From: nobody@REPLAY.COM (Anonymous)
Date: Thu, 21 Dec 95 09:06:58 PST
To: cypherpunks@toad.com
Subject: FWD: Intuit and SSNs
Message-ID: <199512211706.SAA10738@utopia.hacktic.nl>
MIME-Version: 1.0
Content-Type: text/plain


What does our man in Intuit have to say about this? 

>  Date: 18 Dec 1995 19:10:07 -0800
>  From: michael@piglet.amscons.com (Michael Bryan)
>  Subject: SSN Shown On Payments by Intuit's Banking Service
>  Organization: none
>  
>  Another user (Robert Mayo) discovered, and I confirmed, that Intuit's
>  online bill payment service sends your payees a printout containing
>  your social security number.
>  
>  This applies to any person who is using Quicken for Windows or
>  Microsoft Money for Windows to send payment requests electronically,
>  using Intuit's service.  It specifically does -not- apply to using
>  Quicken with the Checkfree service, as the Checkfree service does not
>  supply anybody with your SSN.
>  
>  The details:
>  
>  When the Intuit service sends a payment to a merchant, it will do one
>  of three things.  First, it will try to perform an EFT directly from
>  your account into the merchant's.  Most merchant's are still not setup
>  for this, however.  Second, if your payment is the only payment going
>  to a given merchant on a given day, then they will print a check, drawn
>  against your account, and mail it to the merchant.  Both of these
>  methods are ok, and do not result in your merchant receiving your SSN.
>  
>  However, if there are multiple payments going to a single merchant on a
>  given day (i.e., more than one customer has requested a payment to the
>  given merchang), all of these payments are sent in a single envelope,
>  and a summary sheet is enclosed.  This summary sheet will have a field
>  called "Control Number", which consists of your SSN, followed by two
>  other digits.  This summary also lists your checking account number, in
>  addition to your name, account with the merchant, and the amount of
>  your payment.  (In my opinion, only these last three fields are called
>  for.  There is no need for the checking account number to be listed,
>  even though it -is- printed on your check as part of the MICR
>  encoding.)
>  
>  I have contacted Intuit regarding this matter, and they have been
>  decidedly less than helpful.  I know at least three other people who
>  have called them, and we have all been told the same thing:
>  
>  1) "Most of your merchants already have your SSN".  Perhaps this is
>  true for some people, but it is not the case with me.
>  
>  2) "The SSN is encrypted on the printout".  Absolutely not true.  It is
>  printed under the label "Control Number", and has two extra digits
>  appended, but this does not "encrypt" the number.  Anybody who knows
>  what the field contains has instant knowledge of your SSN.
>  
>  Intuit is currently refusing to address this issue.  Furthormore, when
>  I called in, they tried to tell me I was the only person who was
>  complaining.  I immediately gave them the names of three other people
>  who had called in, one of whom I knew had talked to this particular
>  individual.  So that little "divide-and-conquer" trick backfired.
>  
>  Also, when I said that I would be forced to go to the media if they
>  didn't address this issue, I was told that by doing so, I would be
>  responsible for broadcasting this information to those who might then
>  illegally use the information.  I found this two-faced attitude
>  particularly annoying.  On the one hand, they are claiming it's not a
>  problem, yet on the other they tried to keep me from going to the media
>  because it might give criminals information they could then exploit.
>  
>  Anyway, I've done all I can with talking to Intuit, so I am now
>  pursuing other avenues.  My bank (Union Bank) was particularly
>  concerned that the SSN was being printed out and mailed with
>  potentially every payment, and vowed to look into it and work with
>  Intuit on my behalf to get this behaviour stopped.  Also, I and a few
>  others have contacted various media representatives, in an attempt to
>  get them to focus a spotlight on Intuit, and let people know that
>  Intuit is broadcasting their SSN, without their knowledge.  And of
>  course, I'm posting Usenet articles in the privacy newsgroups, as well
>  as the newsgroup where most Quicken discussion occurs,
>  comp.os.ms-windows.apps.financial.
>  
>  If you are using Intuit's Online Bill Payment service, and are
>  concerned about this, please call Intuit and express your displeasure.
>  The number for the Online Bill Payment service is 708-585-8500.  Also,
>  call your bank, and inform them as to what's going on.  Finally, write
>  to your local (or national) newspaper, let them know about this, and
>  ask them to cover this in their paper.
>  
>  It appears that the only way Intuit is going to address this is by
>  getting some negative publicity, since customer complaints don't seem
>  to carry enough weight.  I wish they were more reasonable, but that
>  just doesn't seem to be happening here.  So be it --- they want a
>  fight, they've got one.