Hill Dems question IRS on identity verification requirements for Direct File

A trio of Democrats on Capitol Hill think that the IRS requirements for identity verification in the Direct File program “created serious access barriers” to filing taxes using the service. 

Sens. Elizabeth Warren, D-Mass, and Ron Wyden, D-Ore., and Rep. Katie Porter, D-Calif., penned a letter to the heads of the IRS and Treasury Department on Tuesday requesting more information and a briefing about identity verification requirements for Direct File.

Direct File is a new program piloted last year to give taxpayers a way to file online, directly with the IRS and for free using a government-fielded tool. The tax agency recently announced its plans for the service’s expansion in the coming tax season. 

“The launch of Direct File was a huge success, and going forward, we look forward to it serving more taxpayers with more features, which is precisely why it is important to understand the impact of the identity verification process on taxpayers,” the lawmakers write in the letter. 

The letter points to Nextgov/FCW reporting on drop-offs in the Direct File pilot, particularly at the point where users had to prove their identities and make an account. Only 62% of those that finished the eligibility checker created or signed into an account. 

“Direct File is poised to be especially critical for those taxpayers who face barriers to filing,” the letter reads. “Requiring them to use ID.me is creating yet another needless barrier to exactly these taxpayers who need Direct File most to claim tax benefits.”

The lawmakers also argue that the identity verification required by the IRS for Direct File goes beyond what is required for private tax prep companies’ tools, putting Direct File at a “significant disadvantage.”

Last tax season, the IRS used private vendor ID.me for Direct File’s identity verification, pointing to the vendor’s compliance with a government-created identity standard called identity assurance level two.

Federal agencies are required to follow National Institute of Standards and Technology identity guidelines under a 2019 memo. IAL2 is one of three levels of identity proofing under those guidelines.

“While we applaud the IRS’ goal of protecting taxpayers from identity theft, it makes no sense to only require heightened identity verification for taxpayers using the free Direct File service, while allowing identity thieves to continue to exploit the comparatively lax security of commercial tax prep services,” the group wrote in the letter. 

“If the threat posed by identity thieves and fraudsters is severe enough to warrant requiring taxpayers to submit to identity verification before submitting their tax returns, then the IRS should require such security protections, across the board,” they continue. “If the threat posed by identity thieves is not serious enough for the IRS to require commercial tax prep companies to implement burdensome identity verification, then taxpayers using Direct File should not be required to do so either.”

The Democrats also cite concerns about bias in face recognition technology and the privacy ramifications of the government outsourcing identity verification.

This isn’t ID.me’s first time in the spotlight. The service also garnered the attention of lawmakers in 2022, particularly for its use of face recognition to verify the identities of taxpayers logging into the IRS online.

Using a biometric like facial recognition is the easiest way to meet that commonly sought after IAL2 standard under NIST guidelines, although the standards agency is currently updating the guidelines to allow for non-biometric options. 

The IRS said in 2022 that it would add Login.gov — a single sign-on and identity proofing service fielded by the government — as an option, but has yet to do so, citing a lack of compliance with IAL2. 

Login.gov has added facial recognition technology to meet that standard, but the only choice for users of Direct File was to go through ID.me, which offers people logging into the IRS accounts a facial recognition or video call option. 

The question of whether the IRS is considering Login.gov as an alternative is one of several the lawmakers want answers to.

They also ask what the IRS knows about how identity proofing worked for Direct File and what barriers it may have caused, in addition to whether the IRS may reconsider its requirement for IAL2 altogether once NIST finalizes its updates and whether private tax companies should also have to be IAL2 compliant, among other things.

“ID.me is proud to support the IRS in the expansion of its successful Direct File program,” a company spokesperson said in a statement to Nextgov/FCW. “For users who choose our self-service pathway, which uses facial verification with 1:1 matching, our NIST- and DHS-tested algorithm has demonstrated 99+% effectiveness across all tested demographics.”

H&R Block and TurboTax did not immediately respond to requests for comment on their practices around identity proofing. 

"The IRS has already committed to moving to Login.gov," a Warren aide told Nextgov/FCW. "We look forward to learning more about their facial recognition and identity verification technology."

The IRS did not immediately respond to requests for comment.