Is ID.me safe? Security and privacy considerations

You may have encountered ID.me if you’ve tried logging into your IRS account or accessing your online healthcare portal in recent years. It employs modern cybersecurity measures, but that doesn’t mean it’s risk-free. In fact, concerns about the privacy of user data have stirred up controversy.

Bipartisan lawmakers have criticized the platform, prompting the IRS to announce in 2022 that it would move away from it and switch to a government-run alternative. However, as of this writing in 2025, the IRS still relies on ID.me for identity verification.

Due to the recent backlash and a resulting House investigation into its practices, it’s understandable if you’re reluctant to enter your sensitive data into the ID.me platform. However, to access some government services online, you may not have an alternative.

In this article, we’ll walk you through what ID.me is, how it works, its security features, and the potential risks it may pose.

What is ID.me?

ID.me is an online identity management tool that allows users to verify their identity online using facial recognition software. Although it’s a private company, ID.me has been approved as a National Institute of Standards and Technology (NIST) service provider, and several government agencies use it to verify users remotely.

How does ID.me work?

ID.me works by analyzing your personal information and documents, then matching them to official records to verify your identity. It uses facial recognition and biometric technology to confirm that you are the person accessing your account.

To use ID.me, you’ll upload a photo ID, such as a U.S. driver’s license or passport, and enter your Social Security number (SSN) and phone number. ID.me then verifies that your information matches official records held by government agencies or financial institutions. It also scans the images using machine vision technology to confirm your documents are authentic, and uses AI to make sure they haven’t been altered in any way.

Next, you’ll take a short selfie video, and ID.me will verify that your facial features match your photo ID. The platform also uses “liveness detection” to confirm you’re a real, live person, not a static image or deepfake. If ID.me cannot verify your identity through automated means, you’ll be prompted to complete a live video call with a trained agent.

Once you complete the verification process, you can store your verified identity in your ID.me Wallet, a secure digital wallet that lets you access services requiring identity verification.

What organizations use ID.me?

According to ID.me, over 60 federal and state government agencies and more than 70 healthcare organizations use the platform for user verification. Certain retailers also use it to verify eligibility for special discounts.

Here’s a breakdown of the types of organizations using ID.me and what they use it for:

• Government agencies: The IRS, Department of Veterans Affairs, and the Social Security Administration are among the agencies that use ID.me to help users securely log in and access government services online.
• Healthcare organizations: Many healthcare providers use ID.me to grant patients access to electronic health records and log into online portals.
• Retailers: Stores like Sam’s Club and DollarDays use ID.me to verify eligibility for exclusive discounts for military members, nurses, teachers, and other qualifying groups.

How secure is ID.me?

ID.me has federal accreditations and employs robust security measures like encryption and multi-factor authentication to help keep your account and digital wallet safe.

Here’s a closer look at how ID.me aims to protect your personal information:

• Advanced encryption: The platform encrypts all personally identifiable information (PII) with an Advanced Encryption Standard (AES) algorithm.
• Federal accreditations: ID.me is accredited by the U.S. General Services Administration (GSA) and its identity proofing solution complies with the National Institute of Standards and Technology (NIST). Additionally, the company meets the security requirements of the Federal Risk and Authorization Management Program (FedRAMP), and the platform has several other recognized certifications that ensure it complies with federal standards for data privacy and information security.
• Technical and policy controls: ID.me complies with the federal government’s rigorous technical and policy controls to help keep user data secure. These layers of protection include firewalls, strict access controls, encryption, and multi-factor authentication.
• Security team: ID.me boasts an experienced security team with industry-recognized privacy and security management certifications.
• Privacy-first model: According to ID.me’s Privacy Policy, they will never share your information with anyone without your consent, and will never sell your data to third parties or advertisers.

Potential risks and downsides of using ID.me

While ID.me offers a convenient way to verify your identity online, it may also raise privacy, security, and accessibility concerns.

These issues have gained increased attention in recent years. Lawmakers and the public have voiced concerns about how use of ID.me may affect people’s ability to file taxes securely. In 2025, a Government Accountability Office report revealed gaps in the IRS’s oversight of ID.me.

Here’s a closer look at some of the risks and downsides associated with ID.me:

• Extensive data collection: ID.me is a third-party vendor that gathers a large amount of sensitive personal data, including SSNs, government-issued IDs, and biometric information, which can pose a risk of exposure or misuse.
• Data breach risk: Although ID.me has not reported any major data breaches, the volume of sensitive information it stores could make it a valuable target for hackers looking to steal identities or commit fraud.
• Inaccurate facial recognition: The reliability of ID.me’s facial recognition software has been called into question, particularly after a scammer bypassed the system multiple times by wearing a wig.
• Accessibility barriers: ID.me requires users to have a government-issued photo ID and a smartphone or webcam. When it’s the only way to access a service online, this can create hurdles for people in marginalized communities trying to file taxes or apply for benefits.
• Racial bias in facial recognition: While not unique to ID.me, facial recognition software has been shown to be less accurate on individuals with darker skin tones, which could disproportionately affect people of color.
• Lack of alternative ID verification options: As of mid-2025, ID.me remains the only option for identity verification on several government platforms, including sensitive IRS applications. The absence of a government option like login.gov limits user choice and can raise concerns about fairness, especially for those uncomfortable with using a private vendor.
• ID.me scams: ID.me itself warns that cybercriminals may use phishing attacks to trick you into verifying your identity on a fake ID.me account they control or to steal access to your real account. These attacks often start as IRS scams or tech support scams.

Tips for using ID.me safely

When using any online platform that deals with sensitive information, it’s important to follow a set of best practices to help protect your personal data.

Here are some tips to help secure your ID.me account and prevent unauthorized access:

• Choose a strong password: Although ID.me only requires eight characters, create a secure password that’s unique and at least 15 characters long.
• Enable two-factor authentication (2FA): Turn on 2FA to add an extra layer of protection. With 2FA, you’ll be asked to confirm your identity using a one-time code sent via SMS or an authenticator app whenever you log in.
• Update your software regularly: Install software updates on your devices and operating system. Patches often fix security flaws that attackers could exploit while you’re using services like ID.me.
• Use a secure internet connection: Never sign up for or access your ID.me account over public Wi-Fi without protection. If you must use public Wi-Fi, use a VPN to encrypt your data.
• Be on the lookout for phishing: Phishing scams are all too common, so always make sure you’re on the legitimate ID.me site: https://www.id.me. Be cautious of lookalike URLs and note that ID.me domains never end in “.com.” Be suspicious of unanticipated messages claiming to be from id.me.
• Keep your contact details current: Ensure your phone number and email address are always up to date in your ID.me account. This helps you receive timely security alerts, login notifications, and account recovery information if needed.
• Consider identity theft protection: Even with strong security practices, breaches can happen. Identity theft protection services can help monitor your information online and guide you through recovery if your identity is compromised.

Help protect your identity and secure your data

Protecting your personal data should be a top priority whenever you enter sensitive information online. With increasing threats from phishing scams that could lead to identity theft, it’s essential to take proactive steps to protect your data.

Install Norton 360 Deluxe to help guard against these threats. Norton’s comprehensive security suite includes AI-powered scam detection, a VPN to secure your connection on public Wi-Fi, malware protection, and timely alerts if we find your sensitive information exposed on the dark web.

FAQs

Is ID.me a government site?

No, ID.me isn’t a government website. It’s a private identity verification company that many government agencies and other organizations use.

Is it safe to give ID.me my SSN?

According to the Social Security Administration, ID.me complies with federal security standards for online identity verification and authentication. Of course, sharing sensitive information on any platform always carries some level of risk.

Is ID.me a scam?

No, ID.me is not a scam. It’s a legitimate identity verification company used by many government agencies and other organizations. However, scammers may impersonate ID.me through phishing attacks to try to steal your personal information or access your account, so it’s important to stay alert.

Why is ID.me controversial?

ID.me has drawn controversy for several reasons, particularly because it’s the sole identity verification method for accessing certain government services, including those offered by the IRS.

A recent government audit found that the IRS isn’t conducting sufficient independent oversight of ID.me’s performance or AI use. Instead, the agency relies on ID.me’s self-reported data without clear performance objectives, raising concerns about transparency, accountability, and effectiveness.