IRS isn’t checking the performance of its identity proofing vendor

The IRS isn’t doing quality control checks on the vendor-powered digital identity proofing that it requires taxpayers to pass in order to access many online IRS applications. 

Although the tax agency beefed up its privacy protections after its use of the company ID.me and face recognition technology caused concern for members of Congress and advocacy groups in 2022, the IRS isn’t evaluating ID.me’s work or independently verifying performance data, according to a new report from the Government Accountability Office. 

That means that the IRS is “relying on ID.me’s own assessments of its solutions’ performance,” reads the new report, which includes recommendations for IRS.

Millions of taxpayers go through the company’s identity checks annually to get to IRS applications deemed sensitive enough to require identity proofing, like individual online accounts with information like tax records or balances. 

Users logged into IRS apps requiring ...