Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Welcome
Go
Free Newsletter Sign Up

Grandma’s Selfie Chaos Shows Government Fraud Fix Still Elusive

March 7, 2022, 9:45 AM

Last spring, my 79-year-old grandma in Ohio—and her flip phone—met the government’s online security system.

To redirect her Social Security check to a new bank account, she needed to pass through ID.me, a cybersecurity company that has become a digital gatekeeper for federal services and has used selfies to verify Americans are who they say they are.

Mom took out her iPhone, snapped a photo of Grandma, and uploaded it to the company’s website before the timer expired. She and my aunt repeated this several times—and still couldn’t log in to the website, which required a photo as a biometric pass code.

My overwhelmed Grandma nearly lost her temper after telling a Social Security customer service representative—for the third time—that she couldn’t unlock the selfie portal.

If ID.me sounds familiar, it’s probably because you’ve read about its selfie software. The Internal Revenue Service recently said it would drop the company later this year because of privacy concerns about the facial recognition tool, and the Department of Veterans Affairs is reconsidering using it.

President Joe Biden is expected to sign an executive order in the coming weeks directing agencies to crack down on identity theft involving public benefits without compromising privacy. And Biden’s Justice Department will tap a chief prosecutor to tackle large-scale pandemic identity fraud, the president said on Tuesday night.

But that doesn’t immediately fix the problem government asked ID.me to help solve—block potential fraudsters from stealing government checks online. The Secret Service reported that criminals potentially stole up to $100 billion in stimulus funds. Whatever replaces ID.me needs to keep government funds safe and work for people like my grandma—and others across the country who don’t have documentation, reliable internet, or selfie skills. Roughly two in 10 U.S. adults don’t have a smartphone, according to a 2021 Pew Research Center survey.

“As much as we are sort of pushing a lot of things to online services, there very much is a digital divide and there has to be in-person alternatives,” said Hannah Tanabe, a Boston legal-aid attorney who helps clients apply for unemployment benefits.

The Social Security Administration said in a statement that ID.me has never been the only tool for Americans to complete tasks with the agency online. ID.me said that it has hired agents to video chat with people who don’t want to or can’t meet its selfie requirement, adding that it’s up to agencies to provide in-person or calling options.

Rooting Out Fraud

Long before the pandemic triggered job losses and shuttered government offices, federal technology officials directed a few agencies to set up secure ways to verify an individual’s identity online so that checks went to the correct person.

One option: compare someone’s selfie to a driver’s license photo using an algorithm. ID.me before the pandemic struck deals to do just that for a few agencies, far surpassing competitors’ share of the federal government’s digital gatekeeper business. Biden’s Labor Department recommended ID.me, along with competitors TransUnion and LexisNexis, to state unemployment offices looking to crack down on pandemic aid fraud.

But in my grandma’s case, ID.me didn’t work. ID.me would just not let her through—no matter how many selfies we helped her take. The company said that was because we used different phones to take the photos—and none of them were registered in my Grandma’s name, a safeguard ID.me uses to check someone’s identity remotely.

In the end, it was her bank, not the federal government, that helped us correct her check last April.

No Perfect Solution—Yet

The IRS said it will continue to rely on a combination of video interviews with the company’s support personnel and optional selfies through this tax season.

But it’s difficult to meet the federal government’s proofing requirements for agencies facing higher risk of fraud without comparing an individual’s face against an ID photo, whether that’s done by an algorithm or a person. Meanwhile, federal data scientists are rewriting the rules for outside companies like ID.me to verify Americans’ identities on behalf of the federal government, with the goal of publishing them by summer, said Andrew Regenscheid of the National Institute of Standards and Technology.

Agencies also have yet to buy into Login.gov, the identity verification solution managed by the federal government—except for a few federal websites, such as the government’s job board and the Social Security Administration portal. Login.gov uses third-party services, including LexisNexis, to verify an individual’s identity.

The goal is for Americans to eventually use Login.gov to access services across government agencies, rather than each one using different privacy standards, outside vendors and security levels.

But agencies aren’t required to use it and weaving it into their years-old systems takes time. The technology also isn’t fraud-proof. It asks applicants for names and email addresses, all information that a fraudster can steal and use to impersonate someone else. However, it has an added layer of security that helps private companies cut down on hacks.

Login.gov isn’t using facial recognition for now, a spokesman for the tool said by email. Engineers did test it out as recently as March 2021, according to a blog post.

Biden in December also directed his government to slash the time Americans spend accessing government services, including Medicare, veteran’s benefits, and student loan repayment. The order calls on agencies to deliver more services online, such as passport renewals and disaster inspections.

Open and available government offices are another way for people like my grandma to claim benefits without the online hurdles, or even in another language. Advocates are calling for more Post Offices to add identity validation to their offerings, given that so many already handle first-time passport applications.

“We’re never going to solve this problem for everybody with one or two tools,” said Linda Miller, a fraud risk management consultant who used to work for the government’s pandemic response watchdog.

To contact the reporter on this story: Courtney Rozen in Washington at crozen@bgov.com

To contact the editors responsible for this story: Cheryl Saenz at csaenz@bloombergindustry.com; Bernie Kohn at bkohn@bloomberglaw.com