A group of lawmakers has urged the IRS to loosen the identity verification requirements to access the new Direct File system by dropping the mandate for users to register with ID.me, which is far more stringent than many commercial tax prep services.
At the same time, the lawmakers said the service operates at a significant disadvantage compared to commercial tax prep services, namely its stringent identity verification requirements in the form of the ID.me service, which is used by both the federal government and several state governments. Specifically, ID.me credentials are assessed against the National Institute of Standards and Technology's Identity Assurance Level 2 standard. IAL 2 requires remote or physical verification of identity, in which an applicant's face is compared to a government ID, which can be performed using facial recognition software or by a human. Earlier this year, the General Services Administration announced that its Login.gov service will be compliant with existing IAL2 standards in the coming months. The letter noted that private tax preparation companies are not assessed against IAL standards but basically operate at a level 1 basis, as users simply assert their identity.
"While we applaud the IRS' goal of protecting taxpayers from identity theft, it makes no sense to only require heightened identity verification for taxpayers using the free Direct File service, while allowing identity thieves to continue to exploit the comparatively lax security of commercial tax prep services," said the letter.
The letter said there is
"Requiring them to use ID.me is creating yet another needless barrier to exactly these taxpayers who need Direct File most to claim tax benefits, as it has been with other government benefits," said the letter.
The lawmakers also questioned the wisdom of entrusting identity verification to a private company in the first place. The letter said private tax prep companies have abused taxpayer information in the past; Direct File was created partially to ensure taxpayers would not need to give their data to a private company. But requiring the use of ID.me means taxpayers concerned about their privacy are required to hand over personal data to yet another private company.
"The IRS' current approach to security does not make sense," said the letter. "If the threat posed by identity thieves and fraudsters is severe enough to warrant requiring taxpayers to submit to identity verification before submitting their tax returns, then the IRS should require such security protections, across the board, regardless of whether taxpayers use Direct File, commercial services like TurboTax and H&R Block, or print out their tax returns and send them in by mail. Alternatively, if the threat posed by identity thieves is not serious enough for the IRS to require commercial tax prep companies to implement burdensome identity verification, then taxpayers using Direct File should not be required to do so either."
