The Strange Case of the IRS and Facial Recognition

In what looks like a fairly hasty policy revision, the US Inland Revenue Service (IRS) has modified its position that online tax filers in the US would be required to submit a selfie to a third-party identity verification company using facial recognition in order to access their IRS accounts.

The initial change to IRS rules on verifying identity online became apparent during exchanges between an IRS spokesperson and online technology media platform Gizmodo ¹, when it came to light that users with an IRS.gov account would no longer be able to log in with a simple username and password.

Instead, they would need to provide a government identification document, a selfie, and copies of their utility bills to Virginian-based identity verification firm ID.me to confirm their identity.

In a statement to Gizmodo, an IRS spokesperson wrote that users can still receive basic information from the IRS website without logging in, but added they would need to sign in through ID.me to make and view payments, access tax records, view or create payment plans, manage communications preference, or view tax professional authorisations.

To access their IRS.gov account, users would have to create an account with ID.me by uploading either a driving licence, passport, or passport card.

Users are then told to use a smartphone camera or their computer’s webcam to take a selfie. According to ID.me’s website, the company uses a face match facial recognition system to verify the selfie matches the provided government document. If approved in ID.me’s system, users can then use these credentials to verify their identity across any of ID.me’s partners – in this case the US IRS.

For some time, digital rights groups like the Electronic Frontier Foundation have expressed concerns over claims of bias, privacy and security of facematching technology. In its own white paper ², ID.me makes the distinction between ‘face matching’, which scans images against a large population of potential matches (one-to-many) and its own ‘facial recognition’ service that compares the face scan to a single provided government document (one-to-one) resulting in a 98.9% pass rate per user. Further, according to the company, its internal research has shown ‘no detectable bias tied to skin type’.

Formed in 2010, ID.me has become a leader in identity verification among US government agencies. The company gained attention last year when Reuters ³ reported that at least 27 US states across the country were using its service to vet jobless claims applicants during the pandemic. States reportedly introduced the technology to combat an increase in fraud.

Despite ID.me’s reassurances, questions persist about the efficacy (and ethics) of using a private ID verification company to facilitate filing US tax returns using an IRS.gov account – particularly when Login.gov, the US government’s own ID verification portal, might be a viable alternative.

With the level of controversy surrounding ID.me’s appointment, it might not come as too much of a surprise that earlier this month, the IRS announced it will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts.

In a statement, the service wrote: ‘The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season. During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition.’ 

1 - https://gizmodo.com/irs-will-require-facial-recognition-scans-to-access-you-1848387715

2 - https://insights.id.me/wp-content/uploads/2022/01/IDme-Anti-Bias-Whitepaper.pdf

3 - https://www.reuters.com/business/states-using-idme-rival-identity-check-tools-joblessclaims-2021-07-22/