Is ID.me safe in 2025? A dive into security measures, risks, and alternatives

What is ID.me and how does it work? 

Founded in 2010 by former Army Ranger Blake Hall and Matt Thompson, ID.me is an identity verification company based in McClean, Virginia that is used by both government and private organizations. 

The service has over 150 million users; and 20 federal agencies, 45 state government agencies, more than 70 healthcare organizations, and over 600 consumer brands use ID.me to verify personal identities. 

You might be prompted to create an ID.me account to verify your identity for a federal agency – such as the IRS or Department of Veterans Affairs – so you can access services or benefits. You can also use ID.me to create a digital identity wallet that can be used to verify community membership for retail discounts and cash back programs – think military, nurse, teacher, and student discounts.

Here’s an overview of the verification process: 

• Once a website needs to verify your identity, you’ll have the option to create an ID.me account
• Once it’s created, you’ll need to choose between self-service verification (uploading a selfie video) or live video call (though some organizations only allow self-service)
• Next, upload your ID document (driver’s license, state ID, passport, etc.)
• Take a video selfie OR do a live video call with an ID.me representative
• You’ll need to provide additional information, such as your Social Security number
• Finally, review your details and give ID.me consent to share your information with the organization

ID.me uses facial recognition software to verify your identity, so you only need to go through this process once to use your ID.me account with any site that accepts it. Once the initial verification is completed, you’re usually only required to log into your ID.me account for verification. Reverification may be necessary if your account details change, you don’t use the service for a long time, ID.me detects a new device/ location, or the establishment that initiates the verification has stricter requirements.

How secure is ID.me? 

ID.me offers robust security features designed to protect your identity and keep your sensitive details out of the hands of hackers, scammers, and other bad actors, including:

• Encryption: all personally identifiable information is protected with AES 256-bit encryption.
• NIST сompliance: ID.me meets rigorous security guidelines set by the National Institute of Standards and Technology.
• MFA and biometric authentication: multi-factor authentication and biometric verification create a secondary line of defence and help keep your account safe even if your password is compromised.
• Third-party audits & certifications: the company is aligned with federal identity frameworks like FICAM and has earned SOC 2 Type II certification for its data protection practices.
• Do Not Sell Policy: ID.me explicitly states that it doesn’t sell user data. It also requires users to provide consent before sharing data, and you can revoke an organization’s or app’s access at any time.
• Data removal: the platform allows you to delete your selfie image and biometric information or close your account and purge the associated data from active use in their databases at any time (though some data may be retained for up to three years for fraud prevention and government auditing).

Common concerns and complaints

Despite its strong security practices, there are still some credible concerns and complaints about ID.me. 

Hacker target

ID.me holds a vast amount of sensitive data – including Social Security numbers, biometric info, and everything listed on government-issued IDs – that would be ultra-valuable to hackers and scammers. Even though ID.me has not yet fallen victim to a true hacker data breach, it has previously come under fire for employees leaving user data exposed on internal dashboards.

Facial recognition controversy

ID.me faced significant backlash over its facial recognition software, which the American Civil Liberties Union (ACLU) said was problematic due to a lack of offline identity verification options, outsourcing a core government function, and biased biometrics that could falsely misidentify people by race or gender. In addition, ID.me originally stated it used one-to-one facial comparisons (comparing uploaded documents to live selfies), when in fact it used one-to-many, comparing faces against a database of photographs – which is less accurate and more prone to ethical scrutiny.

Account lockouts & customer service bottlenecks

Multiple media outlets have reported that ID.me has failed to accurately verify identities, locking people out of key government services such as unemployment benefits. Many of these people are stuck in verification loops or unable to recover their accounts, especially during peak demand, or face long wait times for video verification or to resolve ID issues.

Potential for fraud

Facial recognition isn’t perfect, and in 2022, a criminal was able to use a wig and a fake ID to trick ID.me into granting him access to $900,000 in unemployment benefits.

Poor reviews

Every online service will have its share of negative feedback. However, a service that deals with giving access to government benefits is expected to do better—maintaining a strong ratio of positive to negative reviews, where user complaints are the exception, not the norm. Nevertheless, ID.me only has a 2.7-star aggregate rating from over 3,800 reviews on Trustpilot, where users report frustration with the verification process and poor customer support, including getting AI chatbots instead of live representatives. ID.me reviews on other platforms are similar, with ratings usually below 3 (out of 5) stars.  

Tips for using ID.me safely

If you need to use ID.me, follow these tips to stay safe and protect your identity: 

• Strong password and 2FA: Use a strong, unique password and enable two-factor authentication. You can use an online password generator to create a random password that is less likely to be guessed by scammers.
• Verify ID.me’s URL: Always make sure you’re on the correct website and not a phishing clone. Carefully review the URL to make sure it’s https://www.id.me.
• Only use when necessary: Only upload data to the service if absolutely necessary. If an agency offers alternative verification methods, use those. Never connect your ID.me account to non-essential services.
• Keep documentation & screenshots: Take screenshots of your account and confirmed verification as proof of your identity in case your account gets locked or you need support.
• Don’t use public WiFi: Only use ID.me from your own private WiFi network and avoid public ones because data could be intercepted by hackers.
• Delete your ID.me account: If you no longer need your ID.me account, delete your information and close it.

Alternatives to ID.me

Some organizations exclusively require ID.me for verification, so you can’t always choose an alternative method. However, other organizations do offer multiple verification options, giving you a choice of which to use. 

Here are some of the most popular identity verification services, what they’re most commonly used for, and what differentiates them from ID.me. 

Login.gov

Login.gov makes it easy to access multiple government websites with a single login. Like ID.me, it’s privacy-focused and complies with NIST standards. Unlike ID.me, it’s run by the government and does not use facial recognition to verify identities. Login.gov partners with over 50 federal, state, and local agencies, including USAJOBS, the Social Security Administration, the Department of Veterans Affairs, USDA, the Department of Homeland Security, and the U.S. Army. 

CLEAR

CLEAR uses biometrics such as fingerprints, facial recognition, and iris scans to verify personal identities for airport security, stadiums, and arenas. Unlike ID.me, it’s not useful for federal programs, but it can speed up the security line at major airports such as Chicago O’Hare and sporting venues like Allegiant Stadium in Las Vegas.

Jumio, Entrust & Trulioo

These commercial services use biometrics, document analytics, AI, and other technologies to verify identities. They’re often used in the fintech and crypto industries, but they’re less relevant for public service access. 

How Onerep helps protect your sensitive information

As secure as platforms like ID.me may be, we’ve seen that identity verification can be bypassed by scammers if they know your personal details. One prominent source of such details is public data brokers AKA people-search sites — they collect your information from numerous sources and publish it online, often for free.  That information includes a wide range of sensitive details from your full name and birthday to your contact info, family members, and income. This data can be used to impersonate you, access your accounts, make purchases in your name, or even steal your identity. 

Onerep is a data removal service that automatically deletes your personal information from 232 people-search sites. After the initial removal, Onerep monitors the websites to make sure your data doesn’t get republished; and if it does, the service automatically begins the opt-out process again. Thus, Onerep protects your sensitive information by continuously keeping it off people-search sites and out of the hands of bad actors.

FAQs

Is ID.me legit?

Yes, ID.me is a legitimate identity verification service trusted by over 65 government agencies, 70 healthcare organizations, and hundreds of consumer brands.  

What is ID.me used for?

ID.me is used to verify identities for access to government and healthcare services. It’s also used to verify group membership – for example, students, teachers, and military members – for retail discounts and cash back programs.

Can I delete my ID.me account? 

Yes, you can delete your ID.me account by logging in and selecting Sign In & Security > Privacy. Browse to “Manage my data” and choose “Remove my data.” Then, follow the prompts to close your account. Note that if your account is suspended, you won’t be able to close it, but you can contact ID.me’s customer support to request a review. 

Is verify ID.me safe?

Verify.id.me is a legitimate subdomain of ID.me used during the identity verification process. While it’s generally considered safe to verify your identity with ID.me, it’s not without risk. ID.me has a massive database of sensitive user information, making it a valuable target for hackers. In addition, at least one fraudster has tricked the service into allowing access to someone else’s government benefits. 

Is ID.me safe to give SSN?

You can share your Social Security number with ID.me during the identity verification process (it’s likely required). The service has robust security measures designed to protect information. However, understand that there is always a risk to sharing SSN with online services, as not a single one is completely immune to cyberattacks.