The IRS will soon require taxpayers to use facial recognition to access their online accounts. Users will need to submit a combination of documents and even a video selfie to ID.me, a third-party company, to verify their identity.
Information security blog Krebs on Security drew attention to the plan last week.
The additional verification will not be required to file taxes or submit a payment, the IRS clarified in a statement, as reported by CNBC. But, taxpayers will need to use the service to see payment history, set up a payment plan, and access the Child Tax Credit Portal starting in summer 2022. Additional services will also transition to use ID.me “over the next year,” the agency said in a November 2021 press release, which announced the move.
To access an online account once the changes take effect, users will have to create a profile with ID.me and upload a photo of an ID, such as a driver’s license or passport. They can then use a mobile device or webcam to record a video selfie, which the ID.me system uses to verify the user’s identity. If verification fails, users will be prompted to join a recorded video call with an ID.me agent for manual verification.
The process might be a barrier even for the tech-savvy, as Brian Krebs, who runs the Krebs on Security blog, found. In his post about the ID.me system, Krebs details having to re-enter his personal information several times before being asked to join a video call and was told the wait time was over three hours to do so.
The IRS is not the first government agency to use ID.me. Some states, like Colorado and New York, started using the service to identify recipients of unemployment benefits in 2021. Some applicants reportedly experienced months-long delays due to access issues.
Government agencies are trying to tighten up security in unemployment and tax filings, hoping to slow an increase in fraud. But privacy advocates are concerned that the IRS is forcing citizens to hand over personal data to a private company. “This announcement signals one of the largest expansions of facial recognition technology in the U.S. and there is no question that it will harm peoples’ privacy,” Caitlin Seeley George, campaign director at advocacy nonprofit Fight For the Future, told Axios.
But ID.me argues their software is different from facial recognition programs that sift through millions of photos to match an image. In a public white paper, the company calls their program “face match,” explaining that it’s more like the system your phone uses to verify your face than facial recognition technology that can pick out a single face in a crowd. These programs, like the one used by Clearview AI, are also sometimes used by government agencies, and have drawn criticism from privacy experts.
According to ID.me’s website, they don’t sell or trade biometric data. But they do share it with some “trusted entities,” and if you cancel your account, the company can keep your information for an additional seven and a half years.
