IRS Proposal Could Turn Taxpayer Face Scans Into Long-Term Fraud Database

The Internal Revenue Service (IRS) began to require taxpayers use the ID.me facial recognition system to access certain IRS online services in 2022. The tax collection agency is now considering a proposal which would allow ID.me to retain taxpayers’ biometric data for as long as an account remains active and then for up to 36 months after the account is deleted.

While the IRS proposal would expand the retention and use of the biometric data, ID.me is a private contractor. The firm recently updated their own privacy policy with stipulations which also advance similar objectives – data retention and data use.

“…the IRS proposal appears to turn what had been presented as a tightly limited identity-proofing process into a longer-term fraud investigation archive,” Biometric Update said. “Instead of deleting biometric scans soon after verification, ID.me would preserve the material so investigators could later determine whether a taxpayer account was created fraudulently or whether the same biometric identity was used across multiple suspicious accounts.”

The change would fundamentally alter the nature of the face scan, moving from basic identification verification to a system which can identify fraudulent and criminal activity – effectively subjecting users to an investigation each time they use the service.

“The proposal also appears to involve one-to-many biometric matching, a more expansive form of facial recognition than simple identity verification. In a one-to-one match, a system checks whether a selfie matches the face on a driver’s license or other identity document,” Biometric Update said. “In one-to-many matching, the system compares a face against a database of other faces to determine whether the same person appears elsewhere. Privacy advocates have long viewed that distinction as critical because one-to-many matching moves a system from identity confirmation toward biometric searching.”

Under the proposal, the retained facial recognition data could be accessed by the government as part of law enforcement operations, or through IRS inspector general investigations, or through legal processes.

“The proposal reflects a growing concern inside the federal government that identity fraud is becoming harder to detect as criminals use stolen personal information, synthetic, and AI-generated images to impersonate taxpayers,” Biometric Update said.

Alex Jones Live has recently reported on the widespread proliferation of fraud in the digital domain, particularly medical system data breaches which compromise personal, financial and biometric information of affected patients and medical staff.

The industry’s reaction to the problem of digital fraudulent activity has been to increase the reliance on digital systems, not curb their use. Digital ID and the collection of even more biometrics is being put forward as a solution to digital data and biometrics being accessed by unauthorized parties.

Notably, the digital identification and biometric database system used by the IRS is not a wholly-owned government asset. Rather, ID.me is a private contractor which must be used to access online government services.

“The proposed action has raised questions about how much biometric information Americans should be expected to give a private contractor to access government services online,” Biometric Update said.

The private contractor ID.me updated their public privacy policy on May 7. The big change is that personal information provided to them in connection with a public sector agency verification (like for certain IRS online services) may be retained for up to three years after the account is closed, unless regulations require a shorter time. It also said ID.me can retain data tied to high-risk transactions in the government and health care settings to prevent fraud and for government audit purposes.

Thus, even if the government doesn’t expand biometric data use regulations, private contractors still might.