From: michael@piglet.amscons.com (Michael Bryan)
Date: 18 Dec 1995 19:10:07 -0800
Subject: SSN Shown On Payments by Intuit's Banking Service

Another user ... discovered, and I confirmed, that Intuit's
online bill payment service sends your payees a printout containing
your social security number.

This applies to any person who is using Quicken for Windows or
Microsoft Money for Windows to send payment requests electronically,
using Intuit's service.  It specifically does -not- apply to using
Quicken with the Checkfree service, as the Checkfree service does not
supply anybody with your SSN.

The details:

When the Intuit service sends a payment to a merchant, it will do one
of three things.  First, it will try to perform an EFT directly from
your account into the merchant's.  Most merchant's are still not setup
for this, however.  Second, if your payment is the only payment going
to a given merchant on a given day, then they will print a check, drawn
against your account, and mail it to the merchant.  Both of these
methods are ok, and do not result in your merchant receiving your SSN.

However, if there are multiple payments going to a single merchant on a
given day (i.e., more than one customer has requested a payment to the
given merchang), all of these payments are sent in a single envelope,
and a summary sheet is enclosed.  This summary sheet will have a field
called "Control Number", which consists of your SSN, followed by two
other digits.  This summary also lists your checking account number, in
addition to your name, account with the merchant, and the amount of
your payment.  (In my opinion, only these last three fields are called
for.  There is no need for the checking account number to be listed,
even though it -is- printed on your check as part of the MICR
encoding.)

I have contacted Intuit regarding this matter, and they have been
decidedly less than helpful.  I know at least three other people who
have called them, and we have all been told the same thing:

1) "Most of your merchants already have your SSN".  Perhaps this is
true for some people, but it is not the case with me.

2) "The SSN is encrypted on the printout".  Absolutely not true.  It is
printed under the label "Control Number", and has two extra digits
appended, but this does not "encrypt" the number.  Anybody who knows
what the field contains has instant knowledge of your SSN.

Intuit is currently refusing to address this issue.  Furthormore, when
I called in, they tried to tell me I was the only person who was
complaining.  I immediately gave them the names of three other people
who had called in, one of whom I knew had talked to this particular
individual.  So that little "divide-and-conquer" trick backfired.

Also, when I said that I would be forced to go to the media if they
didn't address this issue, I was told that by doing so, I would be
responsible for broadcasting this information to those who might then
illegally use the information.  I found this two-faced attitude
particularly annoying.  On the one hand, they are claiming it's not a
problem, yet on the other they tried to keep me from going to the media
because it might give criminals information they could then exploit.

Anyway, I've done all I can with talking to Intuit, so I am now
pursuing other avenues.  My bank (Union Bank) was particularly
concerned that the SSN was being printed out and mailed with
potentially every payment, and vowed to look into it and work with
Intuit on my behalf to get this behaviour stopped.  Also, I and a few
others have contacted various media representatives, in an attempt to
get them to focus a spotlight on Intuit, and let people know that
Intuit is broadcasting their SSN, without their knowledge.  And of
course, I'm posting Usenet articles in the privacy newsgroups, as well
as the newsgroup where most Quicken discussion occurs,
comp.os.ms-windows.apps.financial.

If you are using Intuit's Online Bill Payment service, and are
concerned about this, please call Intuit and express your displeasure.
The number for the Online Bill Payment service is 708-585-8500.  Also,
call your bank, and inform them as to what's going on.  Finally, write
to your local (or national) newspaper, let them know about this, and
ask them to cover this in their paper.

It appears that the only way Intuit is going to address this is by
getting some negative publicity, since customer complaints don't seem
to carry enough weight.  I wish they were more reasonable, but that
just doesn't seem to be happening here.  So be it --- they want a
fight, they've got one.