ID.me is the IRS's official identity verification tool, and the agency has taken steps to make it find—but like any online system that holds sensitive data, it carries some risk.

The IRS began requiring ID.me verification in 2021 to prevent fraud when you create or access an IRS online account. ID.me uses facial recognition, document scanning, and identity checks to confirm you are who you say you are. The IRS chose ID.me because the agency needed a way to stop criminals from filing false tax returns or claiming refunds in other people's names.

Whether ID.me is "safe" depends on what you mean. ID.me itself has strong encryption and security practices. But no online system is risk-free, and you should understand what data you are sharing, what could go wrong, and what your options are if you do not want to use it.

Key Takeaways

  • ID.me is owned by a private company but is the IRS's official identity verification partner, meaning the IRS requires it to access certain online accounts and services.
  • ID.me encrypts your data in transit and stores facial recognition images separately from your identity documents, but a data breach is always theoretically possible.
  • You can verify your identity in person at a local IRS office or by mail instead of using ID.me, though both routes take longer.
  • ID.me has experienced security incidents in the past, including a 2023 breach affecting some users, which the company disclosed and addressed.
  • The IRS does not store your facial recognition image—ID.me keeps it—but the IRS does receive confirmation that you passed verification.

How ID.me Works and What Data It Collects

When you use ID.me to verify your identity with the IRS, you upload a photo of your government-issued ID (driver's license, passport, or state ID) and take a selfie. ID.me's software compares the two images to confirm they match. The system also checks your identity against databases maintained by credit bureaus and other data sources to confirm your Social Security number, address, and other basic information match public records.

ID.me stores your facial recognition data separately from your identity documents. This separation is intentional—it means that even if someone accessed your driver's license image, they would not automatically have your facial data. The company encrypts data both when it travels to ID.me's servers and when it sits in storage. However, ID.me is a private company, not a government agency, so it operates under its own privacy policy rather than the same rules that bind the IRS.

The IRS receives only a confirmation that you passed verification—not your facial image, not your driver's license photo, and not your Social Security number. ID.me keeps those. This is important because it means the IRS's database does not contain your biometric data, even though ID.me's does.

ID.me's Security Track Record and Past Incidents

ID.me has experienced security problems. In 2023, the company disclosed that some user accounts had been compromised through credential stuffing attacks—a technique where criminals use stolen usernames and passwords from other websites to try to break into accounts elsewhere. ID.me said the breach affected a small percentage of users and that it had added additional security measures in response, including mandatory two-factor authentication.

Before that, in 2021 and 2022, ID.me faced criticism from privacy advocates and lawmakers who questioned whether facial recognition technology should be required for government services at all. Some states, including California and New York, restricted how their own agencies could use ID.me. The company has also faced complaints about false rejections—people whose documents were flagged as fraudulent when they were legitimate, forcing them to verify in person or by mail.

These incidents do not mean ID.me is unsafe in absolute terms. Every major company that handles sensitive data has experienced breaches or security challenges. What matters is how the company responds. ID.me disclosed its 2023 breach publicly, did not hide the scope, and implemented fixes. That transparency is a positive sign, though it does not eliminate the risk that future breaches could occur.

What Happens If ID.me Data Is Breached

If ID.me's systems were breached and your facial recognition data and identity documents were stolen, a criminal could theoretically use that information to impersonate you elsewhere—not necessarily with the IRS, but with other services that accept ID.me verification or that use facial recognition. Your facial data is biometric information, meaning it cannot be changed the way a password can. If it is compromised, you cannot straightforward reset it.

However, the IRS has said it would not hold you responsible for fraudulent activity on your account if the breach originated with ID.me, not with you. If someone uses stolen ID.me data to file a false return in your name, you would report it to the IRS and the agency would investigate. This is the same process that happens when someone commits tax identity theft through any other method.

ID.me maintains cyber liability insurance and has committed to notifying users within 30 days if a breach occurs. These are standard practices but not guarantees.

Your Alternatives to Using ID.me

You do not have to use ID.me to verify your identity with the IRS. You have two other options, both slower but both avoiding the facial recognition requirement.

In-person verification: You can visit a local IRS office with your government-issued ID and proof of address. An IRS employee will verify your identity and create or unlock your online account. Wait times vary by location and season, but you should expect to spend 30 minutes to two hours in the office. You can schedule an appointment through IRS.gov or call 1-800-829-1040.

Mail verification: You can request identity verification by mail. You will send copies of your ID and proof of address to the IRS, and the agency will mail you a PIN that you use to access your account. This process typically takes four to six weeks. The IRS provides instructions on its website under "Verify Your Identity by Mail."

Both alternatives are free and do not require you to share biometric data with a private company. The trade-off is time. If you need access to your IRS account quickly—for instance, to check the status of a refund or to file an amended return—ID.me is faster.

What the IRS Says About ID.me Security

The IRS has stated that it chose ID.me because the company meets federal security standards for handling sensitive data. The IRS does conduct security audits of ID.me's systems and has the authority to require changes if vulnerabilities are found. However, the IRS does not may provide that ID.me will never be breached, and the agency's choice to use ID.me does not mean the IRS endorses it as completely risk-free.

The IRS also notes that using ID.me is optional. The agency offers the service because it is fast and convenient, not because it is the only way to verify your identity. If you are uncomfortable with facial recognition or with sharing your data with a private company, the in-person and mail options are available to you.

How to Reduce Your Risk If You Use ID.me

If you decide to use ID.me, you can take steps to protect yourself. Use a strong, unique password—one you do not use anywhere else. Enable two-factor authentication, which ID.me now requires. Do not share your ID.me login credentials with anyone, and do not use ID.me on a public Wi-Fi network without a VPN.

After you verify your identity and create your IRS account, monitor your account regularly for unauthorized activity. Check your IRS transcript at least once a year to confirm no one has filed a return in your name. You can view your transcript free at IRS.gov under "Get Your Tax Record."

If you notice suspicious activity on your IRS account or if you believe your identity has been compromised, contact the IRS when ready at 1-800-829-1040 or file a report with the Federal Trade Commission at IdentityTheft.gov.

Frequently Asked Questions

Does the IRS store my facial recognition image?

No. ID.me stores your facial recognition data on its own servers. The IRS receives only a confirmation that you passed verification. The IRS does not receive, store, or have access to your facial image or the biometric data ID.me collected.

What should I do if ID.me rejects my identity?

If ID.me says your documents are fraudulent or your identity cannot be verified, you can try again, but repeated failures usually mean you should use the in-person or mail verification option instead. Contact the IRS at 1-800-829-1040 to schedule an in-person appointment or request mail verification.

Is ID.me required to file my taxes?

No. ID.me is required only if you want to create or access an IRS online account (like IRS.gov login). You can file your taxes by mail or through a tax professional without ever using ID.me. You need ID.me only if you want online access to your account, transcripts, or payment history.

Can I use ID.me with other government agencies?

Yes. ID.me is used by several federal and state agencies, including the Social Security Administration, the Department of Veterans Affairs, and some state unemployment offices. Your ID.me account works across these services, but each agency has its own privacy practices and data handling rules.

What happens if someone uses my ID.me data to commit fraud?

If your ID.me credentials are stolen and used to access your IRS account fraudulently, contact the IRS when ready and file a report with the Federal Trade Commission. The IRS will investigate and restore your account. If a false return was filed in your name, the IRS has procedures to resolve it and will not hold you liable for the fraud if it originated with ID.me's breach.