Online tax filers will soon be required to submit a selfie to a third-party identity verification company using facial recognition tech in order to file their taxes or make IRS payments online.
Starting this summer, users with an IRS.gov account will no longer be able to log in with a simple username and password. Instead, they will need to provide a government identification document, a selfie, and copies of their bills to Virginian-based identity verification firm ID.me to confirm their identity. That change, first noticed by Krebs on Security, marks a major shift for the IRS which previously allowed users to file their taxes without submitting personal biometric data.
In a statement to Gizmodo, an IRS spokesperson said users can still receive basic information from the IRS website without logging in, but added they would need to sign in through ID.me to make and view payments, access tax records, view or create payment plans, manage communications preference, or view tax professional authorizations.
So here’s how filing taxes will work for most people later this year. Users attempting to log in to their accounts using ID.me will have to create an account with the company by uploading either a driver’s licence, passport, or passport card. Users are then told to use a mobile phone camera or their computer’s webcam to take a selfie. According to ID.me’s website, the company uses a face match facial recognition system to verify the selfie matches the provided government document. If approved in ID.me’s system, users can then use these credentials to verify their identity across any of ID.me’s partners.
If ID.me’s system fails to verify a selfie or flags other issues that could be considered fraud, the user may then join a recorded video call with an ID.me representative called a “Trusted Referee.” ID.me claims it has verified more than 2.8 million people through these referees and has begun implementing some in-person identity verification options across the country.
“ID.me offers multiple relief valves or escape hatches to ensure there is always a path forward for everyone,” the company said. “We are committed to a policy of ‘No identity left behind.’”
Though that may be the case in many situations, it’s unclear if IRS filers have any equivalent escape hatch. When asked whether there were alternative options for filers who lack access to adequate technology or who are unwilling to submit their personal biometrics, an IRS spokesperson directed Gizmodo to a site providing details on how to request physical transcripts by mail. Neither the IRS nor ID.me could provide any specific example of how to access tax documents online without providing a face scan.
At least as of this writing, ID.me’s verification process does not work perfectly either. One member of Gizmodo’s staff was unable to verify their image due the quality of their webcam. Unable to resolve the issue, that person opted to ditch the digital system entirely and file their payment by mail.
I went through the first stages of completing an ID.me application to see what it was like. The process required me to submit a photocopy of my driver’s licence as well as a face scan using my phone’s front camera. ID.me then required I submit my social security number and it requested permission to see information in my credit profile. Feeling sufficiently creeped out, I stopped short at that final stage but had I continued I would have given up a treasure trove of personal identifying information including government documents, credit history, and detailed biometric data.
In a white paper shared with Gizmodo by ID.me, the company was quick to draw a distinction between its face match system and lesser facial recognition verification systems.
“Face match is equivalent to an airport agent comparing your face to the photo on your government ID card,” ID.me said. “Facial recognition is equivalent to giving your picture to the same agent, putting him on stage at a rock concert, and asking him to pick your face out of the crowd.”
The key difference here is that, unlike some algorithms, like those used by Clearview AI, which scans images against a wide trove of potential matches, ID.me’s service compares the face scan to a single provided government document. Despite the distinction, digital rights groups like the Electronic Frontier Foundation have nonetheless expressed serious concerns over the use of face-matching technology. Speaking to the widely known issue of racial bias in facial recognition algorithms, ID.me claimed its internal research had shown “no detectable bias tied to skin type.” According to the company, the face-match step has a 98.9% pass rate per user.
ID.me assures users signing up for an account that it doesn’t trade, sell, or lease data to any third parties, though it does share some data with “select partners.” Prior to submitting one’s government documents, users are required to accept ID.me’s biometric consent policy. The company’s policy says it collects both facial biometrics and voiceprints. In addition to using these biometric identifiers to verify a user’s identity and protect against fraudulent behaviour, the company’s policies state they may also be used to “comply with a request from law enforcement or government entities where not prohibited by law.” If a user does decide to cancel their relationship with ID.me, the company may retain that data for up to seven and a half years.
The IRS formally announced ID.me had become a “trusted technology provider” last November, but the company itself has been around for over a decade. Formed in 2010 ID.me has become a leader in identity verification, particularly among government agencies. The company gained attention last year when Reuters reported that at least 27 U.S. states spread out across the country were using its service to vet jobless claims applicants during the pandemic. States reportedly introduced the technology to combat a supposed increase in fraud. However, in some cases, filers said the additional layer of verification was creating a layer of hassle in accessing benefits particularly among those less accustomed to modern technology.
In New York, News10NBC detailed numerous accounts of residents struggling to navigate through the verifications system, including one woman who claimed she had waited 19 weeks for her unemployment benefits.
“Every week I call and I’m getting nowhere, it’s about $US3,000 ($4,165), it’s only $US168 ($233) a week but that $US168 ($233) a week covers groceries, medical, and gas you know,” the woman told News10. “I’m at a loss here, I try to call to talk to somebody and ask what am I doing wrong here and I can’t get through to a real person.”
While these individual cases are anecdotal, they offer a potential warning sign for what may happen when all online U.S. tax fillers are required to use biometric-based verification systems to complete a practice both fundamental and required of them by law.