Company accessed ROS without consent

skinny90

Hi all,

Looking for some feedback.

Back in 2014 I used a well known tax return company to claim back tax and expenses.

In 2015 I also did the same and on both occasions I had to explicitly provide consent for this company to access my account and claim on my behalf.

Since then I have been managing my tax refunds, expenses myself.

I would get lots of calls from said company throughout the following years, I have always said I wasnt interested and to stop contacting me.

I then started to ignore calls until about 3-4 years ago I blocked them from calling me due to so many voicemails they left.

Low and behold I received the below email yesterday :

"We checked your details on ROS and the information is that you already applied by yourself for 2021 tax year. We can claim an additional refund for the Medical Insurance that is reported to the Tax office. Can you advise us if you have any receipts for your expenses-Medical (we need the receipts for the claimed amount of E 396.00, Dental (you need to ask your Dentist for the Med 2 form), working from home (we need the receipts for your utility bills) or work related that you did not include in your initial application, so you can e-mail them to us and we can claim them for you.

Please also advise us your Job Industry & Job Occupation in 2021 so we can check if we can also include something additional."

Im annoyed they did this as I never contacted or consented for them to access my details on my behalf.

I dont know if they are entitled to access my account without consent or if im overreacting but I feel like they have overstepped

What should I do?

TIA

Jim_Hodge

Not sure where you go with this but did you nit change your password after giving them access in 2014/15?

Atlantic Dawn

There would have been new certificates issued in order to log in since you originally gave them access, how did they obtain them?

AndrewJRenko

Is it possible they are checking their ROS, not yours? Are they still listed as your agent?

Buddy Bubs

https://www.boards.ie/discussion/comment/119081031#Comment_119081031

It's my account on revenue.ie I imagine, not ROS. There's no digital certs for it, that's only for the main ROS for businesses and self employed. You can however set up a 2 factor authentication which would have stopped any unauthorised access.

Either way, I'd be annoyed a company went in without my consent in order to generate some business for themselves.

I image you nominated them as your agent when you used them.

If you didn't revoke that they are probably still registered as such.

Mundo7976

I tried using a crowd like this before, but found that I saved more by doing it myself. I happened to be on the phone to revenue one day a couple of years later and the officer mentioned that the tax back crowd were still listed as my contact & asked if I was still using them. I said no & she responded with 'its the better thing to do' - I could hear the distaste for them in her voice!

TL;DR: Make sure the tax back crowd are not listed on your revenue account at all, even if you have to call them to be sure!

ThreeGreens

A lot of people giving advice above but not undering how ROS works.

When you first asked them to do a return for you, you would have had to sign a form which appointed them as your "Tax Agent". They send this to the Revenue Commissioners (through ROS) and this gives them access to your account ("My Account" or "ROS") through their own ROS Log in.

After that, they don't need your password or your certificate, as they are logging in with their own ROS account.

They will continue to have access until you remove them. (There was a communication that I saw recently from Revenue saying that for people with only PAYE income, that the link would be automatically broken after 5 years, but I think that 5 years only starts this year).

If you don't want them to be able to access your account in the future, you should contact Revenue on 01-7383636 or through "My Enquiries" and as them to remove the tax people as your agent. Then their access is cut off and they can no longer look into your account.

As for whether they should or shouldn't have used the access that they had, I've leave for you and them to sort out! But the above is the mechanics of how it works, and how to stop them from looking into your account in the future.

skinny90

Hi All,

Thanks for clarifying.

I had changed my revenue pwd multiple times aswell as enabling 2fa.

They were indeed listed as my agent, im doubting myself now but im fairly I had removed them in the past.

I have now removed them

And yes I guess you are correct about ROS, I dont have access to that its myrevenue

Really annoyed non the less at their approach considering I havnt engaged with them in the last 6 years and have actively blocked them given the amount of cold calls

KR

seagull

In general, it's better to ask them to remove you from their list, or even add you to their "Do not call" list, rather than just blocking them.