Using a Private Company to Get Your Private IRS Records
This Week's Quote:
“Learning how to be still, to really be still and let life happen--that stillness becomes a radiance.”
-Morgan Freeman
With technology developing more and more every year, it seems like we should have a dozen different ways to access our information. In this article, the WSJ reveals that this isn’t true when it comes to the IRS. The IRS has had problems with its system that verifies whether or not you are who you say you are. Thus, they have turned to a private company, ID.me, that will verify your identity prior to letting you see your tax documents. Their services come cheap it seems, and some fear their private information is the cost.
-Zak Kitzmiller
They’re Your IRS Records. Getting Them Means Giving Up Privacy.
Handing over personal information to a contractor called ID.me is the only practical route most Americans have to access their tax records online. That doesn’t sit right with some people.
Tax Day 2022 has come and gone, but this year’s filing season brought an unpleasant surprise for many Americans that’s still here: People who want online access to their tax records at the Internal Revenue Service have to turn over sensitive personal information to an outside company to get them.
This matters if you don’t like the idea of sharing private data to get online tax records many people need at some point. These records contain summary return information, payment histories and other details that help people fill gaps in their own files. Complete records may be required to apply for loans and deal with tax disputes, among other things.
Over the last decade, the IRS has had severe problems with its own systems that limited access for many taxpayers, so last year it turned to an outside vendor, ID.me, to verify identities. ID.me, which originated to help military families access benefits, is based in McLean, Va. It now provides online ID verification services to 10 federal agencies and 30 states. Its contract with the IRS is for up to $86.8 million.
Now, taxpayers who want to view their IRS records online must submit copies of driver’s licenses, Social Security cards and other documents to ID.me as proof of identity.
ID.me says that due to federal requirements, applicants must also provide a certain type of facial “selfie” or else have an online video interview with a representative for comparison with photo IDs. A spokesman says the average wait time for an interview, which was sometimes more than two hours during filing season, was less than 10 minutes recently.
While many people–including many tax professionals–don’t mind giving personal data to ID.me, others do. Jodi Porter, a software engineer in Omaha, Neb., went through ID.me’s verification on April 18 when she needed her IRS records to research a tax-payment snafu.
“I couldn’t get through to the IRS on the phone, and I had to act quickly. I was extremely uncomfortable sharing my documents with the representative, who didn’t give me her name or ID, just to get my own information from the IRS. Any time you share private information, that puts it at risk,” she says.
The outsourcing hasn’t gone smoothly. In February, a furor arose over ID.me’s then-requirement that applicants provide a selfie as “biometric” data to help prove identity. After members of Congress and privacy specialists protested that biometrics can be faulty and have dangerous consequences, the company made the selfie requirement optional for users who have a video interview. It also said it would delete facial images collected from IRS users.
At the same time, the IRS announced it would work with the General Services Administration to upgrade to a government ID system, Login.gov, to provide alternative verification.
Then in April, Rep. Carolyn Maloney (D., N.Y.), chairwoman of the House Oversight Committee, and Rep. James Clyburn, (D., S.C.) chairman of the House Select Coronavirus Committee, launched an investigation of ID.me’s use of facial recognition. A major focus is whether the company prevented eligible applicants from receiving state unemployment benefits, but the lawmakers are examining contracts with the IRS and other agencies as well.
In late April, a Treasury official said, “Both Treasury and the IRS are committed to transitioning away from ID.me as soon as possible.”
Blake Hall, the CEO and co-founder of ID.me, disagrees strongly with many criticisms of the company: “ID.me isn’t perfect, but we have dramatically expanded access to government services, especially for the unbanked and underserved.”
He adds that ID.me has nearly doubled the success rate of applicants for IRS verification, from about 40% under the IRS legacy system to about 75%, and that five states have credited the company with helping prevent $238 billion in fraud.
Whatever happens next, ID.me is the only practical route most taxpayers now have to their IRS records, and there is no perfect way to balance access and security. While it’s possible to get IRS records by mail, it’s much slower. For details, see IRS.gov/individuals/get-transcript.
Here’s more information about ID.me and the verification process.
Why is it controversial to use facial recognition and other biometric data to verify identity?
Opponents of facial recognition cite studies saying its accuracy can vary by age and demographic group, while supporters say these claims are outdated.
Privacy specialists add that it’s hard to fix problems with biometrics. “A stolen credit card or drivers’ license has a process for correction, but currently there’s no way for a person to deal with stolen, altered or faulty biometric data,” says India McKinney, director of federal affairs at the Electronic Frontier Foundation, a nonprofit specializing in digital privacy issues.
What happens to the personal information I provide ID.me?
The company says that for IRS users verifying with ID.me the first time, it automatically deletes any selfie or related biometric information within 24 hours.
It retains other personal information used to prove identity while the account is open and for up to three years after it’s closed. This is to comply with federal regulations under the National Institute of Standards and Technology, or NIST.
I’m worried that ID.me could be hacked and my records stolen.
No company or government is immune to hacking, and U.S. government agencies have suffered data breaches. ID.me says it meets rigorous federal standards for securing sensitive data.
These standards are set by the General Services Administration, National Archives and Records Administration, and NIST. Compliance is monitored by an independent group, the Kantara Initiative.
If my identity is verified by ID.me, will the company have access to my IRS records?
No.
If I go through ID.me to access my IRS account, will the company try to sell me products or services?
No. If someone is using ID.me to be verified for a state or federal agency, the company will not use any personal information for marketing or promotion. Users who want to receive marketing notices later must opt into them.
Does ID.me earn money from my data?
According to both the company and a Treasury official, the terms of the IRS contract explicitly bar the company from using taxpayer data in ways that exploit, market, or profit from it.
Credit goes to Laura Saunders. Published April 29, 2022 on Wall Street Journal
Thank you for all of your questions, comments and suggestions for future topics. As always, they are much appreciated. We also welcome and appreciate anyone who wishes to write a Tax Tip of the Week for our consideration. We may be reached in our Dayton office at 937-436-3133 or in our Xenia office at 937-372-3504. Or, visit our website.
This Week’s Author, Zak Kitzmiller
