Is ID.me safe? – Everything you need to know

ID.me is an online, free platform designed for identity verification founded in 2010. It has grown to over 100 million members. Based in McLean, Virginia, the company is recognized by the U.S. National Institute of Standards and Technology, and various state and federal agencies use the app to confirm user identities securely.

In this article, we’ll examine how ID.me protects user data and the measures it takes to ensure secure online interactions. We’ll also investigate potential concerns, including privacy risks and reliability issues. This guide will help you decide if ID.me is the right choice for your identity verification needs by outlining the advantages and disadvantages.

How does ID.me work?

ID.me streamlines online identity verification with a secure and straightforward process. You can start by creating an account and providing personal details like name, address, and date of birth. To confirm your identity, you have to upload documents such as a driver’s license or passport and may also take a selfie. Facial recognition software matches the selfie with the uploaded ID for added accuracy.

Once verified, you can access a single ID.me account across various organizations. This eliminates the need for repeated identity checks, saving time and effort. Many organizations, including federal agencies, rely on ID.me for its compliance with strict security standards. Integrating ID.me enhances security, prevents fraud, and offers a smoother user experience.

ID.me’s system has been adopted by groups like the IRS and the Department of Veterans Affairs to authenticate users. However, some agencies, including the IRS, are exploring alternatives as concerns about reliability and privacy arise. Despite this, ID.me plays a significant role in online identity verification, offering a convenient way to prove identity across platforms.

Here are the exact steps for creating an ID.me account:

1. Sign Up: Visit ID.me, click “Get Started“, and create an account with your email and password.
2. Provide Details: Enter your personal information, including name, address, date of birth, and Social Security Number (or ITIN). Upload your government-issued ID.
3. Take a Selfie: Follow the prompt to take a clear, live selfie that matches your ID.
4. Submit: Review your information for accuracy, then click “Submit” to finish the verification.

What are the advantages of verifying your identity with ID.me?

ID.me provides several advantages, making it a useful option for verifying identities online. Its smooth process, ability to work across platforms, and use of multi-factor authentication ensure a safe and reliable way to confirm identities.

1. Easy online identity verification

ID.me makes online identity verification quick and easy for government, healthcare, finance, and retail industries. It speeds up the process by remotely verifying identity in minutes, reducing time and the need for face-to-face verification.

Using a mix of physical identification, mobile network data, fraud detection, and compliance checks, ID.me ensures that each identity is accurate and legitimate. This efficient method makes proving one’s identity straightforward, improving the user experience and removing unnecessary obstacles.

2. Enhanced security with multi-factor authentication

ID.me boosts security with multi-factor authentication (MFA). Users can choose from various verification methods, like uploading a driver’s license or passport or providing their Social Security Number with matching data. This extra step ensures that only the right people can access accounts.

By adding MFA to its platform, ID.me reduces the risk of unauthorized access. This added protection, with easy identity verification and login features, makes ID.me a reliable choice for organizations. It helps businesses comply with regulations while protecting users’ information.

3. Single Sign-On

ID.me simplifies access with its cross-platform login feature. After verifying your identity, you can use your ID.me credentials to log in to any organization that supports the platform. You don’t need to verify your identity again when accessing different services.

ID.me streamlines the user experience. It reduces the hassle of remembering multiple passwords and makes it easier for users to access a wide range of services with a single login.

What are the disadvantages of using ID.me?

Using ID.me to confirm your legal identity could expose you to privacy and security risks. Since the platform collects sensitive personal information, such as government-issued IDs and Social Security Numbers, there is always a chance that this data could be compromised. Here are a few disadvantages of ID.me:

1. A prime target for hackers

ID.me collects and retains a significant amount of personal information to operate effectively. This includes Social Security numbers, government ID scans, and biometric data. The vast amount of sensitive data stored by ID.me makes it an attractive target for cybercriminals. Large volumes of personal information could be exposed if a data breach occurs, potentially leading to identity theft or phishing scams.

On the plus side, ID.me meets the federal identity, privacy, and security standards for digital identity verification — including Identity Assurance Level (IAL) 2 and Authenticator Assurance Level (AAL) 2, as set by the National Institute of Standards and Technology (NIST). It’s compliant with security frameworks like ISO27001, FedRAMP, Kantara, and SOC2 Trust Services Criteria.

2. Dependence on a third-party provider

Relying on a private company to access essential government services raises potential user concerns. While it may help streamline operations for agencies like Social Security, it puts individuals at risk if the company doesn’t prioritize security to the same degree as government organizations. Private companies are not always held to the same accountability standards, which can lead to vulnerabilities in data protection.

Another issue is that some private companies may sell or share user data with advertisers and data brokers. This introduces a level of privacy risk that would be less likely if government entities handled the identification process directly. Keeping such sensitive tasks within the public sector could ensure citizens’ data is safeguarded more effectively.

To its credit, ID.me says it never sells user data.

3. Inconsistent facial recognition technology

Facial recognition software is not always dependable, which can create serious challenges. While a glitch might be minor when unlocking your phone, it becomes a more significant issue if it blocks access to essential services like unemployment benefits.

Research shows that these systems often struggle to recognize people of color accurately. This inconsistency can unfairly impact minority communities, making it harder for them to access vital resources.

An ID.me spokesperson told Comparitech in an email, “ID.me utilizes a facial verification provider for 1:1 matching that is tested by the federal government and shown to be 99% effective against all tested demographics. ID.me’s use of facial verification should not be confused with surveillance use cases. Using algorithms tested by NIST and the Department of Homeland Security for the use case of identity verification have shown consistent results across demographics. ”

ID.me’s Privacy Policy

Before signing up for ID.me on your computer or phone, take a moment to review its privacy policy. The policy covers various topics, including platform use by minors and how ID.me handles your data.

Key points of the ID.me Privacy Policy:

• ID.me collects personal and non-personal information when you use its services.
• It gathers data from emails and other direct communications with the platform.
• ID.me shares some information with government agencies to provide services.
• The platform does not allow minors under 18 and avoids collecting their data.
• It uses biometric data like facial features for identity verification but does not sell or trade this information.

The thorough policy offers clear guidelines on how ID.me manages user data.

Past incidents associated with ID.me

Like any online platform, ID.me has faced security challenges over the years. In 2022, some users expressed frustration with ID.me’s verification process, citing issues like failed facial recognition. ID.me stated that facial recognition is optional and offers live video chat verification as an alternative. Allegations also surfaced about inappropriate comments from its fraud team on WhatsApp.

ID.me allows users to delete accounts and personal data through its website, emphasizing its robust security policies. Still, reading and understanding ID.me’s data policies is essential to decide if you’re comfortable with its practices.

How to stay safe while using ID.me

When using an online identity platform like ID.me, adopting smart habits can help safeguard your personal information. Here are a few recommendations:

1. Regain control with identity recovery services

Identity recovery services offer critical support when your personal or financial information gets compromised. Trained experts, such as case managers, guide you through the recovery process to secure your accounts and data. They assist with tasks like freezing your credit, disputing fraudulent charges, and filing necessary reports.

2. Browse safely with a VPN

A Virtual Private Network (VPN) shields your online activity from prying eyes. It encrypts your internet connection and assigns your device an anonymous IP address, ensuring greater privacy and security. You can avoid trackers, hackers, and malicious actors with a VPN.

3. Always use antivirus software

Antivirus software is essential for defending against malware and cyber threats. Installing a trusted program scans your system for risks and keeps your devices safe. Regularly check for updates to ensure the software stays effective against new threats. Without updates, it can’t defend against the latest malware.

FAQs about ID.me verification

Got questions about ID.me? This FAQ guide covers everything you need to know!