One door is not a service: the IRS selfie reversal

The week

In November 2021, the Internal Revenue Service said new users of several online services would need to verify their identity through ID.me, a private identity verification provider, with existing users to follow in 2022. The usual process asked users to photograph an identity document and take a selfie for facial comparison, with a video call to an agent as a fallback. In late January 2022, the requirement drew sharp criticism from lawmakers of both parties and from privacy advocates. They objected to the use of facial recognition, the role of a private company in access to tax records, and long waits for people who could not complete the automated steps. Treasury said it was reviewing alternatives. On February 7, the IRS announced it would transition away from using a third-party service for facial recognition when people created new online accounts.

Remote identity proofing asks an agency to do two things at once. It must keep fraudsters out of tax, benefits and unemployment accounts, which were heavily targeted during the pandemic. It must also let in a population that includes people without smartphones or credit histories, people whose names differ across records and people with reasons to distrust government data collection. A tax agency serves almost every adult, so even a small failure rate is a large number of people. Earlier in this series we looked at vendors setting facial recognition policy for police before agencies did. The IRS episode raised a different question: what happens when one proofing method, chosen for good fraud reasons, becomes the only way in. We look at three design decisions: the routes offered, how failure is measured, and who is accountable for the data.

The routes offered

Document-plus-selfie verification is popular because it resists the most common fraud. Someone holding stolen personal data can often answer knowledge-based questions drawn from credit files. Producing a matching face and a valid document is harder. For an agency fighting organized fraud rings, that is a real advantage.

The same method excludes people for reasons unrelated to fraud. It needs a camera, a current photo document and enough comfort with the process to complete it. Older adults, people with disabilities, people whose appearance has changed, and people without a driver’s license or passport fail or abandon at higher rates. Some people simply decline to hand a biometric to a private company to see their own tax records.

NIST’s digital identity guidelines already allowed several ways to reach a given assurance level, including supervised remote proofing and in-person proofing. A sound design offers at least three routes to the same level. One is automated and fast for those who can use it. One uses a live agent on video who checks documents without automated facial matching. One is in person, at an agency office, a partner such as the Postal Service, or a trusted community organization. Each costs more per user than the last, and each closes a different gap. The automated route carries the volume. The others keep the service universal.

Routes must also be reachable. A fallback that requires hours on hold, or an office visit hundreds of miles away, exists on paper only. Capacity for each route should be planned from expected failure rates, with service levels published.

How failure is measured

Proofing vendors and agencies typically report pass rates and fraud caught. Those numbers hide who fails. A high overall pass rate says nothing about whether the failures fall evenly or cluster among older users, rural users or people with particular document types.

The useful measures are failure and abandonment by step and by population group, time to complete each route, and the share of people who finish on a fallback. Agencies can collect most of this without storing sensitive attributes by using aggregate analysis and voluntary surveys. A high failure rate in any group should be treated as a service defect with an owner and a fix date, just as a broken form would be.

Fraud measures need the same honesty. A method that stops fraud in one channel may push fraudsters to the weakest fallback. Tracking fraud attempts by route shows whether the fallback is becoming the attack path and whether its checks need strengthening. Without that data, an agency cannot tell whether removing a strict method made it safer or only more convenient.

Who is accountable for the data

When a private company performs proofing for a public service, the public reasonably asks who holds the images, how long they are kept, what else they may be used for and who answers when something goes wrong. Those questions can be answered in the contract and the privacy notice. They also need to be answered publicly and in plain language before launch, because a privacy notice discovered by journalists after launch reads as concealment.

Contract terms should cover retention limits for images and templates, a ban on secondary use, deletion on request, audit rights, breach notice and data return at contract end. Agencies should also decide whether the provider’s account belongs to the citizen across many services or only to the agency. Reuse is convenient, but it concentrates data and dependency in one company.

There was also a sourcing choice. The federal government ran its own shared service, Login.gov, and the debate in early 2022 included whether agencies should rely on it instead. That choice involves assurance level, cost and operating capacity, and it is a policy decision as much as a procurement one. A shared government service keeps citizen data under public accountability but depends on appropriations and its own operating capacity. A commercial provider can scale quickly but brings the accountability questions above. Either way, the agency should own the decision in writing, with its reasons, rather than inherit it from whichever contract vehicle was available.

With hindsight

Within weeks of its February announcement, the IRS added an option to verify through a live virtual interview without facial comparison, and the provider said users could have their selfies deleted. The IRS continued to use the provider with that alternative in place. In 2023, the GSA inspector general found that GSA had misled agencies about whether Login.gov met the government’s highest remote proofing standard. Login.gov later added an option that met it, using facial matching alongside alternatives. NIST finalized its revised digital identity guidelines, SP 800-63-4, in 2025, with more emphasis on usability, equity and alternatives to biometric methods. By this point in 2026, public agencies are expected to offer more than one route to verified identity. Fewer of them measure who fails each route, which is what tells them whether the routes are working.