Cybersecurity: BSI warns of vulnerabilities in tax apps

German tax law is generally regarded as one of the most complex in the world. This makes it all the more understandable that many citizens seek assistance with their tax returns. Thanks to so-called tax apps, this can now be done easily using a smartphone, even without a tax advisor. However, the German Federal Office for Information Security (BSI) is now warning against these popular apps.

BSI discovers vulnerabilities

A tax return is usually a complex matter for laypeople. The whole thing may be annoying, but it also offers the opportunity to receive an attractive refund. A short vacation is definitely possible. If you want to keep things as uncomplicated as possible, you can use tax apps. These make it possible to complete a tax return in just a few minutes. Sounds good, doesn’t it? The BSI is obviously not so enthusiastic about digital tax advisors.

As part of an investigation, the authorities have found a number of weaknesses in IT security. Consumers should now be aware of these if they want to choose an app. Common sense should tell you that you shouldn’t choose just any provider at random. After all, a tax app asks for a range of very sensitive data. This includes not only information on income, but also highly personal data such as your social security number. Hovering over all of this is the fear of identity theft, which is unfortunately becoming increasingly popular in cybercrime circles.

The boom in tax apps

The BSI did not make a statement without good reason. In fact, the authority has observed a gigantic upswing in software solutions and apps relating to tax returns in recent years. A survey conducted by the BSI confirmed this once again. In 2023, twice as many people submitted their tax return using a tax app than was the case in 2022. The fact that eight percent of consumers now rely on one of the apps for their tax return was immediately used by the authority as an opportunity for its security check.

BSI warns of potential dangers

As part of the detailed inspection, the BSI scrutinized two iOS apps, four Android apps and three web apps. However, the BSI did not specify which apps were involved. The nine apps tested were selected at random from a pool of 70 tax apps in total. The prerequisite was an interface with Elster – the online portal of the German tax authorities. However, an actual incident has probably not yet occurred. Instead, the BSI claims to have found vulnerabilities during its investigation that could be exploited by cyber criminals.

Tax returns made easy with the Taxfix app. I wonder if it also has the vulnerabilities criticized by the BSI?

The authority believes it is particularly important that users refrain from transferring data to third-party providers wherever possible. The BSI was able to identify this in a total of five of the nine apps reviewed. Outdated software, as found in three of the apps tested, also poses a risk. If you want to use a tax app in the future or are already doing so, you should keep this information in mind. It would of course be desirable for the developers of tax apps to revise their own applications in line with the points of criticism.