IRS will require taxpayers to sign up with ID.me to access their online accounts

Starting this summer, taxpayers wanting to access their online accounts on IRS.gov will soon be required to take a selfie and verify their identity with ID.me.

Existing online accounts with IRS.gov, which require only an email and password to access, will no longer work as of the middle of 2022, the agency says. 

The IRS says the move is necessary to protect taxpayers from potential identity theft, but privacy advocates say it’s invasive and point out that the company behind ID.me has a spotty record in verifying people’s identities. 

The move “will only lead to further ruin for Americans when their data is inevitably breached,” Jackie Singh, director of technology and operations at the Surveillance Technology Oversight Project, said on Twitter.

ID.me, a 12-year-old company that started as a way for military veterans to get discounts, has boomed during the pandemic, becoming the government’s default ID-verification system. The company has pulled in over $200 million in venture funding and secured contracts with 27 states as they try to root out fraud in the unemployment system, for instance. It’s valued at $1.5 billion, Bloomberg reported. 

A spokesperson for the IRS said that Americans would not need to take a selfie or make an ID.me account in order to file their tax return, calling the notion “wildly inaccurate.”

“The IRS emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company. Tax payments can be made from a bank account, by credit card or by other means without the use of facial recognition technology or registering for an account,” the agency said in a statement.

However, taxpayers will need to register with the new security system to see records of previous payments, access their wage transcripts or to access their Child Tax Credit Update portal.

Additional IRS tools will transition to use ID.me verification “over the next year,” the agency said.

A long verification process

CPAs commonly advise taxpayers to request a transcript from the IRS — which details all income that employers, banks or online platforms have reported to the agency — before filing a return. 

Security researcher Brian Krebs first spotted the change on the IRS’ website and detailed the extensive process of verifying his identity with ID.me.

To sign up for an account, users need to provide an email address and a landline or mobile phone number, upload identity documents and take a selfie with a camera that will then scan the user’s face to verify their identity. If the application flags any issues with a taxpayer’s documents, the person will be asked to do a video chat or phone call with an ID.me representative. 

“[F]or anyone who fails the automated signup, count on spending several hours getting verified,” Krebs wrote.

The user is also required to agree to the use of their biometric data, which ID.me says can include hand prints, face scans, facial geometry and retina scans. 

A Gizmodo reporter began the process of verifying his identity with ID.me but stopped when ID.me requested access to his credit report. 

Verification game

The IRS has sometimes struggled to protect taxpayers’ data, even shutting down its online transcript service back in 2015 after it was found that fraudsters were using it to steal identities.

“Privacy and data theft is significant at the IRS. They are deathly afraid of a hack,” said Daniel Morris, a CPA based in California. 

“The service is trying to modernize, and make sure from a data protection standpoint … they want to make sure that someone who is getting your data is authorized,” Morris said. 

However, ID.me is not without its problems. The system has been plagued by complaints from frustrated unemployment recipients who said they couldn’t get past the verification process, with one California senator blaming it for putting “thousands of legitimate claims in limbo,” Bloomberg reported.