ID.me is the IRS's official identity verification tool, and it uses standard security practices, but you should still take precautions when using it
The IRS uses ID.me to verify your identity when you access certain online services, including tax transcripts and the IRS Direct File tool. ID.me itself does not store your tax information — it only confirms you are who you say you are, then passes you through to the IRS system. The company uses encryption, multi-factor authentication, and fraud detection similar to what banks use, which means the technical security is solid.
That said, ID.me is a third-party company, not the IRS itself. You are sharing personal information with another organization before reaching the IRS. The real safety question is not whether ID.me's technology works, but whether you should use it at all, and what to watch for when you do.
Key Takeaways
- ID.me is the IRS's chosen verification partner and uses encryption and multi-factor authentication, but it is a separate company that temporarily holds your personal data.
- You can verify your identity with the IRS without ID.me by calling 1-800-829-1040 or visiting an IRS office in person, though these routes take longer.
- Never click a link in an email or text to reach ID.me — go directly to irs.gov and log in from there, because scammers impersonate ID.me constantly.
- ID.me will never ask you to pay a fee, and the IRS will never contact you first about verification unless you initiated contact.
- If you see suspicious activity on your account after using ID.me, contact the IRS immediately at 1-800-829-1040.
How ID.me works with the IRS
When you try to access your IRS account online, the system redirects you to ID.me to prove your identity. You provide your Social Security number, date of birth, address, and other personal details. ID.me cross-checks this information against public records, credit bureaus, and other databases to confirm you are real and that the information matches.
Once ID.me confirms your identity, it sends a signal back to the IRS saying "this person is verified" — but it does not send your actual data to the IRS through ID.me. The IRS already has your Social Security number and tax records. ID.me's job is only to confirm that the person logging in is the person who filed the return.
This is why ID.me asks for information you would normally give only to banks or government agencies. The verification has to be thorough enough that a scammer cannot fake it.
What security measures ID.me actually uses
ID.me encrypts data in transit, meaning information sent between your computer and ID.me's servers is scrambled so it cannot be read if intercepted. It also requires multi-factor authentication — usually a code sent to your phone or email — so someone who steals your password alone cannot get in.
The company uses automated fraud detection to flag suspicious login attempts, and it stores data in secure data centers with restricted access. These are the same practices major banks use, and they work. ID.me has not had a major breach that exposed IRS users' tax data.
However, security measures are not the same as privacy. ID.me collects and temporarily stores your personal information. The company has a privacy policy that says it will not sell your data to advertisers, but it does use some information for its own fraud prevention and may share data with law enforcement if required by law.
Real risks: phishing and fake ID.me sites
The biggest danger is not ID.me itself — it is scammers pretending to be ID.me. The IRS and ID.me are targets for phishing attacks because criminals know people will enter sensitive information. You might receive an email or text saying your account needs verification, with a link that looks like it goes to ID.me but actually goes to a fake site controlled by a scammer.
If you click that link and enter your information, the scammer has your Social Security number, date of birth, and address. They can then file a false tax return in your name, open credit accounts, or sell the information to other criminals.
The safest approach: never click a link in an email or text to reach ID.me or the IRS. Instead, go directly to irs.gov in your browser, type the address yourself, and log in from there. If you receive an unsolicited email about IRS verification, it is almost certainly a scam.
Alternatives to ID.me for IRS verification
You do not have to use ID.me. The IRS offers other ways to verify your identity, though they are slower. You can call the IRS at 1-800-829-1040 and speak to a representative who will ask you security questions to confirm who you are. This takes longer — you may wait on hold — but no third party is involved.
You can also visit an IRS office in person with a photo ID and proof of address. Find your local office at irs.gov. This is the slowest option but the most secure, because you are handing documents directly to a government employee.
If you need your tax transcript or other documents urgently, ID.me is faster. If you have time and prefer not to share your information with a third party, the phone or in-person route works.
What to do if you are uncomfortable with ID.me
If you start the ID.me process and decide you do not want to continue, you can stop. You will not be penalized. You can then use the phone or in-person verification method instead. The IRS will not force you to use ID.me.
If you have already used ID.me and are worried about your information, monitor your credit report and tax account. You can get a free credit report from each of the three major bureaus (Equifax, Experian, TransUnion) once per year at annualcreditreport.com. Check for accounts you did not open. You can also place a fraud alert or credit freeze with the bureaus if you believe your identity has been compromised.
If you see suspicious activity — unauthorized tax returns filed in your name, accounts opened without your permission, or unexpected IRS notices — contact the IRS at 1-800-829-1040 and file a report with the Federal Trade Commission at reportidentitytheft.ftc.gov.
Red flags that something is wrong
The IRS and ID.me will never ask you to pay a fee to verify your identity. If someone claims you owe money to use ID.me or access your IRS account, it is a scam. The IRS does not collect fees for account verification.
The IRS will not contact you first by email or text about verification unless you initiated the contact. If you receive an unsolicited message claiming to be from the IRS or ID.me, treat it as a scam. Legitimate IRS contact usually comes by mail.
If ID.me asks you to verify your identity using a video call with a live person, that is legitimate — ID.me does offer this option for users who cannot verify through documents alone. But the video call should happen only after you have already started the process on irs.gov, not because of an email link.
Frequently Asked Questions
Can ID.me see my tax return or financial information?
No. ID.me only confirms your identity. It does not access your tax return, income, refund status, or any financial details. Once you are verified, you log into the IRS system directly, and ID.me steps out of the process.
What happens if ID.me denies my verification?
If ID.me cannot verify you through documents or databases, it will offer you the option to verify by video call with a live person. If that also fails, you can use the phone or in-person verification method with the IRS instead. Denial does not mean you have done anything wrong — it usually means your information does not match records clearly enough for automated verification.
Is my information deleted after I use ID.me?
ID.me retains some information for fraud prevention and account recovery purposes, but it does not keep your full profile indefinitely. You can request deletion of your ID.me account and associated data by contacting ID.me directly through their website. The IRS does not control how long ID.me stores data.
Can I use ID.me on my phone, or should I use a computer?
ID.me works on both phones and computers. The security is the same either way. Use whichever device you are most comfortable with, but make sure you are on a secure network — avoid public Wi-Fi when entering sensitive information.
What should I do if I think my ID.me account was hacked?
Change your ID.me password immediately and enable multi-factor authentication if you have not already. Then contact the IRS at 1-800-829-1040 to report the incident and ask them to flag your account for fraud monitoring. Check your credit report and tax account for unauthorized activity.