You will have to submit sensitive government documents, your Social Security number, credit history, and a face scan to ID.me, a third-party company.
Online tax filers in the United States will soon be required to submit a selfie to a third-party identity verification company using facial recognition tech in order to access their IRS accounts.
Starting this summer, according to an IRS spokesperson, users with an IRS.gov account will no longer be able to log in with a simple username and password. Instead, they will need to provide a government identification document, a selfie, and copies of their bills to Virginian-based identity verification firm ID.me to confirm their identity. That change, first noticed by Krebs on Security, marks a major shift for the Internal Revenue Service, which previously allowed users to access their IRS accounts without submitting personal biometric data.
In a statement to Gizmodo, an IRS spokesperson said users can still receive basic information from the IRS website without logging in, but added they would need to sign in through ID.me to make and view payments, access tax records, view or create payment plans, manage communications preference, or view tax professional authorizations. The IRS spokesperson later said the information he initially provided was not accurate. (See update below.)
So here’s how accessing IRS online accounts will work for most people later this year. Users attempting to log in to their accounts using ID.me will have to create an account with the company by uploading either a driver’s license, passport, or passport card. Users are then told to use a cellphone camera or their computer’s webcam to take a selfie. According to ID.me’s website, the company uses a face match facial recognition system to verify the selfie matches the provided government document. If approved in ID.me’s system, users can then use these credentials to verify their identity across any of ID.me’s partners.
If ID.me’s system fails to verify a selfie or flags other issues that could be considered fraud, the user may then join a recorded video call with an ID.me representative called a “Trusted Referee.” ID.me claims it has verified more than 2.8 million people through these referees and has begun implementing some in-person identity verification options across the country.
“ID.me offers multiple relief valves or escape hatches to ensure there is always a path forward for everyone,” the company said. “We are committed to a policy of ‘No identity left behind.’”
At least as of this writing, ID.me’s verification process does not work perfectly either. One member of Gizmodo’s staff was unable to verify their image due the quality of their webcam. Unable to resolve the issue, that person opted to ditch the digital system entirely and file their payment by mail.
I went through the first stages of completing an ID.me application to see what it was like. The process required me to submit a photocopy of my driver’s license as well as a face scan using my phone’s front camera. ID.me then required I submit my Social Security number and it requested permission to see information in my credit profile. Feeling sufficiently creeped out, I stopped short at that final stage but had I continued I would have given up a treasure trove of personal identifying information including government documents, credit history, and detailed biometric data.
In a white paper shared with Gizmodo by ID.me, the company was quick to draw a distinction between its face match system and lesser facial recognition verification systems.
“Face match is equivalent to an airport agent comparing your face to the photo on your government ID card,” ID.me said. “Facial recognition is equivalent to giving your picture to the same agent, putting him on stage at a rock concert, and asking him to pick your face out of the crowd.”
The key difference here is that, unlike some algorithms, like those used by Clearview AI, which scans images against a wide trove of potential matches, ID.me’s service compares the face scan to a single provided government document. Despite the distinction, digital rights groups like the Electronic Frontier Foundation have nonetheless expressed serious concerns over the use of face-matching technology. Speaking to the widely known issue of racial bias in facial recognition algorithms, ID.me claimed its internal research had shown “no detectable bias tied to skin type.” According to the company, the face-match step has a 98.9% pass rate per user.
ID.me assures users signing up for an account that it doesn’t trade, sell, or lease data to any third parties, though it does share some data with “select partners.” Prior to submitting one’s government documents, users are required to accept ID.me’s biometric consent policy. The company’s policy says it collects both facial biometrics and voiceprints. In addition to using these biometric identifiers to verify a user’s identity and protect against fraudulent behavior, the company’s policies state they may also be used to “comply with a request from law enforcement or government entities where not prohibited by law.” If a user does decide to cancel their relationship with ID.me, the company may retain that data for up to seven and a half years.
The IRS formally announced ID.me had become a “trusted technology provider” last November, but the company itself has been around for over a decade. Formed in 2010 ID.me has become a leader in identity verification, particularly among government agencies. The company gained attention last year when Reuters reported that at least 27 U.S. states spread out across the country were using its service to vet jobless claims applicants during the pandemic. States reportedly introduced the technology to combat a supposed increase in fraud. However, in some cases, filers said the additional layer of verification was creating a layer of hassle in accessing benefits particularly among those less accustomed to modern technology.
In New York, News10NBC detailed numerous accounts of residents struggling to navigate through the verifications system, including one woman who claimed she had waited 19 weeks for her unemployment benefits.
“Every week I call and I’m getting nowhere, it’s about $3,000, it’s only $168 a week but that $168 a week covers groceries, medical, and gas you know,” the woman told News10. “I’m at a loss here, I try to call to talk to somebody and ask what am I doing wrong here and I can’t get through to a real person.”
While these individual cases are anecdotal, they offer a potential warning sign for what may happen when all online U.S. tax fillers are encouraged to use biometric-based verification systems to complete a practice both fundamental and required of them by law.
Correction: When Gizmodo reached out to the IRS with a series of questions for this story, a spokesperson told us, “Taxpayers can still get information from IRS.gov without logging on, but to do the following actions, you would need to access your online account.” The spokesperson then listed a series of bullet pointed actions that include: “View or Create Payment Plans,” “Make and View Payments,” “Manage Communication Preferences,” “Access Tax Records,” and “View Tax Pro Authorizations.”
On Thursday, the same spokesperson informed Gizmodo that this is not accurate. They told us that taxpayers can still pay or e-file their taxes online without setting up an account. When we asked for documentation that explains that users can file without creating an account, the IRS did not provide a link but sent the following statement:
“There have been some wildly inaccurate statements regarding the use of selfies relating to paying and filing taxes. The IRS emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company. Tax payments can be made from a bank account, by credit card or by other means without the use of facial recognition technology or registering for an account. To help protect the security of taxpayers, the IRS uses an identity verification process for accessing IRS’ self-help tools such as checking your account online and getting a transcript online.”
So, as of January 20th, the IRS’s official position is that you can e-file without uploading a selfie, a selfie will be required for accessing your records through IRS.gov, and that’s not changing for now. Just be aware, when filing your taxes, that virtually everything will indicate that you must use this new system, but that’s not true. We regret the error.