The verification process includes taking a picture of a photo ID, like a driver’s license or passport, and then taking a video selfie with a smartphone or computer so software can compare the two. It’s part of a partnership the IRS has with ID.me, a fast-growing company that uses facial recognition software as part of its identity-verification process.
For now, this process is optional if you already have an IRS username and password. But if you don’t, and you want to use online tools to request an online tax transcript or see information regarding your tax payments or economic impact payments, you’ll need to sign up with ID.me. And starting this summer, those old IRS usernames and passwords will no longer work.
“I think any plan that inserts a private intermediary into the system for accessing critical information or obtaining benefits from a government agency warrants a lot of scrutiny,” said John Davisson, director of litigation and senior counsel at the Electronic Privacy Information Center, or EPIC.
In a statement to CNN Business, the IRS pointed out that it’s not necessary to have an online account with the IRS at all. The agency said it “emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company.” (Taxpayers can also, for instance, request a transcript that will come by mail.)
“To help protect the security of taxpayers, the IRS uses an identity verification process for accessing IRS’ self-help tools such as checking your account online and getting a transcript online,” the IRS said in a statement to CNN Business.
The rise of ID.me
As ID.me has spread to more government services, it has also raised concerns from privacy advocates about how facial recognition technology is seeping into everyday life. Those concerns were renewed this week amid mixed messaging from the company about how its service works.
To verify users’ identities, ID.me uses a form of facial-recognition technology known as facial verification, or one-to-one facial recognition — similar to the process of unlocking your smartphone with your face.
A spokesperson for ID.me said the company first uses one-to-one facial recognition for verifying identities of users, and then checks users against an internal database of selfies to look for “prolific attackers and members of organized crime who are stealing multiple identities.” People who are matched with a photo in ID.me’s database — which the spokesperson said totals 0.1% of users — are sent to a video chat for verification.
In response to Hall’s LinkedIn post, digital rights group Fight for the Future called for the IRS to stop the use of facial verification on its website, and for government agencies to end contracts with ID.me.
Herzog, who’s based in the Boston area, already had an IRS online account and said he experienced a nine-day wait to get verified with ID.me in early January, including failed attempts to upload documents, and a long wait for a video call.
“I saw a message that current logins are going to be required to use this new ID.me system beginning this summer,” he said. “So I thought, ‘Okay, I might as well get a head start on this; how long could it take?'”
The ID.me spokesperson said that in the first three weeks of January, a combination of the Omicron variant and snowstorms in Virginia, where the company’s support team is based, cut down its ability to support users. The spokesperson also said that nine out of 10 ID.me users are automatically verified in under five minutes.