RECOMMENDATION 01124-1
RECOMMENDATION TEXT:
Remove geo-blocking to enable international taxpayers access to FFFF without restrictions It has been reported that FFFF is geo-blocked in Sweden, Denmark, France, Singapore, and Taiwan. There could be more. Many were able to get around the geo-blocking issue by using a VPN, but this is unsafe to transfer person data using a VPN. Geo-blocking provides a false sense of security while depriving international taxpayers one of the few free options available for them to e-file. Clearly, security is a top priority to prevent fraudulent claiming of credits or refunds, but these harms legitimate filers of FFFF while creating no significant barrier for fraudulent returns. If someone really wants to claim refunds fraudulently, it’s easy to use a U.S. Virtual Private Network (VPN) or rent a U.S.-based computer to get around geo-blocking of the website. If a VPN is considered as a workaround for legitimate access, it is also a workaround for malicious access. Cashing a fraudulent check from abroad is next to impossible given it is extremely difficult, if not impossible, to cash a U.S. check outside of the country. Checks are banned in countries like Sweden or Australia given it’s viewed as an unsafe money transfer method. Geo-blocking provides no security or benefit to taxpayers or FFFF and should be removed.
IRS Action: Recommended
RECOMMENDATION 01124-2
RECOMMENDATION TEXT:
Remove requirement to register or provide a US phone number and make as an optional field We understand that FFFF made changes to become compliant with the Federal Trade Commission Safeguard law rules requiring that all tax software companies, and tax professionals, secure financial Personally Identifiable Information (PII) using multi-factor authentication (MFA), which the FTC updated on in June of 2023. The FTC define “an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).” The MFA requirement directs the use of at least 2 types of authentication factors: (1) Knowledge factors, such as a password; (2) Possession factors, such as a token; or (3) Inherence factors, such as biometric characteristics. The FTC actually prohibits the use of phone, cell phone, and email for MFA. FTC link to the new Safeguards rules eCFR :: 16 CFR Part 314 — Standards for Safeguarding Customer Information: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 Removing the requirement of entering a US phone number to set up a FFFF account should be removed not only because it prohibits international taxpayers who don’t possess a US phone number from accessing FFFF to be able to e-file, but also because requiring it for 2FA goes against FTC safeguard law rules. This should be rectified immediately. Please review ID.me 2FA methods, it may benefit FFFF to integrate with ID.me since it already provides identity verification for the IRS.gov online taxpayer login and are international taxpayer friendly. The single remaining limitation that obstructs filing from abroad is the requirement for an SMS-capable US telephone number when registering. If these options aren’t available, then FFFF should accept non-US phone numbers in addition to US phone numbers for 2FA. The IRS position might be that telephone numbers are easier to trace than e-mail addresses and therefore a helpful fraud-reduction measure, but that can include foreign telephone numbers as well. Certainly, it costs more for the IRS to send a confirmation SMS abroad than within the US, but we are talking cents. A US telephone number is also required to be provided when scheduling a direct debit of tax owed in FFFF. US telephone number should be made into an optional field.
IRS Action: Recommended
RECOMMENDATION 01124-3
RECOMMENDATION TEXT:
Accept any email address to register for an account E-mail addresses with non-US country domain endings (example: yahoo.co.uk), are accepted for registration, but the system then does not send the confirmation code to such an address for verification, with no indication of the reason. Criminals can easily obtain e-mail addresses which end in .com or .net so this is another “security” precaution that is ineffective and causes more harm than good.
IRS Action: Recommended
RECOMMENDATION 01124-4
RECOMMENDATION TEXT:
Allow numeric postal codes to be contained within the city field for foreign addresses Justification: FFFF strips out any numerals from the field “city name”, but IRS instructions say to provide the city name in the manner specified by postal authorities in your country of residence. This often means postal code + city name, yet FFFF strips out the numeric postal code. This should only be done for domestic US addresses. This particularly prevents people living in Germany and parts of Asia.