ID.me is a legitimate identity-verification service used by the IRS, Social Security Administration, Veterans Affairs, and many major businesses. It’s safe to use and now offers less-invasive verification options than before, though data breaches are always a possibility. If you’re hesitant about giving ID.me sensitive personal information, keep reading. I’ll explain how this service works, discuss past controversies, and reveal how to protect your privacy when using ID.me.
Is ID.me safe to use?
Yes, ID.me is safe. It encrypts all personally identifiable data, and its information security program is based on the NIST Risk Management Framework. Further, ID.me meets standards set out by AICPA SOC2 and ISO 27001, even though this isn’t a legal requirement. These are widely-respected frameworks governing who can access data and how it’s protected, so ID.me certainly seems to care about keeping your information safe.
The problem is that no system is completely impenetrable. ID.me currently holds sensitive information about more than 70 million Americans. If there was a data breach, criminals could potentially access social security numbers, home addresses, copies of photographic ID, contact information, and more. That would be devastating, and made worse by the fact that many victims had no choice since ID.me verification may be required to access some federal benefits.
How to protect yourself when using ID.me
Because we’re dealing with personal information, it pays to be extra cautious. Follow these steps to limit data exposure and protect yourself as much as possible when signing up to ID.me:
- Verify you’re on the real ID.me website. Scammers may send you text messages or phishing emails to trick you into logging into a spoofed site. Never click any links in a message from someone claiming to be ID.me. Instead, type the address in manually.
- Set up multi-factor authentication. This service offers six different multi-factor authentication options so you can verify that it’s really you logging in.
- Use a unique password. You should never reuse a password, but especially not on platforms that have access to your sensitive personal info. Choose a lengthy, complex password or create one automatically using Comparitech’s strong password generator.
- Don’t use the selfie feature. Verifying via facial scans might be quicker but there’s no telling how that data is processed or who it’s shared with. It’s better to schedule an appointment with a real person than risk having biometric data leaked.
- Keep an eye out for suspicious activity. You can view recent logins by signing in, clicking the person icon, and hitting My Wallet. From there, select View All Activities. If you see anything unusual, report it and immediately change your password.
How does ID.me work?
ID.me gives you two ways to verify your identity. Users can either upload photos of their ID and a video selfie or schedule a video call with an agent. The exact documents you’ll have to provide differ based on your specific scenario. For instance, if you’re trying to access gambling sites, you’ll be asked for photographic ID and likely proof of your address. To claim a veteran’s discount, however, you’ll have to prove that you were actually in the military.
Once verified, you can use your ID.me account to prove your identity on hundreds of different websites. This lets you take advantage of employee discounts, prove eligibility for state benefits, and file taxes without having to constantly verify you are who you claim to be.
How private is ID.me?
We’ve seen that ID.me prioritizes data security, but how privacy-conscious is it? As expected from an organization that exists to verify your identity, it stores quite a lot of sensitive information. However, it also shares this information with a wide range of partners including government agencies and private sector organizations. To its credit, the company doesn’t collect data of anyone under 18 and never sells or trades your personal info.
Here’s a breakdown of the types of information ID.me stores and for how long:
| Information type | Included data | Retention period |
|---|---|---|
| Verification information | Name, date of birth, social security number, copies of your ID, email address, mailing address, biometric data, professional certifications, education history, and community affiliations | Up to three years after account closure, unless public sector regulations require a shorter period |
| Other personal information | Age, gender, any other data you choose to provide | As long as needed, up to three years after account closure |
| Correspondence and feedback | Any feedback you’ve provided, as well as the contents of any messages to ID.me | As long as needed, up to three years after account closure |
| Information obtained offline | CCTV recordings of in-person visits, any other info provided during such a meeting | As long as needed, up to three years after account closure |
| Analytical info | IP address, location, errors displayed, and which website pages you visit. Will also record any links you click to refine targeted advertising | Up to three years |
| Info from business partners, data brokers, and other sources | Any publicly-available info, plus whatever data ID.me’s business partners have on you | As long as needed, up to three years after account closure |
| Biometric data | Selfies, recorded videos, fingerprints, hand scans | Depends on the platform you used ID.me to verify your identity with. No longer than one year after account deletion, unless legally required to keep for longer (then up to three years). Can manually request deletion, but takes up to a week |
This is a reasonable amount of information for an identity-verification service to have. That said, I’d prefer if the default retention period was lower (at least for sensitive data, like copies of your government identification). Three years is a long time, and in many cases, the countdown doesn’t even begin until you delete your account.
Can ID.me be trusted?
Unfortunately, one reason people keep asking “is ID.me legit?” is because the company has done some extremely shady things. For instance, during the COVID-19 pandemic, when unemployment was reaching unprecedented levels, ID.me falsely claimed $400 billion had been lost to fraudulent benefits claims. Further, users unable or unwilling to verify using biometrics were forced to wait nine hours or more for online appointments.
That’s not all: a 2022 investigation found that the company’s data-protection practices were significantly more lax than they appeared. Sensitive user information was posted in public Slack channels, staff were undertrained, and ultimately, those most in need paid the price. After all, during this time, it was impossible to access unemployment without an ID.me wallet and you simply could not get one if you didn’t have a permanent address or government ID.
So, is ID.me a legitimate website? Yes. Should you trust it? That depends.
If the service you’re trying to access lets you verify your identity directly, I’d choose this option. There’s no need for a middleman, and this way, one less company has your personal data. This may not always be an option though. It’s better to have government support you’re entitled to than to avoid signing up for privacy reasons, so if you’re in a tight spot, just do what’s required. If you’d like, you can always delete your ID.me account when it’s no longer needed.
Conclusion
Any organization that collects identification documents is a prime target for cyber criminals. ID.me has robust data-protection systems though it’s haunted by previous misrepresentations about its efficacy, wait times, and the scale of benefits fraud. It’s not ideal, and not always even necessary, but you can use this service relatively safely.
The biggest risk is not that ID.me will leak your information; it’s that someone will compromise your account directly. To protect yourself as much as possible, I recommend enabling multi-factor authentication and learning how to spot identity theft scams. You may also want to read up on smishing and data-sensitivity, just so you’re fully informed.
