ID.me misled IRS on processing times for identity verification, congressional investigators found

Wait times to receive identity verification were more than double than what ID.me initially represented to the IRS.

The House Oversight Committee released its investigation into identity verification company ID.me on Thursday, concluding that the company “inaccurately overstated its capacity to conduct identity verification services to the Internal Revenue Service.”

Among the report’s findings include that ID.me mislead the IRS in an April 2021 meeting over its wait times to authenticate taxpayers, stating that they were only “about 2 hours as of today.”

In fact, ID.me data from that month shared with investigators showed that average wait times were more than four hours for 14 of the 21 state unemployment services using ID.me. Following the April meeting, the IRS started using ID.me for the implementation of the enhanced Child Tax Credit and then for IRS.

ID.me’s success skyrocketed as state governments struggled with an increased demand for remote verification of unemployment claims during the pandemic and how to prevent significant fraud. House investigators say that ID.me was unable to substantiate CEO Blake Hall’s assertions in June 2021 that Americans had lost more than $400 billion to fraudulent claims during the pandemic — an amount more than 10 times higher than Department of Labor estimates.

The IRS said it would “transition away from” using third-party facial recognition software services after its partnership with ID.me drew scrutiny. ID.me has faced backlash from lawmakers for misleading the public, the federal government and state governments over how it deployed facial recognition technology, as CyberScoop previously reported.

“The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised,” IRS Commissioner Chuck Rettig said in a statement at the time. “Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition.”

The IRS as well as agencies including Veterans Affairs still use ID.me technology.

“It is deeply disappointing that a company that received tens of millions in taxpayer dollars to help Americans obtain these benefits may have hurt their ability to access that critical relief,” Rep. James E. Clyburn, D-S.C., chair of the select subcommittee on the coronavirus crisis, said in a statement. “Companies entrusted with implementing critical programs in a national crisis must be able to serve the needs of the people those programs are intended to benefit.”

In a statement from chief communications officer Terry Neal, ID.me disputed criticism of its assessment of pandemic unemployment fraud levels, calling the criticism “premature.” The company has since staffed up to deal with issues regarding wait times, said Neal.

“We worked tirelessly to serve Americans who needed aid, and we regret the long wait times
that individuals endured while we fought to clear fraud out of the system,” said Neal. “This situation was short-lived and temporary and caused by historic fraud.”

Corrected Nov. 22, 2022: This article has been corrected to reflect that the IRS continues to use ID.me.

A year after outcry, IRS still doesn’t offer taxpayers alternative to ID.me

The agency sparked controversy over its decision to deploy facial recognition technology from the company to vet taxpayers' identity.

Agencies don’t know what sensitive data new IT systems collect on Americans, GAO report finds

Senators ask FTC to investigate ID.me for deceptive business practices

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure