Password-protected bank statements

[wserra]

Alright, so this is not a question about tax practice. But, as I do every year, I was getting info together for our accountant to do our 2020 business taxes when it arose. I know IT folks read the board, in addition to IT hobbyists like me. So please read this, and tell me WTF is going on. I'll post my inquiry and the bank's response.

My inquiry:

For years, going back to our last firm, at tax time I would download statements, annotate, and combine them to send to our accountant. I did this last just a few months ago for PPP loan purposes. Several days ago, when I tried to get our tax info together, I found that our statements are password-protected. I have contacted tech support (as your records will show) twice over the last few days. Each time I have been told that it is a "known bug" and that they are working on it. I found that hard to believe the first time - how can a bug password-protect files, and even if it does, how can it take a week or more to remove? While they promised to get back to me, no one ever did. I checked five minutes ago - still PW-protected.

So, a couple of questions: (1) the old Microsoft question: is this a bug or a feature? (2) If a bug: when will you
fix it? (3) If a feature: why at sometime over the last few months did you implement it without telling anyone, let alone asking if anyone wanted it?

One way or the other: WE DON'T WANT OUR STATEMENTS PASSWORD-PROTECTED. Please stop it from happening. And, unlike your tech support, please get back to me.

Their response, which I just received:

Thank you for contacting us. I'm sorry you have been experiencing difficulties with downloading statements.

Thank you for telling us about this issue regarding a password to download your statements. We're aware of it and are working to correct it as quickly as possible. I'm sorry, but we're unable to provide an exact timeframe to when the issue will be corrected.

Wesley, we apologize for any inconvenience this matter has caused you. Thank you for your feedback. We will share it
with the appropriate team. We are continually working to improve our products and services to meet our customers' needs.

We appreciate your patience.

If you need further assistance, please send us a secure message. We appreciate your business and thank you for choosing [one of the international mega-banks that's too big to fail].

This has been going on for at least a week, because that's when I discovered it. Does it make sense to anyone? I have an idea, but really don't know if I'm right - so would like to hear other ideas before expressing mine.

Thanks (unlike my reaction to Mega-Bank).

[Dark Optimist]

My 0.02 - this was an intentional change to the bank's policies to password protect any document that has sensitive taxpayer information - specifically Social Security Numbers.

Without naming names or pointing fingers or raising hands - CPA's and other professionals are required to keep sensitive taxpayer information secure, meaning don't send it over email for god's sake and if you do, at a minimum password protect it.

So, just as a CPA is supposed to get a waiver from a client before sending a copy of their tax return to the bank for a loan application, it is easier to password protect the file and give it to the client and let them forward it to the bank. My guess is that someone at the bank decided it will reduce their exposure if the statements are all password protected.

And FWIW, I know the full version of Acrobat will let you remove a password from a file. I am pretty sure there are alternative (freeware) pdf readers that will allow you to remove the password.

[wserra]

My 0.02 - this was an intentional change to the bank's policies

I understand that it was your 0.02, and appreciate your donation, but then why doesn't the bank just say that? Their tech support outright told me that it was a bug. And I asked them specifically if it was intentional, in writing, and they wrote that they were "working to correct it as quickly as possible". See above.

And FWIW, I know the full version of Acrobat will let you remove a password from a file. I am pretty sure there are alternative (freeware) pdf readers that will allow you to remove the password.

I have the "full version" of Acrobat - Acrobat Pro DC. Yes, you can remove PW protection - if you have the PW. And I'm pretty sure there are no freeware or other programs that allow you to remove the protection without having the PW - although some imply they do until you read the fine print.

[BBFlatt]

Just a thought, can you create a new pdf document from the statement (without the pw) by printing to pdf? I don't recall the details but I think I've overcome password protection that way before.

[wserra]

can you create a new pdf document from the statement (without the pw) by printing to pdf?

You can, but it will leave you with an image, not a native pdf. I won't be able to perform the annotations and editing that I've done for our accountant for years.

Perhaps more than anything, I'm pissed off at the haughty behavior of the bank (I know - a bank, haughty?). I don't believe that it's a bug. They're gonna do what they want, lying about it in the process. Maybe one day we'll find out why. Maybe we won't.

Sorry.

[Judge Roy Bean]

I strongly suspect your well-known too-big-to-fail bank recently applied a policy change that defaulted to having all .pdf's that contained customer identifiable information encrypted and password protected.

You're at the mercy of multiple interfacing departments who had and have a hand in the deployment of the policy and one of them (first-line customer technical support) is the last to actually have facts at hand other than what they are told to say.

In short, it's really not a "bug." It's a feature setting and the change-control team is now faced with how to cover their asses as they point fingers at the compliance wonks who are pointing fingers at the security team who are complaining that they don't have the right product feature set because a few months ago someone (who probably no longer works there) decided to go with vendor A instead of vendor B.

And so on and so on and scooby-doo-be-do-be.

[notorial dissent]

I strongly suspect your well-known too-big-to-fail bank recently applied a policy change that defaulted to having all .pdf's that contained customer identifiable information encrypted and password protected.

You're at the mercy of multiple interfacing departments who had and have a hand in the deployment of the policy and one of them (first-line customer technical support) is the last to actually have facts at hand other than what they are told to say.

In short, it's really not a "bug." It's a feature setting and the change-control team is now faced with how to cover their asses as they point fingers at the compliance wonks who are pointing fingers at the security team who are complaining that they don't have the right product feature set because a few months ago someone (who probably no longer works there) decided to go with vendor A instead of vendor B.

And so on and so on and scooby-doo-be-do-be.

Or equally likely someone was "fixing" something and the "fix" is responsible and no one knows for sure how they did it or how to undo it. Either scenario does not speak well of them.

[eric]

Same same here in Canada, except that it is our tax people, CRA = IRS. Background: tomorrow is the first day of electronic tax filing season for this year. To make life interesting they locked out 100K taxpayers out of their accounts on Tuesday for "security reasons". Their initial response, until pressed by the media, was that affected taxpayers would get a letter in the mail explaining why and what to do.
https://www.cbc.ca/news/technology/cra- ... -1.5916607
To add to the fun, taxpayers who wish to use electronic filing have to use software certified by the CRA. According to their web site they haven't got around to certifying any yet. For any Canadians here they actually certified some software on Friday, go to your preferred vendor for further information.

[wserra]

And so on and so on and scooby-doo-be-do-be.

Agreed. It particularly pisses me off that they're lying about it to their own customers.

Thanks for the responses.