IRS will require taxpayers to sign up with ID.me to access their online accounts
Starting this summer, taxpayers wanting to access their online accounts on IRS.gov will be required to take a selfie and verify their identity with ID.me.
Existing online accounts with IRS.gov will no longer work as of the middle of 2022, the agency says.
The IRS says the move is necessary to protect taxpayers from potential identity theft, but privacy advocates say it's invasive and point out that the company behind ID.me has a spotty record in verifying people's identities.
The move "will only lead to further ruin for Americans when their data is inevitably breached," Jackie Singh, director of technology and operations at the Surveillance Technology Oversight Project, said on Twitter.
Millions of users
The online IRS services that will soon require verification were used 60 million times in the last fiscal year, STOP estimated.
An IRS spokesperson did not answer a query on how many accounts had been created on the agency's site. The spokesperson noted that Americans would not need to take a selfie or make an ID.me account in order to file their tax return, calling the notion "wildly inaccurate."
"The IRS emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company. Tax payments can be made from a bank account, by credit card or by other means without the use of facial recognition technology or registering for an account," the spokesperson said in a statement.
However, taxpayers will need to register with the new security system to see records of previous payments, see previous years' transcripts or to access their Child Tax Credit portal.
CPAs commonly advise taxpayers to request a transcript from the IRS — which details all income that employers, banks or online platforms have reported to the agency — before filing a return.
Additional IRS tools will transition to use ID.me verification "over the next year," the agency said.
A long verification process
ID.me, a 12-year-old company that started as a way for military veterans to get discounts, has boomed during the pandemic, becoming the government's default ID-verification system. The company has pulled in over $200 million in venture funding and secured contracts with 27 states as they try to root out fraud in the unemployment system, for instance. Bloomberg puts the company's value at $1.5 billion.
Facial recognition is already extensively used by federal and state governments. A Government Accountability Office report last year found that 20 agencies used internal face-recognition systems, mostly to identify criminal activity. The GAO also concluded that most departments didn't track their use of non-government systems and didn't consider the "privacy and accuracy" risks of this technology.
Security researcher Brian Krebs first spotted the change on the IRS' website and detailed the extensive process of verifying his identity with ID.me.
To sign up for an account, users need to provide an email address and a landline or mobile phone number, upload identity documents and take a selfie with a camera that will then scan the user's face to verify their identity. If the application flags any issues with a taxpayer's documents, the person will be asked to do a video chat or phone call with an ID.me representative.
"[F]or anyone who fails the automated signup, count on spending several hours getting verified," Krebs wrote.
The user is also required to agree to the use of their biometric data, which ID.me says can include hand prints, face scans, facial geometry and retina scans.
A Gizmodo reporter began the process of verifying his identity with ID.me but said he stopped when ID.me requested access to his credit report.
Face-recognition software generally has been documented to have many flaws, including being more likely to mis-match Black, Asian and Native American faces than White faces.
CEO: More equitable, more secure
ID.me CEO Blake Hall defended the process as both more secure and fairer than the previous method of logging into IRS.gov. For instance, setting up an IRS.gov account currently requires verifying your identity with a credit card — a step that leaves out taxpayers without credit.
"The most damaging thing that can happen to your privacy is not taking a selfie, it's having somebody get access to your medical records, or to your tax information," Hall told CBS MoneyWatch. "That selfie control is actively preventing a massive amount of identity theft."
Verification game
The IRS has sometimes struggled to protect taxpayers' data, even shutting down its online transcript service back in 2015 after it was found that fraudsters were using it to steal identities.
"Privacy and data theft is significant at the IRS. They are deathly afraid of a hack," said Daniel Morris, a CPA based in California.
"The service is trying to modernize, and make sure from a data protection standpoint … they want to make sure that someone who is getting your data is authorized," Morris said.
However, ID.me is not without its problems. The system has been plagued by complaints from frustrated unemployment recipients who said they couldn't get past the verification process, with one California senator blaming it for putting "thousands of legitimate claims in limbo," Bloomberg reported.
In Colorado, one unemployment recipient spent months getting verified because he lacked high-speed internet, Colorado Public Radio reported.
Hall said that 90% of people who sign up with ID.me get through the automated checking method and that the technology meets the government's highest standards for identity verification.
