Crystal Umbrella

Several users visiting the HM Revenue & Customs website used for self-assessment tax purposes have issued complaints that the site is not secure.  Users note that when they use the website their password is actually displayed as a part of the URL which is shown in a web browser’s address bar.

The security risk is that people can take the password and use it to access someone else’s tax information which is located on the site.  The field for a person’s username will auto-complete the name once you begin to type it.  Because the username and password are so easy to obtain it could pose a real security issue for anyone that chooses to use the site.

To make matters worse, any time you print a document from the website the URL is also printed at the bottom of the page.  Because the password is clearly visible in the URL, anyone that found the piece of paper would also find the person’s password.

 An expert on security at Cambridge University, Richard Clayton, noted that the password issue was not a common practice.  He said “Seeing someone’s tax return is not the same as accessing their identity, however. Though it could be a step towards doing that.”

HMRC has defended the website and has denied that a password is revealed in the URL.  Instead they said that it was actually a unique taxpayer number that was displayed, and that this had nothing to do with a person’s password or username.

Source: www.computing.co.uk 

Many tax payers using HMRC’s online self-assessment filing facility may have fallen victim to a computer glitch.  The system had an option available for taxpayers that allowed them to choose to pay their taxes by way of a special PAYE tax code. 

It is thought that hundreds of people decided to select this option.  The problem for HMRC seems to be that this option was supposed to only be available until the end of December 2008.  Unfortunately, HMRC can’t seem to figure out how to make the option unavailable so anyone that visits the site will see it as a valid option to choose.

Because the option appears to be valid, people may select the tax payment option without ever knowing that there is a problem.  No taxes would be removed through PAYE and a person could be liable for interest on the amount of taxes that were due.

 HMRC has said that anyone that ends up in this type of situation will not be penalized for their mistake.  According to HMRC “If customers use this option believing that having their underpayment coded out is still a valid option, we will show any underpayment in their PAYE tax code if they contact us and ask us to do so.”

It was also noted by HMRC that they will be contacting people who selected this option in early February.  Many people have already contacted HMRC in regard to the issue and have had the problem taken care of.

Source: www.bbc.co.uk