IRS begins requiring new ID system for accessing online accounts

The Internal Revenue Service has implemented a new verification process for taxpayers who want to access their online tax accounts and self-help tools that includes taking a selfie and submitting a photo of their driver’s license or passport to a third-party service, ID.me.

The IRS announced the new authentication procedure last November after a series of high-profile data breaches in recent years on some of its online tools like Get Transcript (see story). The new procedures are garnering fresh attention this week after a report on the cybersecurity blog Krebs on Security and as more of the IRS rolls out the new authentication process across more of its online apps as the start of tax season approaches next Monday.

The IRS is emphasizing that selfies won’t be needed to file and pay taxes online, only for accessing its online accounts and self-help tools.

Andrew Harrer/Bloomberg

“There have been some wildly inaccurate statements regarding the use of selfies relating to paying and filing taxes,” said a statement forwarded by IRS spokesperson Bruce Friedland. “The IRS emphasizes taxpayers can pay or file their taxes without submitting a selfie or other information to a third-party identity verification company. Tax payments can be made from a bank account, by credit card or by other means without the use of facial recognition technology or registering for an account. To help protect the security of taxpayers, the IRS uses an identity verification process for accessing IRS’ self-help tools such as checking your account online and getting a transcript online.”

Other apps that will require the beefed-up authentication include the Child Tax Credit Update Portal, Get an Identity Protection PIN (IP PIN) and Online Payment Agreement. The IRS said in November it has also integrated this new account-creation process into some applications used by tax professionals, including those used to request powers of attorney or tax information authorizations online using Tax Pro Account or to submit Forms 2848 and 8821 online.

The new procedures come after the IRS has been hit by cyberattacks in recent years. In 2015, the IRS needed to remove its Get Transcript app in the middle of tax season after finding that identity thieves had used it to get access to the transcripts of hundreds of tax returns. It relaunched the app in 2016 with improved authentication procedures (see story). Similar problems were found with the IP PIN app and others where the IRS needed to improve authentication (see story).

ID.me has grown into a default identity verification system for other federal government programs and in 27 states after being in business for only 12 years, according to CBS News. The tech site Gizmodo reported that the service requires users to share not only a selfie and government verification document like a driver’s license or passport, but also their Social Security number and allow access to their biometric data like voiceprints and their credit profile.

“We utilize the video selfie and 1:1 Face Match to verify a person is who they say they are on government issued documents,” said ID.me CEO Blake Hall in a statement emailed to Accounting Today. “This is very similar to the process that many use regularly to unlock their smartphone.”