Don't Mess With Taxes

The Internal Revenue Service will go beyond its current multifactor authentication online access protocol when it comes to signing in to taxpayer accounts.

The Internal Revenue Service continues its efforts to get more of us to interact with it electronically. It also wants to make sure those transactions are secure.

So later this year, the IRS is implementing a new security protocol for folks who want to set up or manage an online taxpayer account.

But it appears, at least based on anecdotal online and social media reactions, that the move might backfire.

More steps to get info: Last week, the security news website KrebsOnSecurity reported that by this summer, taxpayers can manage their online official IRS tax accounts only if they have an ID.me account.

This change will apply to existing IRS account owners (like me) and those who establish new accounts.

For now, I and other online tax account owners can sign on at IRS.gov by entering the username and password we created when we opened the account.

But with the ID.me requirement, we'll have to go through that McLean, Virginia-based company's confirmation steps to get an account which we then will use to log on to our tax account.

The ID.me system also is required of tax professionals

IRS and ID.me partnership expanding: I get it. Security is important. And the IRS has been hacked before. Its Get Transcript online service was out of service for more than a year after it cyber crooks found a way in.

So it's no surprise that the IRS looked for ways to protect its systems and taxpayer data, including access by taxpayers to their own information.

Plus, the IRS used the ID.me account method as the way for individuals to make changes to Advance Child Tax Credit payments via the tax agency's portal. The IRS actually has been using the so-called identity-proofing company since 2017, when in launched a pilot program.

In addition to IRS usage, ID.me was approved by the federal government as a "credential service provider" in 2014 and has been used by the U.S. military, the Social Security Administration, and Veterans' Affairs. Twenty-seven states and hundreds of retailers also use the company.

More steps and more questions: OK, it has a lot of official approval. But I also get why folks apparently are not happy with the new ID.me requirement.

Maybe it was Krebs blog post headline — IRS will Soon Require Selfies for Online Access — that prompted some of the reactions. It's a great attention grabber, but sounds like a silly, at best, security step.

Or maybe it's that people are used to easier ways to secure access to online accounts, like multifactor authentications. I'm quite accustomed to going to my bank or investment account websites and waiting for a code to be texted to me so I can sign in.

In fact, the IRS texted me a numerical code today to sign into my online account using the existing (for now) ID/password method I created years ago. And you have to use multifactor authentication to set up an ID.me account that you then use to sign into your IRS account.

Other ID methods: Or maybe it was the talk of biometrics and facial identification (hence the selfie headline) that ID.me uses to verify that you are you.

Sure, we already use fingerprints or facial recognition to get into our phones, and talk to them and our smart speakers. But that's between our personal devices and ourselves. We don't have a third party getting so involved.

And about those identity verification steps. ID.me also wants other stuff. A lot of it. Like copies of government-issued ID, utility or insurance bills, and details about our mobile phone service.

Say what? Maybe we aren't as ready for the future we see in entertainment programs as we think we are.

You can find out exactly what's what with the IRS-ID.me deal in this week's Saturday Shout Out items. Yeah, I know, I've rambled on so much here that I've kinda negated this feature's purpose, but…. Anyway, the posts are:

• KrebsOnSecurity's aforementioned IRS will Soon Require Selfies for Online Access;
• Gizmodo's IRS Will Require Facial Recognition Scans to Access Your Taxes Online;
• C|Net's Doing your taxes? The IRS will soon require a video selfie to access your account, and
• GoBankingRates' How To Set up ID.me for the IRS.

Not all welcome the change: I also suggest you (and the IRS) check out the comments about the change that follow the Krebs and Gizmodo articles. Most folks are not pleased, even if they never intended to get an IRS online tax account.

I share some of the trepidation. Like I said earlier, I do have an account, but to be honest, I only set it up to see how to do so when I was writing a post about the option back in 2016. I've looked at it maybe two times since, like when I posted about the IRS expanding info available via the Taxpayer Online Account tool.

Sorry, readers of the ol' blog, but I don't think I'll be going through the ID.me hoops to report on it. I share the sentiment of Gizmodo reporter Mack DeGeurin, who wrote (the highlighting in the excerpt below is mine):

"I went through the first stages of completing an ID.me application to see what it was like. The process required me to submit a photocopy of my driver’s license as well as a face scan using my phone's front camera. ID.me then required I submit my Social Security number and it requested permission to see information in my credit profile. Feeling sufficiently creeped out, I stopped short at that final stage but had I continued I would have given up a treasure trove of personal identifying information including government documents, credit history, and detailed biometric data."

And about that treasure trove. There are issues about how much and with whom our information might be shared.

Also, not to get all government bureaucratic about it, but this also strikes me as something where the IRS should have asked for public comment, or at least input from the tax professional community and the National Taxpayer Advocate.

No ID.me needed to e-file: The good news, at least (reportedly) for now, is that we taxpayers don't have to go through ID.me to e-file our returns or electronically pay our tax bills.

That's good. I plan to keep e-filing, especially since the U.S. Postal Service has become a bit less reliable. And I've been using the Electronic Federal Tax Payment System (EFTPS), for ages. I'd hate to lose that option.

I also hate to see my online tax account become inaccessible when the ID.me requirement takes effect, even though I don't use it often. When I logged in today, the IRS told me I had last logged on back in July 2021, and then once in 2020. But that apparent annual check-in will stop this summer, because I'm not going through the ID.me process.

It will be interesting to see how many others are of my mindset, and whether this will pose a hurdle to IRS efforts to get more people to set up online accounts.

Or, as one commenter opined: "It's not clear when the inconvenience or real inability to participate as a citizen will make it untenable for people to maintain the right to not use these systems, but sooner or later it will happen."

You also might find these items of interest:

• Digital IRS is costing those who can least afford it
• Ways to keep your business from becoming a tax cybercrime target
• COVID pandemic provides new paths for con artists to steal tax (and other) money, identities

Advertisements