Starting this summer, taxpayers wanting to access their accounts online at IRS.gov will need to take a selfie and verify their identity with ID.me.
Existing online accounts with IRS.gov, which only require an email and password to access, will no longer work from mid-2022, according to the agency.
The IRS says the ruling is necessary to protect taxpayers from potential identity theft, but privacy advocates say it’s invasive and point out that the company behind ID.me has a spotty record when it comes to privacy. verification of people’s identity.
The move “will only further ruin Americans when their data is inevitably hacked,” said Jackie Singh, director of technology and operations at the Surveillance Technology Oversight Project, noted on Twitter.
Millions of users
Online IRS services that will soon require verification were used 60 million times in the past fiscal year, STOP estimated.
An IRS spokesperson did not respond to a question about the number of accounts created on the agency’s site. The spokesperson noted that Americans would not need to take a selfie or create an ID.me account to file their tax return, calling the notion “grossly inaccurate”.
“The IRS emphasizes that taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company. Tax payments can be made from a bank account, by credit card or by other means without using facial recognition technology or opening an account,” the spokesperson said in a statement.
However, taxpayers will need to register with the new security system to view previous payment records, view previous years’ transcripts, or access their child tax credit portal.
CPAs generally advise taxpayers to request a transcript from the IRS — which details any income that employers, banks, or online platforms have reported to the agency — before filing a return.
Other IRS tools will transition to using ID.me verification “over the next year,” the agency said.
A long verification process
ID.me, a 12-year-old company that started as a way for military veterans to get discounts, exploded during the pandemic, becoming the government’s default identity verification system. The company has attracted more than $200 million in venture capital funding and secured contracts with 27 states as they try to stamp out fraud in the unemployment system, for example. Bloomberg estimates the company’s value at $1.5 billion.
Facial recognition is already widely used by federal and state governments. A Government Accountability Office report last year found that 20 agencies were using internal facial recognition systems, primarily to identify criminal activity. The GAO also found that most departments were not monitoring their use of non-government systems and failing to consider the “privacy and accuracy” risks of this technology.
Security researcher Brian Krebs first spotted the change on the IRS website and detailed the in-depth process for verifying your identity with ID.me.
To create an account, users must provide an email address and landline or mobile phone number, upload identity documents, and take a selfie with a camera that will then scan the user’s face to verify their identity. If the app reports issues with a taxpayer’s documents, the person will be prompted to video chat or phone call with an ID.me representative.
“[F]or anyone who fails automated registration, count on spending several hours getting verified,” Krebs wrote.
The user is also required to agree to the use of their biometric data, which ID.me says can include handprints, face scans, facial geometry and retina scans.
A Gizmodo reporter began the process of verifying his identity with ID.me, but said he stopped when ID.me requested access to his credit file.
The IRS has at times struggled to protect taxpayer data, even shutting down its online transcription service in 2015 after it was discovered fraudsters were using it to steal identities.
“Privacy and data theft are important to the IRS. They have a deathly fear of a hack,” said Daniel Morris, a California-based CPA.
“The service is trying to modernize and make sure from a data protection perspective…they want to make sure that whoever gets your data is authorized,” Morris said.
However, ID.me is not without its problems. The system has been plagued with complaints from frustrated unemployed workers who said they couldn’t pass the vetting process, with a California senator slamming it for putting “thousands of legitimate claims in limbo”, Bloomberg reported. .