I've got a hit for a small refund but they want enough for a good amount of identity theft. Can anyone verify this is a legit place being a .com not a .gov?