One door is not a service: the IRS selfie reversal

The week

Almost every adult in the United States deals with the Internal Revenue Service. So when the IRS changes how people get into their tax records online, the decision lands on a very large and very varied public.

On November 17, 2021, the IRS said new users of several online services would need to verify their identity through ID.me, a private identity verification provider. The services named were the Online Account, Get Transcript Online, the Identity Protection PIN tool, the Online Payment Agreement and the Child Tax Credit Update Portal. People with existing IRS usernames could keep them until the summer of 2022 but were asked to create an ID.me account as soon as possible. The agency said more applications would move to the new sign-in over the following year.

Identity verification, sometimes called identity proofing, is the step where an organization confirms that the person creating an account is who they claim to be, before handing over access to sensitive records. Done in person, it might mean showing a driver’s license at a counter. Done online, it has to be reconstructed with technology.

The usual process asked users to photograph an identity document, such as a driver’s license, state ID or passport, and take a selfie with a phone or webcam for facial comparison. Facial comparison means software checks whether the face in the selfie matches the face on the document. A video call with an agent was the fallback. For many people the process took minutes. For others it did not work, and the fallback meant waiting for a live agent.

The IRS was not the first public body to use this route. During the pandemic, a number of state unemployment agencies had adopted the same provider to stem a flood of fraudulent claims. Many claimants had already met long video-call queues there. The IRS decision brought the same design to a service with a far larger and older user base.

In late January 2022, the requirement drew sharp criticism from lawmakers of both parties and from privacy advocates. Republicans on the Senate Finance Committee wrote to the IRS asking how taxpayers’ data would be handled and what would happen to it if the arrangement ended. Other senators sent letters of their own. The objections came on three fronts: the use of facial recognition, the role of a private company in access to tax records, and long waits for people who could not complete the automated steps.

Each objection touched a different nerve. One was about biometrics, data drawn from a person’s body, which cannot be changed if it leaks the way a password can. One was about who should stand between citizens and their government. And one was about plain service: a door that some people cannot get through.

A technical distinction then turned into a public one. Comparing a selfie with one document photo is called one-to-one matching. Searching a face against a large store of other faces, to spot one person opening many accounts, is one-to-many matching, and it carries greater privacy concern. Late in January, the provider had said publicly that it did not use one-to-many matching. Within days its chief executive corrected that statement. He said a one-to-many check did run once at enrollment, for government programs targeted by organized fraud. The correction made the debate about trust as well as technology.

On February 7, Senator Ron Wyden, chair of the Senate Finance Committee, wrote to the IRS commissioner. He urged the agency to drop the facial recognition requirement and move toward Login.gov, the government’s own sign-in service. The same day, the IRS announced it would transition away from using a third-party service for facial recognition when people created new online accounts. It said the change would happen over the coming weeks to avoid disrupting the filing season, and that it did not affect anyone’s ability to file a return or pay taxes. Within days, the provider said government agencies could choose a route that did not use automated facial recognition, and that users would be able to delete their selfies from March 1.

The reversal was swift. The method had not failed to stop fraud; a single route, chosen for good reasons, had become the only route for a service that has to work for nearly everyone.

Remote identity proofing asks an agency to do two things at once. It must keep fraudsters out of tax, benefits and unemployment accounts, which were heavily targeted during the pandemic. It must also let in a population that includes people without smartphones or credit histories, people whose names differ across records and people with reasons to distrust government data collection. A tax agency serves almost every adult, so even a small failure rate is a large number of people.

The IRS episode raised a specific question: what happens when one proofing method, chosen for good fraud reasons, becomes the only way in. The answer turns on three design decisions: the routes offered, how failure is measured, and who is accountable for the data.

What follows takes the issue in order. It starts with the groundwork: how remote proofing works, and why no single person owns the journey through it. Then come the three decisions, one section each. A hypothetical state agency shows how the decisions interact when fraud moves. After that come the strongest case against offering more routes, and how the trade-off differs across agencies, banks and health systems. The last two sections set out the features of a sound service and the questions that test one.

Three ways to prove who you are online

When you open a bank account in a branch, a clerk looks at your ID, looks at you, and decides you match. Remote identity proofing tries to recreate that moment without the clerk or the counter. There are three broad ways to do it, and each has a different weakness.

Questions from the credit file

The oldest is knowledge-based verification: the website asks questions drawn from your credit file, such as which of these addresses you once lived at, or which bank holds your car loan. The trouble is that years of data breaches have put much of that information in criminals’ hands. The 2017 Equifax breach alone exposed personal data on roughly 147 million Americans, according to the company and the Federal Trade Commission. A fraudster with a stolen profile can often answer as well as the real person, sometimes better.

The method also fails honest people in predictable ways. Someone with a thin credit file, such as a young adult, a recent immigrant or an older person who has lived without debt, gets few or no questions. Someone who has moved often may not remember a street from a decade ago. So the method keeps out too many of the wrong people and lets in too many of the right fraudsters.

A document and a selfie

The second is document-plus-selfie verification, the method at the center of the IRS story. It runs in four steps, and each can fail separately.

1. Capture. The user photographs the front and back of a driver’s license or passport. Glare, blur, a cracked phone lens or a worn card can defeat this step before any check runs.
2. Document authentication. Software inspects the image for the security features, fonts and layout expected of that issuer, and reads the barcode or machine-readable zone to see whether the encoded data agrees with the printed data.
3. Liveness. The user takes a selfie, often while turning their head or blinking, so the software can confirm a live person is present rather than a photo or a screen held up to the camera.
4. Comparison. The software compares the selfie with the photo on the document and returns a score. Above a chosen threshold, the person is verified.

That threshold is a policy choice dressed as a technical setting. Set it high and fewer impostors get through, but more genuine people are rejected. Set it low and the reverse happens. Somebody chooses the balance, and the people who bear the cost of a strict setting are rarely in the room.

Two attacks matter here. A presentation attack holds something up to the camera: a printed photo, a mask, a video on another screen. An injection attack skips the camera altogether and feeds a forged or synthetic image straight into the app’s data stream. Liveness checks target the first. The second is a newer and harder problem, and it grew more serious as tools for generating realistic faces improved.

A person checking a person

The third is human: a trained agent checks documents and the person, either over a live video call or face to face at an office. The agent can handle the cases software cannot: a name change after marriage, an expired license, a face that has aged twenty years since the passport photo. Human checking is slower and costlier per person, and people make their own errors in comparing faces. It is, however, the route that most people already understand and accept.

Assurance levels

Behind all of this is the idea of an “assurance level.” NIST, the federal standards body, publishes digital identity guidelines that describe how confident an organization needs to be about a person’s identity for different kinds of service, and which proofing methods can achieve each level. The version in force in 2022, SP 800-63-3, set out three identity assurance levels. The middle one, IAL2, is the usual bar for services that expose sensitive personal records, and seeing your own tax records calls for that kind of confidence. Federal agencies are directed by Office of Management and Budget policy to follow the guidelines.

The guidelines describe outcomes, not a single mandatory technology. Several different routes can reach the same level. An agency that picks one route has made a design choice of its own, and should not present it as a requirement imposed by the standard.

A chain of handoffs with no single owner

From the outside, identity verification looks like a single screen. Inside an agency, it is a chain of handoffs, and each link has an owner who may never meet the others.

It starts when a person clicks “create account.” The agency’s website redirects them to the proofing service, which may be run by a vendor or by another part of government. The service collects the document image and selfie, runs its checks, and sends back a short signed message, usually through a standard federation protocol such as OpenID Connect or SAML. That message says, in effect, verified at this level, not verified, or needs review, along with a few attributes such as name and date of birth. The agency’s own systems trust the message and open the account.

The agency often never sees the images at all. They are held by the provider, under the provider’s retention rules. Nor does the agency usually see why a person failed. It gets the outcome, not the reason, unless the contract requires the provider to report more.

The teams around the chain

Around that chain stand several teams. The program office owns the service and its public promise. The fraud team watches for suspicious patterns and pushes for stricter checks. The contact center absorbs every person who gets stuck, usually without any visibility into why the automated check failed. The privacy office drafts the notice and, for a federal agency, the privacy impact assessment. Procurement writes the contract. Accessibility specialists, if they are consulted, test whether people using screen readers or other assistive tools can complete the steps. Legislative affairs fields the calls from congressional offices when constituents get stuck.

The trouble is that each team sees only its own number. The fraud team sees fraud falling and is pleased. The vendor sees a strong pass rate. The contact center sees long queues but cannot explain them. Nobody owns the end-to-end experience of a person trying to get in, from first click to working account, across every route. That gap, more than any single technology choice, is where services like this go wrong.

One owner, one scorecard

A practical remedy is to appoint one accountable owner for the whole journey, with authority over the routes, the capacity of each, the measures reported and the contract terms. That person’s scorecard should include both fraud stopped and people served, so the trade-off is managed in one place rather than argued between departments.

Such a scorecard might carry five measures. They are the share of people who start and finish, by route; median and worst-case time to a working account; fraud attempts detected by route; complaints and casework; and cost per verified person. These need no exotic tooling. Most can be assembled from the provider’s reports, the contact center’s records and the agency’s own account database, provided the contract requires the provider to supply step-level data.

The owner also needs a standing forum. A monthly review can bring the fraud lead, the contact center lead, the privacy officer and the vendor’s account manager together over one set of numbers. It settles most disputes before they become public ones.

More than one way in

Document-plus-selfie verification is popular because it resists the most common fraud. Someone holding stolen personal data can often answer knowledge-based questions drawn from credit files. Producing a matching face and a valid document is harder. For an agency fighting organized fraud rings, that is a real advantage.

The same method excludes people for reasons unrelated to fraud. It needs a camera, a current photo document and enough comfort with the process to complete it. Older adults, people with disabilities, people whose appearance has changed, and people without a driver’s license or passport fail or abandon at higher rates. Some people decline to hand a biometric to a private company to see their own tax records. For a service the public is obliged to use, that refusal is a reasonable position, and the design has to accommodate it.

Three routes to the same level

NIST’s digital identity guidelines already allowed several ways to reach a given assurance level, including supervised remote proofing and in-person proofing. A sound design offers at least three routes to the same level:

• Automated: fast and cheap for those who can use it.
• Live video: an agent checks documents on a call, without automated facial matching.
• In person: at an agency office, a partner such as the Postal Service, or a trusted community organization.

Each costs more per user than the last, and each closes a different gap. The automated route carries the volume. The others keep the service universal. A building with only a revolving door handles most of its traffic, but nobody would call it accessible.

Two further tools help with the hardest cases. A trusted referee is a trained person, employed by the agency or provider, who can resolve exceptions the standard process cannot, such as someone whose only identity document has expired. An applicant reference is someone who can vouch for an applicant, such as a caseworker or guardian. Both need written rules on when they may be used, because both can be abused.

The full cost of each route

The cost question deserves a frank answer for budget holders. A video agent or an in-person check costs far more per person than an automated check. But the comparison is misleading if it stops there. People who fail the automated route do not disappear. They call the contact center, write to their representatives, file paper forms or give up on services they are entitled to. Each of those has a cost too, sometimes hidden in another department’s budget. The honest calculation compares the full cost of serving everyone, across all routes, with the full cost of failing some of them.

Paper is the clearest example for a tax agency. A person who cannot get into an online account to check a balance or get a transcript will often write or call instead. Each of those contacts takes staff time that the online service was meant to save.

Capacity, queues and seasons

Routes must also be reachable. A fallback that requires hours on hold, or an office visit hundreds of miles away, exists on paper only. Capacity for each route should be planned from expected failure rates, with service levels published. If an agency expects a certain share of users to fail the automated route, it can calculate how many video agents and in-person appointments it needs, rather than discovering the shortfall through complaints.

Queues behave badly near their limit. When a team of agents is busy most of the time, a small rise in arrivals produces a large rise in waiting time. A video route sized for an average week will collapse in the weeks that matter. Those include the opening of filing season, the days after a benefit change and the morning after a news story sends people to check their accounts. Capacity plans should be built for peaks, with surge staff or overflow contracts agreed in advance.

Scheduling helps too. An appointment booked for tomorrow at a known time is a better service than an open-ended queue today, especially for people who are working, caring for others or using a library computer. A route that offers booked slots, reminders and a way to resume after a dropped call turns a frustrating wait into a manageable errand.

Who fails, and where

Proofing vendors and agencies typically report pass rates and fraud caught. Those numbers hide who fails. A high overall pass rate says nothing about whether the failures fall evenly or cluster among older users, rural users or people with particular document types.

The useful measures are:

• failure and abandonment by step, so the agency can see where people drop out;
• failure and abandonment by population group;
• time to complete each route, including waits;
• the share of people who finish on a fallback.

Reading the funnel

Step-level data turns a single pass rate into a funnel. Of everyone who starts, how many get past capture, past document checks, past liveness and past comparison, and how many of those who fail at each step later succeed on another route? The shape of that funnel points to the fix. A big drop at capture suggests a design or device problem. A big drop at document checks suggests that certain document types or issuers are poorly supported. A big drop at comparison suggests a threshold or an algorithm problem.

Abandonment needs separate attention from failure. A person who closes the browser at the selfie screen has not been rejected by software. They may have no camera, no time or no wish to give a biometric. If the agency counts only failures, it misses a group that may be larger than the failures and that never appears in any complaint queue.

Measuring fairness without building profiles

Agencies can collect most of this without storing sensitive attributes by using aggregate analysis and voluntary surveys. Aggregate analysis means looking at totals and patterns, for example failure rates by type of document, by device type or by region, rather than keeping a sensitive profile of each person. A short, optional survey at the end of each route can add age band and disability status for people willing to share them.

There is good reason to look. NIST’s 2019 study of demographic effects in face recognition found that many algorithms performed unevenly across demographic groups, with the size of the gap varying widely from one algorithm to another. That finding does not show that any particular provider’s system is biased. It does show that an agency cannot assume fairness from a vendor’s headline accuracy figure; it has to check on its own population.

A high failure rate in any group should be treated as a service defect with an owner and a fix date, just as a broken form would be. The fix may be technical, such as better support for a document type. It may be operational, such as more appointment slots in an underserved region. Or it may be a change of route, steering people with a known problem straight to the human check instead of making them fail first.

Fraud by route

Fraud measures need the same honesty. A method that stops fraud in one channel may push fraudsters to the weakest fallback. Tracking fraud attempts by route shows whether the fallback is becoming the attack path and whether its checks need strengthening. Without that data, an agency cannot tell whether removing a strict method made it safer or only more convenient.

Fraud should be measured downstream as well as at the door. Some fraud is caught at proofing. More shows up later: refunds redirected to new bank accounts, changed mailing addresses, benefit claims that a real person later disputes. Linking those later signals back to the route by which each account was created tells the agency which route lets fraud through, which is the figure that matters.

Who holds the images, and on what terms

When a private company performs proofing for a public service, the public reasonably asks who holds the images and for how long. It also asks what else they may be used for and who answers when something goes wrong. Those questions can be answered in the contract and the privacy notice. They also need to be answered publicly, in words anyone can follow, before launch, because a privacy notice discovered by journalists after launch reads as concealment.

Biometric data raises the stakes. A stolen password can be changed. A stolen face template, the mathematical description of a face that matching software uses, cannot. So the terms around it matter more than for most data. Contract terms should cover:

• retention limits for images and templates;
• a ban on secondary use;
• deletion on request;
• audit rights;
• breach notice;
• data return at contract end.

Say exactly what the system does

The January 2022 correction over one-to-many matching showed a further requirement: the public description must match what the system does. An agency should obtain from its provider a written list of every biometric operation performed, when it runs, against what data, and what is kept afterward. That list belongs in the contract, the privacy impact assessment and the public notice, and it should be re-confirmed whenever the provider changes its product.

One-to-many duplicate checks do catch a real fraud pattern, where one person opens many accounts under different identities. An agency that wants that protection should say so, explain the safeguards and let people who object choose a route without it. Saying one thing and running another loses the trust that the protection was meant to preserve.

Whose account is it

Agencies should also decide whether the provider’s account belongs to the citizen across many services or only to the agency. Reuse is convenient: verify once, use the same account at several agencies. But it concentrates data and dependency in one company. If that company is breached, changes its terms or leaves the market, every agency relying on it is affected at once. Contracts should provide for exit: how accounts and verification status will be carried to a successor, and how long the provider must keep operating during a transition.

Login.gov or a commercial provider

There was also a sourcing choice. The federal government ran its own shared service, Login.gov, operated by the General Services Administration, and the debate in early 2022 included whether agencies should rely on it instead. That choice involves assurance level, cost and operating capacity, and it is a policy decision as much as a procurement one.

A shared government service keeps citizen data under public accountability but depends on appropriations and its own operating capacity. It must also be able to handle the load of a large agency in its peak season, which is a different engineering task from serving many small ones. A commercial provider can scale quickly but brings the accountability questions above. Either way, the agency should own the decision in writing, with its reasons, rather than inherit it from whichever contract vehicle was available. A contract vehicle is a pre-approved purchasing arrangement that makes buying faster; convenient, but no substitute for a deliberate choice.

Public operation is no guarantee of accuracy about what a service does. A government provider should face the same demands as a commercial one: an independent assessment against the assurance level it claims, and plain statements to its customer agencies about any gap.

How a strict front door pushes fraud sideways

Suppose a state labor department running unemployment benefits adopts document-plus-selfie verification for every new claimant after a wave of fraudulent claims. Fraud through the online portal drops sharply. The dashboard shows a healthy overall pass rate, and the project is declared a success.

Then the complaints arrive. Legislators’ offices report constituents who cannot get past the selfie step. The video fallback has a long queue. When the department breaks its data down by step, it finds that many failures happen at the document photo, not the face match. They cluster among people using older phones and people whose only ID is an out-of-state or expired document. Abandonment is highest among older claimants.

Meanwhile, the fraud team notices something else. Suspicious claims have not disappeared; they have moved to the phone line, where agents verify callers with a few questions from the claimant’s file. The strict front door pushed fraud to the softest side entrance. Some rings change tactics in other ways too, for example by recruiting real people to pass the face check and then taking over the account, which no face match can stop.

The fix keeps the automated route. The department adds a staffed video route without facial matching and partners with local offices for in-person checks. It sizes each route from measured failure rates, strengthens verification on the phone line and publishes readable terms on image retention. It also starts reporting failure by step and route every month, with an owner for each problem.

The fixes interact. Stronger phone verification closes the side entrance, but only if the video and in-person routes have the capacity to absorb the honest callers who can no longer get through by phone. Measuring by route shows whether that is happening. Publishing terms on images lowers abandonment among people who had refused to give a selfie to an unknown company. And account changes after enrollment, such as a new bank account for payments, get their own checks, because the account-takeover pattern bypasses proofing entirely.

No single decision in this story is wrong. The failure comes from making them one at a time, each by a different team, each judged by its own number. Treated together, routes, measurement and data terms make up one design.

The case against more doors

The strongest objection to multiple routes is that attackers choose the weakest one. Every fallback is a potential bypass, and a service with three routes has three sets of controls to keep strong. That objection is correct as far as it goes. The answer is to hold each route to the same assurance level and to measure fraud by route, rather than to keep only the strictest door. NIST’s own approach allows different routes provided each reaches the required confidence.

A second objection concerns cost. Staffed routes are expensive, and agencies under budget pressure will be tempted to underfund them. That is a real risk, but an underfunded fallback is a reason to fund it properly or narrow the service’s scope, not a reason to pretend the excluded do not exist. The excluded remain the agency’s customers, and they reach it through costlier channels.

A third objection holds that software compares faces more consistently than people do, so the human route may be less accurate. For some tasks that may be true. But a choice of routes does not ban automation. Most people will still use the automated route because it is fastest. The human route exists for the people software cannot serve and for those who decline to use it.

A fourth objection says the privacy concern is overstated, since millions of people unlock their phones with their faces. The comparison does not hold well. Phone face unlock generally keeps the face data on the device, under the user’s control. Remote proofing sends a face image to a third party, which compares and may retain it under terms the user did not negotiate. The concerns are different, and so is the consent.

The argument for multiple routes does weaken in one setting. For a low-risk service, such as booking an appointment or paying a parking ticket, an agency may not need verified identity at all. Forcing high-assurance proofing on such services creates the exclusion problem without the fraud benefit. Matching the assurance level to the real risk of each service is the first design decision, and it often removes the need for proofing altogether.

How the trade-off differs by organization

In the public sector, identity proofing is where four pressures meet. Fraud costs taxpayers and damages trust in programs. Exclusion denies people services they are entitled to, and generates complaints, casework and legislative scrutiny. Privacy concerns about biometrics and private contractors can, as the IRS found, turn into a bipartisan political problem within weeks. And reputational damage spreads beyond the program: a citizen who cannot get into a tax account forms a view of government as a whole. The balance among those pressures differs by type of organization.

Federal agencies

A federal agency follows NIST’s guidelines under OMB policy, must assess privacy risks before deploying new systems that collect personal information, and must meet federal accessibility requirements for its digital services. It usually serves a national population, so the range of devices, documents and circumstances is at its widest. Its choices also set expectations for state and local agencies that follow its lead.

State and local agencies

A state unemployment or benefits agency faces the most concentrated fraud pressure, as the pandemic showed, and often runs on tight administrative budgets. Its claimants are, by definition, people in difficulty, some without stable housing or current documents. A county or city has a different mix. It handles many low-risk transactions that may need no proofing at all, a few high-risk ones such as benefits or vital records, and has offices close to residents. For a county, in-person proofing at an existing service counter may be the cheapest fallback available.

Banks and credit unions

Banks face a parallel rule set. Under the customer identification program rule that implements the USA PATRIOT Act, a bank must verify the identity of each new customer. It may use documentary or non-documentary methods, set out in its own written program. The FFIEC’s 2021 guidance on authentication and access, which covers banks and credit unions, asked institutions to base their controls on risk assessments that cover customers as well as employees. A bank that relies on a single selfie route for account opening faces the same exclusion problem as an agency, with a commercial cost added: the customers it turns away open accounts elsewhere.

Health systems

Health systems verify identity for patient portals, telehealth and records requests. The HIPAA Privacy Rule requires covered entities to verify the identity of a person requesting protected health information when the person is not known to them. Patients include the very old, the very ill and proxies acting for them, so the need for human routes and for vouching by family members or caregivers is greater than in most sectors. A portal that only works with a smartphone and a driver’s license excludes many of the patients who most need it.

Across all of these, the IRS episode shows how quickly a choice that looks sensible on a fraud dashboard can become untenable when the people it excludes, and their representatives, start to speak.

The six features of a sound service

Taken together, the choices above give a proofing service six features:

• Several routes to the same assurance level, at least one of them without automated facial matching.
• Capacity planned from failure rates, with published waits for each fallback and surge plans for peak seasons.
• Measurement by step, group and route, with failures and abandonment treated as service defects.
• Fraud tracked by route, including fraud found after enrollment, so the agency sees when attackers move.
• Plain-language data terms, describing every biometric operation, published before launch and written into the contract.
• A written sourcing decision that the agency owns, with an exit plan.

The failures are familiar. Agencies choose one method because it scores best on fraud, then bolt on a fallback with no capacity. They report a single pass rate. They let the vendor’s standard terms stand in for a public commitment on biometrics. They assume removing a strict method makes the service less safe, or that keeping it makes the service fair, without data to show either.

The six features also give an auditor or inspector general a clear test. Each produces evidence: route definitions and the assurance level each meets, capacity plans and published waits, monthly funnel reports, fraud reports by route, the contract clauses and notice, and the signed sourcing memo. An agency that can hand over that file in a day is in a strong position when the questions come.

Where the proofing service can fail

• How many different ways can a person prove who they are to use this service, and does at least one avoid facial recognition?
• Who fails or gives up at each step, and how do we know?
• How long does someone wait on each fallback route today, and on the busiest day of the year?
• Where are fraud attempts coming in, by route, and has that shifted since we changed the process?
• Who holds images and face data, for how long, and can they use them for anything else?

With hindsight

On February 21, 2022, the IRS added an option to verify through a live virtual interview with agents, with no biometric data required. It said images provided by taxpayers through the automated route would be deleted for accounts being created, and that biometric data already collected would be permanently deleted over the following weeks. The IRS continued to use the provider with that alternative in place. The fix kept the automated route, added a genuine second door beside it and limited what was kept from the first.

The same statement said the IRS would work with the General Services Administration to roll out Login.gov as a further option, aiming to introduce it after the 2022 filing deadline. That part moved slowly. Reporting in February 2023 found the IRS still offered the one provider as its only route for online accounts, with the video interview it had called a short-term measure and no in-person option.

Scrutiny of the wider program continued. In November 2022, the House Select Subcommittee on the Coronavirus Crisis and the Oversight Committee published findings on the provider’s work for state unemployment agencies. The committees said that in 2021 average video-call waits had exceeded four hours in most states using the service, and that the company had understated waits in a briefing to the IRS. The company said the long waits had been temporary and caused by historic fraud. Whatever the cause, the report confirmed that a fallback without capacity had excluded people on a large scale.

The public alternative had problems of its own. In March 2023, the GSA inspector general reported that GSA had misled customer agencies about Login.gov’s compliance with NIST’s IAL2 requirements. The service had never included the physical or biometric comparison that level then required, yet GSA had billed agencies over $10 million for those services. Public operation had not guaranteed an accurate description of what a service did. The episode supports the case for independent assessment of any provider, public or commercial.

The fraud pressure was real. In September 2023, the Government Accountability Office estimated that fraud in unemployment insurance during the pandemic was likely between $100 billion and $135 billion, about 11 to 15 percent of benefits paid. Any account of the IRS episode that treats facial matching as an overreaction has to reckon with that figure.

Login.gov later adopted the shape the IRS reversal had pointed toward. In April 2024, GSA announced a pilot of facial matching against a self-supplied photo ID, alongside an upfront option to verify in person, without facial matching, at more than 18,000 Postal Service locations. In October 2024, GSA announced independent certification of Login.gov at IAL2. The argument in 2022 had been about whether facial matching should be the only way in, and on what terms, rather than whether it was good or bad. A government-run service ended up offering the same kind of check, as one option among several.

NIST finalized its revised digital identity guidelines, SP 800-63-4, in July 2025. The identity proofing volume recommends that providers offer options suited to their populations and requires that those options give comparable assurance. It recommends trusted referees for people who fail automated checks and requires explicit informed consent before collecting biometrics. It also adds controls for injection attacks and forged media. Because many public and private organizations follow NIST’s guidance, the revision shapes how remote proofing is designed and judged across sectors.

By this point in 2026, public agencies are expected to offer more than one route to verified identity. Fewer of them measure who fails each route, which is what tells them whether the routes are working.

Offering choices is only half the job. A fallback that nobody measures can become as exclusionary as the single door it replaced, through long waits, distant offices or confusing instructions. Measurement is also what lets an agency defend its choices when they are challenged, as the IRS’s were, with evidence rather than assurances. The questions to ask every quarter are simple: who is failing, where, and how long are they waiting? An organization that can answer them has a service. One that cannot has a policy statement.