it. It is only tangentially related, but in Patio11's article on handling bogus entries on one's credit report[1], there's this wonderful line: 'I was sending “certified mail, return receipt requested”, which is Dangerous Professional for “Do you like paper trails? I like paper trails. I particularly like paper trails where the United States Federal Government attests to the exact minute your firm learned the contents of this letter.”' While not quite the same situation, I suspect such admissible-in-court-as-evidence[2] traceability of communication is of equal use here.

1. https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

2. This is my intuition talking here -- I am not a lawyer. If you have legal questions, talk to one. But, IMO it would be utterly bizarre if USPS record of when a specific piece of mail was received were not admissible as proof of claiming that company got your request.


Technically speaking you can assume that any business receives a mail unless specifically refuted by evidence, but lawyers like having the extra oomph that comes from demonstrating receipt.


> Technically speaking you can assume that any business receives a mail unless specifically refuted by evidence

PRETRIAL:

Sender (in a sworn pre-trial affidavit): I mailed this letter.

Addressee (ditto): I never got it.

Judge: We now have sworn evidence to controvert the Mailbox Rule (which establishes a presumption of delivery after mailing). That means I'm not allowed to rule summarily on that question. That in turn means we have to let the jury decide whether the letter was received.

To quote one of my former students: That's a conversation I don't want to have, because of what follows:

TRIAL:

Sender (under oath): I mailed the letter.

Addressee (ditto): I never got it.

JURY DELIBERATIONS:

Juror N (during deliberation): I believed Sender but I also believed Addressee.

Juror N+1 (ditto): I didn't believe Addressee.

Juror N+2 (ditto): I didn't believe Sender and I did believe Addressee.

VERDICT:

Now it's a roll of the dice as to what the jury concludes about whether the letter was actually received.

LESSON:

Use certified mail or other service that will provide independent confirmation of receipt, refusal, or reasonable efforts to deliver. (The Three R's of Notice.)


I'd say I'm generally not a big fan of the having to opt out approach.


Opt-out approach - polite way of saying "What we are going to be doing is most likely WILDLY unpopular, so rather than risk our potential pool of sucke-customers, we want are going to assume you want in, unless you explicitly tell us no."


Don't employers require employees' permission to share their data?


Premeditated data breaches like this are covered under the boilerplate language in your employment contract -- "sharing data with our partners" and other such nonsense.


Not saying I agree but (I think) the issue is that salary data is technically owned by the employer and not the employee.


The salary number itself yes, but it's only useful when linked to the identity of the employee. And in places with sane privacy laws that's illegal to do without the employee's consent.


It is your presonal information and it is not owned by your employer.

Your employer may have some right to share aggregated data, but not data that identifies you.


This should be opt-in not opt-out. Essentially the opt out process will be a way to harvest more information from people to fatten up there databases. Pathetic.


Switch to Xero. They don't share any customer data unless the customer wants to share with a third party.


So, propaganda-wise, it's basically "Yay! We're selling your data and that's a great thing because of service X that we could provide without selling data!"

Which is especially crappy considering it's a paid product, not some advertising-funded service.

GDPR is far from perfect, but we (the US) could really use something at least minimally comparable.


Not sure why I say that, but the whole credit score idea sounds horrible.


Sigh how about no, can we some how make this kind of BS illegal.


I guess we're all just money on the table, eh?


what could possibly go wrong.


I donno.. this again? https://www.equifaxbreachsettlement.com/

Can anyone really trust Equifax with our data, let alone Intuit feeding them more?


Equifax sells your salary data to employers so that they can negotiate against you.

They use a subsidiary called The Work Number to keep this evil separated from their good name (ha).

You can and should freeze your Work Number file:

https://theworknumber.com/employee-data-freeze/


Should be the top comment


I've been using Intuit Quickbooks Self-Employed for my contracting work and it really fucking sucks.

Paid invoices can't be added as transactions. Tax payments aren't correctly imported into TurboTax. The time tracker can't generate invoices.

There are so many sharp edges that can make their way into my Schedule C that I'm worried about being audited. This software clearly doesn't come from the "Have you even fucking tried using it?" school of software design.

And now on top of all that I have to worry about them selling my data to a credit agency that's a boil on the face of the economy.

Is there a better accounting/tax package out there? The only thing Quickbooks Self-Employed does well is scan receipts.


I remember seeing the Self Employed launch from inside the company. It was somewhat of a skunkworks project from 3 engineers and they got a lot of internal PR for creatively targeting the gig worker market. I guess the plan was to eventually branch out to other self employed people, but the initial motivation was Uber drivers and such rather than small business owners, because that would cannibalize the QuickBooks Online market. It doesn't sound like much has changed in the 5 years since I left. It sounds like you fall a bit in between their product offerings, but I wouldn't count on them handling all your needs because they'd rather people like you just moved to their full QBO product.

I also remember attending a session that Intuit offered on the competitor landscape and being quite surprised that Wave wasn't covered. Intuit just doesn't take them seriously, but their products, to me, seem better than just about every competitor covered in the session, including Xero. They've got a self-employed offering [0] that might be worth experimenting with since you can start for free and only pay when you need the premium features.

[0] https://www.waveapps.com/accounting/self-employed


Funnily enough, Wave discontinued their receipt scanning feature this month.


My understanding from a brief stint in an adjacent industry is that Xero is pretty good and popular for accounting, but I cannot vouch for it as an end-to-end solution for self-employment needs.


I use Xero for my business accounting. Works well. My accountant had never used it before, but had no problem grokking it.

Intuit has my email address from an abortive attempt to use Quickbooks, about a decade ago. It sucked so hard, I ran screaming.

Every now and then, I get an email from them, suggesting that I “reactivate” My account.

The unsub link is worthless. I have to log in with the nonexistent account, in order to unsub. The reset password function doesn’t work (non-existent account). I am doomed to get these emails for eternity, but they aren’t frequent enough to be much more than an annoyance.

But Equifax has a crappy record on data integrity. I expect an avalanche of penis pill spam, soon.


> The unsub link is worthless. I have to log in with the nonexistent account, in order to unsub.

Ah, hey, that's the same level of incompetence as British Airways. I'm in the same boat there, but that's why /dev/null exists, of course :)


> I have to log in with the nonexistent account, in order to unsub

I would consider this a CAN-SPAM violation. You can have your representative and AG apply some pressure.


Yeah…they aren’t interested in addressing this. Not sure why.

So far, it has only been a slight annoyance.


Xero is massive in Australia. Almost every small business uses it and every accountant supports it.

It has a highly populated plugin marketplace to, which is where I think you need to go for the receipt evening part.


New Zealand company, a guy I used to work with in Brisbane is a software architect for them these days in Auckland.

They had a good incentive program for accountants to bring on clients. My account was super disappointed I already had an account and knew how to give them just enough access to it to do their job, but no more.


If you're based in the UK I'd definitely recommend FreeAgent - https://www.freeagent.com

Disclaimer: I used to work for them as a software engineer, but having used Xero when I was self-employed I can definitely say FreeAgent is better.


Second this. Been on FA for at least half a decade and it’s great.


I can 2nd FreeAgent as a user of about 5 years.


I just use spreadsheets, if you design them well they work, and they're relatively portable between the few major spreadsheet products out there. LibreOffice if you're worried about corporate eyes on your data.


Self employed wastes so much of my time. I had to completely redo everything this last tax year.

Switched to godaddy’s bookkeeping which still sucks but not many options out there.


Bench works super well for your use case, provided youre Ok with cash basis bookkeeping.


I'll add another nod for Bench. Been using them for 6 months now and they are friggin great.


Is it just like a Dropbox to upload receipts and someone reviews it? Do they tell you what's missing?


Keeper Tax is very user friendly, but designed for a simpler use-case. It only does expense tracking very well, but it doesn't have income tracking, or invoicing.


I personally use GNUCash for my budget stuff but I know they've got a lot of business oriented tools and reports. Might be worth looking into.


I've been using it for several years. I run all my freelance stuff through a specific checking account so I can just import all transactions and I have my p&L for the year, broken out by category etc etc.


https://plaintextaccounting.org

Not sure about receipt scanning though.


Most probably, they outsource most of the software engineering to consultancy agencies known for H1B abuse.


just curious, why do you even need to scan receipts? Cant you just use a credit card and import transactions from the card provider?


The point of receipts is if the IRS ever audits you.


is the credit card trail not good enough?


I don't think so. You could go buy $1000 worth of gift cards to give to your family on a business credit card versus legitimate business expenses. The receipt shows what you bought, a credit card statement only shows the amount.


No, the CC company actually has line-item information for almost all purchases (fall-back transaction processing and really old terminals are likely excluded).

Theoretically you can get your hands on that information.


thanks


For amounts over $75, it is not.

https://www.irs.gov/pub/irs-drop/rr-03-106.pdf


that's strictly for reimbursing an employee for an expense.


Good catch. I’ve been audited before, so I err on the side of caution and keep as much documentation as reasonably possible to substantiate business expense claims. Electronic storage is cheap, and audits are unpleasant.

https://www.irs.gov/businesses/small-businesses-self-employe...


got it, makes sense, thanks


Thanks again for pointing out my mistake.


Expensify has a really good scanner and sync-to-CC data system. I have only ever used it as an employee, but my understanding is that it has good backends synchronization with a variety of accounting packages.


I found Abacus much easier to use. Expensify was extremely convoluted, you had to create reports and then submit them, instead of just submitting expenses with a couple clicks.


FWIW, if your employer participates in employment verification systems with the credit agencies (like equifax), your salary and some other basic info of you working their is listed. You'll just need signed authorization from that person and their SSN. $30 bucks later you got their salary.


>Why should I worry about privacy if I have nothing to hide.

Microsoft isn't sharing telemetry data with these companies yet but they've shared data from other organizations they own.


Cant wait for equifax to then turn around and sell this as a feature to communities that want to keep people under a certain financial income out. We are rolling towards a Chinese style social credit system that is administered by financial companies instead of the government.


America has been doing that for the last 75 years. New data is not required.

1. Municipality sets minimum lot size and maximum density rules so living in the "nice" neighborhood requires buying more land than you actually need. Originally this replaced race based zoning.

2. Can't afford that much land? Go live in the other neighborhood that allows fourplexes, apartments, and condos.

3. Now that your community is segregated, it's easy to adjust city services so schools, roads, and parks are better in the rich neighborhoods.

Equifax credit scores are part of the system, but the root of evil is in land use policy. Deep red and deep blue local governments are all doing this.

"More than 80% of America’s large metropolitan areas were more racially segregated in 2019 than they were in 1990" https://www.theguardian.com/us-news/2021/jun/28/us-racial-se...

The report that interview is based on, https://belonging.berkeley.edu/roots-structural-racism


I don't doubt the consequences you've laid out, but isn't rent seeking[1] a simpler explanation as the motivating principle? For spatial goods, keeping a cap at density means preventing an increase in supply and keeping/increasing the value extractable of the already owned land.

[1] To clarify I am talking about "economic rent" in its wider meaning.


Why does everything that isn't maximal urbanism have to have some nefarious motivation to it? Maybe people just want privacy, a certain architectural aesthetic, and a lifestyle that isn't possible with overcrowding.


Most people are just pissed (me included) that in the vast majority of the US it's literally illegal to build housing and neighborhoods that many of us would like to live in.


It is not illegal to build housing in the vast majority of the US. Building neighbourhoods in existing cities takes city approval. You may want to throw up condos on the waterfront or knockdown low income housing to put up your storefront or build low rises on farms. Those ideas could work but your low rises need millions of dollars of work to get pumping,electrical,fiber. Removing low income housing or building condos in front of the waterfront has tradeoffs for society as a whole you must be weighted.

Most people understand this on some level and are not pissed off.


Most residential zoned land is single family house exclusive. Allow development there and there's no need to knock down low income housing or sprawl over green space. But that's not the choice municipalities make.

The municipal financial argument doesn't hold water. Urban areas generate tax revenue beyond their cost of infrastructure.


it’s easier to control people if they’re all living inside a huge city.


I have no idea what kind of control you're insinuating.


From recent history covid lockdowns come to mind.


It takes a certain motivation look at modern segregation and say, "but my aesthetic."


People will talk about "protecting property values", but I'm going to claim that's not the underlying motivation.

1. The history is easy, these rules were created originally to maintain racial segregation. The Color of Law covers this in detail. For a shorter form, check out https://grist.org/cities/zoned-out-one-womans-half-century-f...

2. Upzoning a property makes it more valuable. It's giving back property rights to the owner. There's no cost to the owner, but now large developers are a potential buyer. The _real_ selfish move is to demand that ONLY my property is upzoned.

When municipalities consider upzoning, we don't see 2. Instead we get people talking about "destroying" the neighborhood. Renters are referred to as transients. Occasionally the mask comes of and we hear about "those people". When people genuinely think those things are going to happen, they also think their property value will go down.

It's like people talking about the civil war in terms of state's rights instead of slavery. Makes perfect sense if you think of slaves as property.

Edit: To be clear, I think there's a lot of people that think of single family housing as a "lifestyle" that they prefer and are not necessarily bad people. However those with the most visceral reaction that actually become activists tend to be a combination of racist and classist.


Or just simple misaligned incentives. At the time communities are formed and lots are subdivided, they're planned out based on the prevailing population densities and consumer desires of the time. People move in because they like how the community feels, and then are disincentivized toward changing it because any change would take it away from the local optimum that they bought into. The people who would benefit are those who don't currently live in the community. Property owners get a vote; prospective property owners do not get a vote; ergo nearly all communities are biased towards the needs of existing property owners over newcomers.

Talking to boomers, I don't get the sense that either racism or property values are the motivating force behind zoning restrictions. Rather, they want to preserve privacy, natural beauty, traffic, neighborliness, and the general aesthetic that they bought into. Racial discrimination, high housing values, and homelessness are consequences that fall out of that, but most people voting for these policies are not thinking about those. It's "fuck you I got mine", but out of apathy rather than malice.


One could look at this and say that with higher mobility over the last 30 years people will increasingly select to live in socially cohesive communities.

We know this to be the case in other areas.


At this point though, I prefer a government run program. Considering Equifax can't manage to keep my data safe or keep their Java packages updated, and in addition not be liable to any damages caused, it is practically a public liability. Why not just make the government do it. At least they wont sell the data.


I don't think govt will keep their java packages updated either.


The government isn't much better at keeping your data safe:

https://en.wikipedia.org/wiki/Office_of_Personnel_Management...


Yes, but if the government screws up, the onus is on them to fix the lack of a secure way to identify a person. Re-issue new SSNs (maybe with more bits of entropy) to everyone, give everyone a UUID and public/private key, issue national IDs, whatever it takes.

If your bank or company or Equifax leaks all your SSNs the government won't take a shit, they'll just let people continue stealing your identity.



Right, they are not held to account by lawsuits but by elections.


What we really need is new credit line companies (credit cards, loans, etc.) that don't rely on the those shitty organizations.

We also desperately need a system that doesn't profit off the poor and hand it in the form of benefits to the rich.


They won't ever be that direct. It will just ding your credit score.


They already do. This is not new, just a new source.

https://www.equifax.com/product-sheets/income-verification/


If you're going to do business with sociopathic weasels like Intuit, demand a Data Use Agreement.

As part of your contract, enumerate allowed uses of the data and forbid the rest.


In other news, Facebook is buying Equifax.


Source? Can't find anything, add an /s if you're jesting.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: