ID.me does use facial recognition to match against databases, CEO admits

ID.me, a facial recognition company that has been contracted by the IRS to verify taxpayers’ identity, uses a powerful facial recognition technique to match faces against a larger database, despite earlier claims to the contrary.

According to a LinkedIn post made by CEO Blake Hall Wednesday and spotted by reporters at CyberScoop, the company does use a technique known as one-to-many face matching in which a target face is compared against a database of other known faces to find possible matches.

This contradicts previous public statements made by the company, including a press release issued just days ago, where comments attributed to Blake Hall said the company used only a less powerful form of facial recognition known as one-to-one face matching.

In one-to-one matching, a target face is compared only with images of the same face to determine if they match — a process “comparable to taking a selfie to unlock a smartphone,” Hall said in the press release. He added that the company “does not use 1:many facial recognition, which is more complex and problematic.”

But in the new comments, Hall appeared to admit that this previous statement was false and said the discrepancy was due to a reluctance to give details about operational practice that could be exploited by criminals.

“ID.me uses a specific ‘1 to Many’ check on selfies tied to government programs targeted by organized crime to prevent prolific identity thieves and members of organized crime from stealing the identities of innocent victims en masse,” Hall wrote in the LinkedIn post. “We avoid disclosing methods we use to stop identity theft and organized crime as it jeopardizes their effectiveness. Criminals are constantly adapting their tactics, and they use information about our protections to harm innocent people.”

The latest backtrack over the nature of the technology used by ID.me is unlikely to reassure critics of the company, who have raised concerns over the planned use of its services by the IRS. In 2021, numerous complaints emerged from people trying to sign up for unemployment benefits who reportedly had applications put on hold after ID.me failed to identify them correctly, with some suggesting that people of color were more likely to be misidentified.

“This basically is putting a private company between people and the government services that they need,” Jay Stanley, a senior policy analyst with the ACLU, told Axios after the new IRS verification program was announced.