photo by Cory Doctorow
News of a large-scale data breach is always grim. But when the target is the Internal Revenue Service’s website, Americans are understandably queasy about their financial security.
The breach, however, was probably inevitable in a system where overreaching regulations drive people out of the banking system and necessitate riskier alternatives.
The news broke last week that hackers attempted to access the personal tax data of around 200,000 Americans this spring, and a little over half of these attempts succeeded. The attackers used the IRS’ “Get Transcript” system, stealing data including several years’ worth of past returns and other tax information the IRS keeps on file. While the IRS has said it will contact taxpayers by mail if their information was compromised, and will offer free credit monitoring to those affected, the type of data stolen means that victims may feel effects years down the line.
While these attacks have no reported connection to the type of fraud that plagued TurboTax customers earlier this year, both incidents make it painfully clear that the IRS’ security systems are inadequate. And part of the reason for this lax security is the demand for fast refunds - and for refunds that sidestep the traditional banking system, such as sending the money to prepaid debit cards.
The IRS introduced the debit card option in 2011 as a way to give those without checking accounts a cheaper way to receive their money, since check cashing fees can be punitive to those without standard checking or savings accounts. However, the fact that prepaid debit cards are not connected to a bank or financial institution also makes them incredibly useful to tax fraudsters, who can send many refunds to the same prepaid card without a bank to notice anything odd is going on.
Nearly 9.6 million American households were “unbanked” in 2013, according to the Federal Deposit Insurance Corp.’s data. This means about 1 in 13 households had no checking or savings accounts. An even larger group were “underbanked,” meaning that while the households had traditional bank accounts, they also used alternative financial services outside the banking system. Forgoing a bank account can carry real costs beyond the risk of fraud, so why are so many Americans bankless?
A big part of the reason is the Dodd-Frank Act and other regulations, which have pushed banks away from less attractive customers. This, in turn, pressures the government to send money to unknown parties on untraceable debit cards. Everybody loses, except the fraudsters.
The goal of financial regulations should be to get more Americans into the banking system, not drive them out. But our policies over the last five to 10 years have probably had the opposite effect. Consider a recent article in The Wall Street Journal that examined banks’ behavior in Nogales, Arizona. The town of about 21,000, which sits on the Mexican border, has lost four bank branches in the past few months, and many account holders have been informed that their banks no longer want their business. Banks are leaving these customers behind largely in an attempt to avoid huge regulatory fines for failure to defend adequately against money laundering.
Not only are some banks jettisoning current customers, but many are making it much harder to open an account in the first place. As banks are pressured to crack down on both “risky” customers and fraud, they are turning to increasingly strict criteria when evaluating applicants for new accounts. The same institutions that were roundly criticized for taking so many risks in the crisis now face accusations of unfairness as they take steps to weed out customers they think are too risky.
Banks are unsurprisingly twice shy, considering how hard they’ve been bitten by regulators. I have written before about the effects of making banks increasingly risk averse in the context of lending money and paying nearly nothing to depositors. The situation in Nogales illustrates that regulators may well continue to push banks even further - to a place where only the safest customers can do business with a bank at all.
This lack of access is already forcing individuals and businesses to use alternatives that are more expensive and less secure than traditional financial institutions. The more individuals and businesses we force out of the banking system, the more the government will be forced into using these less secure systems, too.
The banks brought some of this on themselves by their own aggressive and exploitive treatment of consumers, but a lot of the problem is regulatory excess inspired by politics. This may be why we are not hearing calls from politicians for the IRS and state tax authorities to take the obvious step of ending the use of debit cards for paying tax refunds. It ought to be the first thing anybody does - but doing so will call the government as well as the banks to account for Americans’ widespread lack of access to bank accounts.
Such an accounting, though unlikely, would be a good first step toward mending an unbalanced and insecure system.