Forest Global Training Partners

Cyber Risks · Krebs on Security

IRS Will Soon Require Selfies for Online Access

Summary: The IRS said that by summer 2022 the only way to log in to irs.gov would be through ID.me, an identity verification service requiring scans of driver's licenses or passports, copies of bills, phone records, and a live video selfie. ID.me, which says it has roughly 64 million users and adds about 145,000 a day, is already used by 27 states to screen unemployment and pandemic benefit applicants, and the IRS previously relied on Equifax for identity proofing until canceling that contract in October 2017 after the breach affecting 148 million Americans.

Bottom line: Taxpayers were being pushed to hand a private company their license, bills, phone details and face biometrics to reach their own tax records, and the reporter found that deleting that biometric data meant deleting the account entirely. The prior IRS identity system ran on Equifax, whose unpatched four-month-old zero-day exposed 148 million people - the same static-data model ID.me is meant to replace.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related