The IRS just introduced a login ID process – how secure is it?

Vitapix/Getty Images

The Internal Revenue Service (IRS) recently implemented an enhanced identity verification and login process that requires facial identification via a selfie and a photo of an ID document – ​​such as a driver’s license , ID card or passport – according to IRS.gov. Taxpayers will continue to access the IRS portal through IRS.gov but will now log in using their ID.me account.

See: How to login to ID.me to access all IRS online platforms
Find: Tax Filing 2022: How to Set Up ID.me for the IRS

ID.me is a third-party technology provider for the IRS that uses facial recognition to verify identity. The process is simple, fairly quick and secure. ID.me claims not to sell users’ biometric or personal information, financial or otherwise.

In a press release detailed by CNET, ID.me founder Blake Hall said, “Our 1:1 face matching is like taking a selfie to unlock a smartphone.”

What you need to know about ID.me verification

The new process is designed to make it easier and more secure for taxpayers to manage their child tax credit, verify IRS accounts and perform “other routine tasks” related to taxes, the IRS said in a news release.

If you already have an IRS username, you can continue to use those credentials to log into the site until summer 2022, but you will be prompted to create an ID.me account as soon as possible, according to IRS.gov. Those who have already set up an ID.me to access the Child Tax Credit Update Portal can use those credentials to log into any other IRS business, including tax filing. They will not have to re-authenticate their identity.

Discover: Teens & Taxes: Does your teenager have to file a tax return for their part-time job?

IRS Commissioner Chuck Rettig said in the statement, “This new verification process is designed to make IRS online applications as secure as possible for individuals.”

Is the ID.me process safe from hackers?

Security expert Nick Santora, CEO of security awareness training platform Curricula, noted that the process is “absolutely more secure” than the IRS’ old identity verification methods, which largely relied part about a user’s social security number. “It sets a precedent. This is where we need to be to start taking people’s identity security seriously,” Santora told GOBankingRates.

He added that the new process recognizes that a Social Security number is not a good authentication tool. “For the most part, people’s social security numbers are already available from previous third-party data breaches.”

Santora pointed out that hackers can always try to infiltrate the system. But the ID.me process adds so many steps to authentication that it’s designed to make hackers decide such an endeavor isn’t worth it, he explained.

More: Top tips for painless tax preparation

With the new identity authentication process, the danger is not in hackers stealing your identity on other sites and using it to create accounts, but in using engineering tools to get you to provide them with the information they need to access your account. The system can only provide security if people use it correctly.

“A hacker can basically target you after setting up your ID.me account and doing what they do best, which is playing on your sense of urgency,” Santora said. For example, a hacker might contact you by phone or email and say they’re from ID.me – or the IRS – and that you need to reset your password or authenticate your account.

If you follow a fake website link that a hacker might provide and follow the steps they issue, you might give them access to your IRS account. “It’s no different than if you walk into your house and a burglar comes up behind you and guides you to open the door for them. They didn’t need to steal your key or make a copy of it. They just walked through the door with you,” Santora explained.

Learn: how are property taxes calculated?
Explore: Tax Prep: IRS says collecting your documents is the first step

To protect yourself, he advised, “Never use your email as a trampoline to get to a website. Don’t just bounce off the IRS site by clicking on a link. Manually enter the IRS.gov website. The agency uses this secure space to ensure that you arrive at the right place.

He added: “ID.me is a reliable and secure website. But problems might arise if hackers install fake websites that look like ID.me. Their purpose will be to entice you to visit one of these other sites.

Santora stressed that taxpayers should only access the IRS.gov portal through the direct website. Do not click on any email links or visit any websites suggested by phone or email. The IRS will never email you or call you directly asking you to access the site, verify your identity, or reset your password.

More from GOBankingRates

About the Author

Dawn Allcot is a full-time freelance writer and content marketer with interests in finance, e-commerce, technology, and real estate. His long list of publishing credits includes Bankrate, Lending Tree and Chase Bank. She is the founder and owner of GeekTravelGuide.net, a travel, technology and entertainment website. She lives in Long Island, New York, with a veritable menagerie that includes 2 cats, a rambunctious kitten and three lizards of different sizes and personalities – plus her two children and her husband. Find her on Twitter, @DawnAllcot.