A Friend's Laptop Keeps Getting Hacked

My friend uses TaxAct, and does tax accounting, and he is having a problem with people getting past the firewall in his computer. The software company tells him it is not happening on their end, and he has updated passwords, removed autosave, and is trying to plug whatever holes he can figure out.

The hackers are basically going in through his computer, or at least his IP, and amending returns to alter the refund amounts, and redirecting the resulting funds elsewhere. He is not getting help from the IRS either as they won't help him.

Any words of advice I can offer him? The hackers have stolen nearly a million dollars.

 

Call the Police.

 

He is not receiving much help from them or from the IRS which is supposed to offer support for such things. I told him either the FBI or Secret Service possibly.

I guess what I am also asking for is some help on getting logs pulled that may be able to trace back where the issue is in his computer. He has a firewall and uses it. We are trying to figure out where they are getting in.

 

Has he checked the router/modem as a possible source of reinfection?

 

I'd say totally reset / DOD wipe the PC and reload the OS and the tax software, nothing else. BUT, if they finally come back to him, that might be destroying evidence..
or go get a new PC. I have to say this: only use software purchased from a legit seller, don't use 'cracked' software. What is the OS? Don't run XP - old unsupported software on the Internet. But my guess if the person is having this many issues, many of these steps would be hard for them to perform.

I am not a lawyer, nor do I play one on TV.

 

Thank you for replying, here are some updates...

He did check to see if the router/modem was the source of entry and he was told it was not.

The good news is the software was indeed legit and licensed from TaxAct. He did get a new laptop with a fresh install as his older one was showing it's age anyway. He has since gotten himself a VPN , disabled the ability to save any passwords, and has put 2FA in place. Here's hoping that cures the problem.

 

Who told him that? Even if it was his ISP I wouldn’t rule it out especially if his PC & other connected devices have been scanned for malware & confirmed clean. Is he connecting via Ethernet or WiFi? If WiFi is he using the router’s default SSID & passcode? If yes then I’d suggest he change it, update the WiFi details on the PC & monitor the problem.