What is ID.me?

ID.me is a digital identity verification platform. Users can verify their identity once and then use their ID.me credentials to sign in to a wide range of websites and secure systems. 

ID.me was founded in 2010 and is headquartered in McLean, Virginia. The platform has over 156 million users. ID.me is a private company and is not affiliated with the U.S. government, but it is used by several governmental agencies. ID.me has NIST 800-63-3 IAL2 accreditation and meets federal standards for secure consumer authentication. 

How does ID.me work?

ID.me uses facial recognition and artificial intelligence to verify a user's identity. For the self-service verification, you need to:

1. 1.Create an account and upload images of your government-issued photo ID. This could be a driver’s license, passport, or state ID. ID.me requires clear photos of both the front and back of your ID. 
2. 2.Provide your U.S. phone number and Social Security number. 
3. 3.Take a short selfie video. The selfie video supports both liveness detection (confirming you're a real, live person and not a photo or video) and facial matching against your uploaded ID. ID.me prompts you on how to center your face so it’s fully visible. 

If the self-service verification process fails, you need to complete a live video call with one of ID.me’s Trusted Referees. This usually happens if your ID photos or selfie videos aren’t clear enough. However, you may also need to schedule a live video call if you don’t have a permanent address or a valid U.S. phone number. During the call, the Trusted Referee verifies your photo ID and other valid identity verification documents. 

Once you complete the initial identity verification process, you can set up your ID.me Wallet. This digital wallet automatically verifies your identity with other services that use ID.me, so you don’t need to re-verify or create new login credentials for each service. You can also use your ID.me Wallet to get discounts or cashback from partner retailers. 

What organizations use ID.me?

Three primary types of organizations use ID.me for user verification: 

• Government agencies. Over 60 U.S. state and federal agencies use ID.me to verify user identities. These include the IRS, SSA, and VA. 
• Healthcare organizations. Over 70 healthcare providers across the country use ID.me. Patients need to create an account to access their electronic health records (EHRs) through online portals. 
• Retailers. Popular retailers like Sam’s Club and DollarDays use ID.me to verify customer eligibility for exclusive perks. If you’re a military member, first responder, teacher, nurse, or student, you can use ID.me to claim discounts and cashback offers. 

Is ID.me safe to use?

Yes, ID.me is generally safe to use. The platform has extensive security measures in place to protect your data. However, ID.me accounts are popular targets for cybercriminals because they contain so much valuable data. If your ID.me account is breached, it could put you at risk for identity theft. 

How ID.me protects your data

ID.me has a wide range of security measures in place to protect user data.¹ These include: 

• Encryption. All personally identifiable information is protected with AES 256-bit encryption to help protect it from unauthorized access. 
• Multi-factor authentication (MFA). In addition to your password, MFA requires a second verification factor, such as a one-time code from an authenticator app or a security key. It keeps your account secure even if your password is compromised. 
• NIST IAL2/AAL2 credentials. ID.me meets federal standards for identity proofing. 
• FedRAMP Moderate Authorization. ID.me holds a FedRAMP Moderate Authority to Operate (ATO), meeting federal cloud security standards.
• SOC 2 Type II certification. SOC 2 Type II is a widely recognized audit framework for security controls. ID.me has completed the full independent audit of cybersecurity controls necessary to meet the requirements of this framework. 
• Liveness detection. It helps reduce spoofing attempts, such as deepfakes and static photos during the selfie verification process. Liveness detection is intended to make impersonation and fraudulent verification more difficult. 
• “Do not sell” policy. ID.me has a strong privacy policy, which states that it doesn’t sell user data and requires users to provide consent before ID.me shares their data with partner organizations. 

Is it safe to give ID.me your SSN?

Yes, it’s generally safe to give ID.me your Social Security number. That’s because ID.me complies with federal security and verification standards and encrypts SSNs in storage. 

ID.me requires your SSN to verify your identity. It matches your SSN against official records from federal agencies to prove it’s really you. 

The greater risk is entering your SSN on a fake site that impersonates ID.me. If your SSN is compromised on one of these scam sites, it could lead to identity theft and financial losses. To avoid these scams, you should only access ID.me by typing the URL directly into your address bar or through official websites with a .gov address. Avoid accessing ID.me from an email link, even if it looks legitimate. 

Risks and privacy concerns of using ID.me

ID.me is generally safe to use, and if you need to manage your taxes or collect government benefits online, it may be your only option. Here are some potential risks and data privacy concerns to keep in mind when using ID.me: 

• Extensive data collection. ID.me collects several different pieces of personal information, including your SSN, government ID, and biometric data for facial recognition. This data makes it an attractive target for hackers. As of July 2026, ID.me hasn’t publicly disclosed a major data breach to date, but if one were to happen, it could put users at risk of identity fraud. 
• Facial recognition reliability. ID.me’s liveness detection is generally very effective, but it’s not impenetrable. In 2022, the Washington Post reported that a scammer bypassed restrictions multiple times just by wearing a wig.² 
• Lack of alternatives. On some federal government sites, ID.me is the only way for users to verify their identity. This means they have to use a private third-party platform to access public services. 
• Accessibility barriers. ID.me requires a government-issued ID and a smartphone or computer with a camera to use. These requirements create hurdles for marginalized users and users who aren’t comfortable with technology. 

Past incidents and controversies

ID.me has been at the center of some privacy incidents and controversies. Concerns started in 2022 when The Washington Post reported that a scammer had bypassed the platform’s facial recognition technology using wigs.² This strategy allowed the scammer to access fraudulent employment benefits. 

At the same time, many legitimate users struggled to verify their identity and access their benefits. This happened when the platform’s AI systems failed to accurately identify their faces. ID.me now offers calls with Trusted Referees, providing another pathway to verification. 

During the same year, ID.me’s CEO, Blake Hall, claimed that fraudsters stole up to $400 billion in unemployment benefits during the COVID-19 pandemic.³ The estimate drew controversy, and the investigators of the U.S. House of Representatives later criticized the claim as inadequately supported.⁴ The report also found that ID.me had overstated its identity verification capacity when working with the IRS. 

In 2025, the U.S. Government Accountability Office (GAO) released a report on the IRS’s partnership with ID.me. The report found significant gaps in IRS oversight of the identity verification platform. The IRS was relying on ID.me’s self-reported performance data, without any unbiased analysis or clear performance objectives.⁵

In May 2026, ID.me drew fresh scrutiny after it was reported that the IRS is proposing to allow ID.me to retain taxpayers' biometric data for longer periods, keeping facial scans for as long as an account is active and for 36 months after it's deleted.⁶

While these controversies are concerning, they don’t necessarily indicate that ID.me is unsafe. Consumers need to remember that ID.me is a private company that is not part of the U.S. government and weigh the potential benefits and risks of digital identity verification for themselves. 

ID.me scams to watch out for

While the official ID.me platform is generally safe, ID.me scams have become a popular tactic for cybercriminals. These scammers know people trust ID.me with their sensitive data, which makes it the perfect disguise for phishing scams. 

If you accidentally fall for an ID.me scam, it could lead to identity theft or tax fraud, so it’s important to stay vigilant. Here are some of the most common ID.me scams to watch for:

• Fake “verify your account” emails. Scammers send an email saying that your government benefits are on hold or that you owe a large tax bill. The email links to a lookalike login page that scammers use to steal your ID.me password or SSN. 
• Fake ID.me text messages. Another popular tactic is sending an SMS message with a fake verification code with a malicious link. The scammer might also include a fake “suspicious activity” alert, hoping to trick you into clicking on the link. 
• Fake phone calls. In this scam, the caller claims to be part of the ID.me customer support team. They ask you to share your SSN or a one-time code. The scammer may already have your username and password and is trying to bypass two-factor authentication. 
• Lookalike websites. Scammers create spoofing websites that look like the official ID.me page but have a slightly different URL, hoping that you end up on the fake website by accident or by following links in phishing emails or text messages.
• Fake “verification” calls. A scammer will ask you to have a video call with them or send them a selfie, but it won’t be through the official ID.me site. In some cases, the scammer could use your biometric data to fool facial recognition tools. 
• Account takeover attempts. Scammers could attempt to compromise your ID.me account with credential stuffing attacks or by trying to intercept your multi-factor authentication codes. 

How to spot a fake ID.me message

Think you’ve received a fake ID.me message? Look for these signs that the message is a scam: 

• The email comes from a lookalike domain, such as @idme.com or @idme.net. Real emails will always come from an @id.me address. 

• The message directs you to a site other than id.me. Many scammers create fake sites with a .com or .net URL. 

• The message asks for your password or an MFA code. ID.me will never ask for this information via email or text message, even if you talk directly with their support staff. 

• The message uses urgent language like “act now” or “your benefits are suspended.” Scammers often use these tactics to trick you into sharing sensitive information without thinking it through first. 

• You’ve received a password-reset email without requesting one first. This is usually a sign that someone is attempting to take over your account. 

You can check what the official communication from ID.me looks like in their Help Center article opens in a new tab.

How to stay safe when verifying your identity online

Whether you use ID.me or any other identity management platform, you can take steps to stay safe online. Use these cyber hygiene practices for an extra layer of protection: 

• Make sure you type the exact URL directly into the search bar or start from an official .gov site when visiting ID.me. Don’t click on links in emails or text messages to visit ID.me. 
• Turn on multi-factor authentication for your ID.me account. The platform offers several MFA options, such as an additional authenticator app. 
• Create a strong password with over 16 characters and a mix of letters, numbers, and symbols. 
• Keep your email, phone number, and other contact details updated in your ID.me account so you receive legitimate security alerts when suspicious login attempts are detected. 
• Avoid accessing ID.me over a public Wi-Fi network without additional protection. Use a VPN like NordVPN to add a layer of encryption on public networks, which can sometimes lack security features. 
• Keep your devices and browser up to date. Hackers often use outdated software and hardware to launch their attacks. 

References

1 ID.me. Federal accreditations & security framework. https://www.id.me/security opens in a new tab

2 The Washington Post. (2022, February 11). ID.me gathers lots of data besides face scans, including locations. Scammers still have found a way around it. https://www.washingtonpost.com/technology/2022/02/11/idme-facial-recognition-fraud-scams-irs/ opens in a new tab 

3 ID.me. (2022, January 20). Calculating the Road to Losing $400 Billion Dollars. https://network.id.me/article/calculating-the-road-to-losing-400-billion-dollars/ opens in a new tab 

4 Reuters. (2022, November 17). ID.me's claim on scope of unemployment fraud baseless, U.S. Congress says. https://www.reuters.com/world/us/startup-idmes-claim-scope-unemployment-fraud-was-baseless-us-congress-says-2022-11-17/ opens in a new tab

5 U.S. Government Accountability Office (2025, June 11). Taxpayer Identity Verification: IRS Should Strengthen Oversight of Its Identity-Proofing Program. https://www.gao.gov/products/gao-25-107273 opens in a new tab 

6 Politico. (2026, May 22). IRS proposal would have company preserve biometric data longer. https://www.politico.com/news/2026/05/22/irs-biometric-data-tax-investigation-00909108 opens in a new tab