Wilton Officials Reassure Residents: No Personal Data Compromised After Tax Vendor Error

Wilton officials had to do some damage control last week after a vendor the town uses for tax payments sent emails with incorrect information to a “small number” of residents.

Those residents reported receiving emails about their property taxes due on their motor vehicles. The emails linked to their correct property information but included names of other people.

Residents notified town officials (and some contacted GOOD Morning Wilton) about the problem, and others took to social media to raise the alarm. They worried that if they were seeing someone else’s names or account numbers, then maybe someone else had access to their information, and perhaps their identity, personal data, bank account numbers or worse had been compromised.

Town Administrator Matt Knickerbocker said residents should not be concerned — no one’s personal identity or financial information was leaked or shared erroneously in any way.

“For people who look at this and say, ‘Oh my gosh, my personal information has been compromised, my ACH number for my checking account is out there. No, it isn’t,” he told GMW on Friday, July 28.

The vendor that made the errors is Invoice Cloud, which runs part of the online tax payment system. Knickerbocker explained that when an online user accesses their account to view their taxes, a shopping cart icon appears next to any amounts that are currently due. Clicking on that shopping cart connects the user to Invoice Cloud.

Invoice Cloud contacts the taxpayer’s bank to relay the amount due to the town — and that’s the only information Invoice Cloud has access to, Knickerbocker said.

“That’s the only thing they know. So they don’t they don’t have access to banking records — [they only know how much is supposed to be charged] and the
[resident’s town] account that it goes back to…” he said.

What’s more, information only travels in one direction — no credit card information or bank information gets relayed back to Invoice Cloud.

“That’s encrypted. It’s not actually held by Invoice Cloud. [Invoice Cloud] just tells [the] bank, ‘These people would like to pay,’ so it can’t go back the other way. So when Invoice Cloud transmits the signal to [the] bank to pay, then it gets paid.”

Knickerbocker said that as of Friday, town officials believed the mixup was related to a small number of residents and only in regard to motor vehicle taxes.

Officials also sent out a press release on Friday promising that the town’s tax records are correct, stating:

• All tax bill numbers and associated names are correct on the Tax Collector’s records. 
• Name errors were solely on the Invoice Cloud System. 
• Invoice Cloud does not have access to either the Tax Collector’s records or the state’s Department of Motor Vehicle registration system and could not change any names or data on those systems.
• All payments appear to have been recorded properly on the Tax Collector’s records.

Right Car, Wrong Name

Knickerbocker said the only taxpayers affected were residents who had signed up to receive advanced notification reminding them to pay their motor vehicle taxes.

Those emails linked to residents’ correct car property information but may have had someone else’s name.

“I don’t blame people for being nervous about that. ‘They’re telling me to click this link and it’s got somebody else’s name? To hell with that!’ [But] they can still pay that way,” he said, reassuring residents that the link to the town’s tax payment page would connect them to their correct account.

For anyone still too spooked to use the link in the email, Knickerbocker said they can manually search for their account directly through the town’s website, or pay by at the tax collector’s office in Town Hall (238 Danbury Rd.) or through the mail.

“They can drop a check in the mail as long as it’s postmarked by Tuesday, Aug. 1,” he said, adding that any online payments or in person payments must be made before 11:59 p.m. on Tuesday, Aug. 1 to not be considered late. The Tax Collector’s office is open 8:30 a.m.-4:30 p.m on Aug. 1.

Anyone who has already paid their taxes but is still worried can check with the Tax Collector (by calling 203.563.0125 or online) or verify with their own bank or credit card issuer to confirm everything has been processed correctly.

Knickerbocker cautions that it sometimes can take about 24 hours for payments to be reflected correctly, but reassures there’s always one other measure in place — Wilton’s Tax Collector Hollie Rapp manually verifies each payment.