Short answer: ID.me is a legitimate identity-verification and sign-in company, but scammers frequently impersonate it. A message that mentions ID.me is not automatically genuine. The safest test is to open the relevant agency or company website yourself, start the sign-in there, and use its ID.me button. Never give a caller or message sender your ID.me password, multifactor-authentication (MFA) code, payment, or remote access.
What ID.me is—and why a government site may use it
ID.me provides identity proofing and authentication. It helps a participating organization decide whether you are the person you claim to be, then lets you sign in to that service. Depending on the agency and verification level, the process can use a government photo ID, Social Security number or other identifying information, a selfie or video selfie, phone and SIM signals, automated document and face matching, a live video call, and MFA. ID.me describes its methods at its identity-verification page.
ID.me says more than 156 million people have interacted with its services and that its network includes federal and state agencies. Those are company-reported figures, not an independent audit; its company information is at id.me/about.
A government agency can contract with a private identity provider. The redirect is therefore not, by itself, evidence of fraud. The Government Accountability Office (GAO) reports that the IRS uses ID.me for many taxpayer identity-proofing applications and that federal agencies use a mix of Login.gov and commercial providers, depending on technical and assurance requirements (IRS oversight report; federal provider review). A legitimate ID.me site can also end in .me; ID.me identifies www.id.me as its official site.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to verify an ID.me request safely
- Type the agency’s address into your browser or use a bookmark you already trust. Do not begin with an unsolicited email, text, social-media message, or caller-provided link.
- Sign in to the agency or company and select its own ID.me button or link.
- On the resulting official flow, sign in to an existing ID.me Wallet or create one.
- Set up or complete MFA, then review the consent screen showing what will be shared.
- Upload only the documents and information that the official flow requires. Complete the selfie or other available method.
- If self-service fails, use the video-call or in-person option presented by the official process. Do not send documents to an unofficial “helper.”
These steps follow ID.me’s current self-service instructions at its verification guide. ID.me lists a camera-equipped smartphone, a government photo ID (such as a U.S. driver’s license, state ID, passport, or passport card), and a Social Security number as common requirements. Exact requirements vary by agency, country, document, phone number, and assurance level.
Red flags that an ID.me message is a scam
ID.me’s guidance on official communications and fake messages is at this communications page and this scam-warning page. Treat the following as stop signs:
| Red flag | Why it matters |
|---|---|
| “Verify within 24 hours or lose your benefits” | Urgency and threats are common social-engineering tactics. |
| A request for your ID.me password or MFA code | ID.me says support representatives will not ask for either; a code can let an attacker finish signing in. |
| A request to email or text a photo of your ID | Normal document submission occurs inside the official verification flow. |
| A request for only a selfie or a video call, without creating or using your own Wallet | ID.me warns this can be used to create or falsely verify a Wallet in someone else’s name. |
| An unsolicited social-media direct message, automated call, or “support” contact | These are channels ID.me identifies in impersonation scams. Support-initiated calls should involve a live person, not an automated demand for sensitive information. |
| Payment by gift card, cryptocurrency, wire, or payment app | An unknown person should not require payment to verify your identity. |
Misspelled, look-alike, or non-id.me domain |
It may be phishing infrastructure. A plausible-looking address still is not proof of authenticity. |
| Remote-access software or a request to read back a one-time code | The caller may be trying to take over your device or authenticate as you. |
ID.me says official email uses an @id.me address or certain stated subdomains such as @mywallet.id.me, while a .com address claiming to be ID.me deserves suspicion. Sender addresses can be spoofed, however, so independent navigation remains the strongest check. Never let an online acquaintance, “agent,” or family member use your credentials or MFA code to create or verify your Wallet.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What data ID.me may collect
Identity proofing requires more information than an ordinary newsletter account. ID.me’s privacy policy describes collection of names, dates of birth, contact details, Social Security numbers or other government identification numbers, copies of government IDs, photographs, and biometric information. Its business materials also describe document, face, phone, and SIM-related checks.
ID.me says it does not sell, rent, or trade personal information. The policy also describes sharing with organizations involved in identity or eligibility verification and with entities needed to provide its services. You control consent for sharing in the account portal, can review authorized applications, revoke an application’s access, and destroy a credential. Those controls reduce some exposure but cannot remove the risks of transmitting, storing, processing, or concentrating highly sensitive identity data. They also do not promise that every legally retained record disappears immediately; consult the current policy and the requesting agency’s notice.
Before consenting, confirm that the organization actually requested verification, that the fields are proportionate to the service, and that you understand which organization will receive them. If you object to facial or biometric checks, ask the agency whether it offers a non-biometric, video, in-person, mail, or other route; availability is service-specific.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Is ID.me secure?
ID.me states on its security page that it uses encryption for data in transit and at rest, AES-256-related controls, role-based access, MFA, FedRAMP-authorized hosting, and SOC 2 and other certifications or accreditations. These are the company’s stated controls and evidence of a security program—not a guarantee that a breach, misuse, vendor failure, or account takeover is impossible.
Independent oversight shows both controls and unfinished work. In a report published June 11, 2025, GAO found that the IRS had issued privacy directives to ID.me, performed data-validation checks, and held regular vendor meetings, but had not established sufficiently measurable performance goals or documented routine procedures for evaluating the provider. GAO also noted that ID.me’s AI use was not listed in the IRS inventory reviewed. These are governance weaknesses, not a finding that ID.me is a fraudulent company: GAO-25-107273.
A separate GAO review says a 2024 FedRAMP assessment found certain data-security practices incomplete because of outdated encryption methods, while a 2025 assessment found that ID.me had updated its methods and fully addressed that practice: GAO-25-107000. That is a historical finding followed by reported remediation, not proof that the service is currently unsafe—or risk-free.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if you clicked, submitted data, or suspect a fake Wallet
- Stop communicating with the sender. Do not click more links, open attachments, pay, provide further information, or grant remote access.
- Visit id.me and the relevant agency by typing their addresses manually.
- If you entered your password on a suspicious site, change it immediately to a unique password. Add another MFA method; use a passkey or NFC security key where supported.
- Review account activity and authorized applications. Report suspected fraudulent Wallet creation or unauthorized access through ID.me’s suspicious-activity guidance. Do not upload government-ID documents to the report form unless its official instructions specifically require them.
- Contact the agency involved—such as the IRS, Social Security Administration, unemployment office, or Veterans Affairs—using contact information from its official website.
- If your personal information was exposed, consider a credit freeze or fraud alert and use the appropriate official identity-theft reporting channel.
An unexpected password-reset email
An unsolicited reset email can mean that fraudsters are trying credentials exposed elsewhere; it does not by itself prove that your ID.me Wallet was hacked. Change the password, strengthen MFA, review activity and authorized applications, and contact ID.me if you see unauthorized access or account creation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.ID.me and Login.gov: what choice do you have?
Login.gov is government-operated, while ID.me is a private contractor. They may support different assurance levels and agency systems. Some services offer a choice; others specify one provider, so you cannot always substitute Login.gov. GAO has also identified recommendations and technical or NIST-alignment issues involving Login.gov (provider review; technical review). Neither service is a universal “safe” or “unsafe” answer.
Compare the specific agency’s requirements, the data requested, recovery and accessibility options, and whether a legitimate alternative exists. If you do have a choice and prefer a government-operated sign-in, select Login.gov; if the service requires ID.me, verify the workflow independently and protect the resulting Wallet with strong MFA.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Before-you-verify checklist
- You reached the request after signing in directly to the intended agency or company.
- The URL is an official ID.me address reached through that trusted site.
- You recognize the organization and the requested information is proportionate.
- No unsolicited person is pressuring you, requesting payment, a password, an MFA code, or remote access.
- You read the consent screen and know which organization receives the information.
Frequently Asked Questions
Is id.me a real website?
Yes. ID.me is a real identity-verification company, and its official site is www.id.me. That does not make every message using its name genuine; start from the relevant agency’s website instead.
Will ID.me ask for my Social Security number?
A legitimate self-service flow may request it, along with a government photo ID and camera-equipped phone. Requirements vary by agency and verification level. Provide it only inside the official flow you reached independently.
Does ID.me ask for an MFA code?
The service uses MFA, but ID.me says its support representatives will not ask you to disclose your password or MFA code. A caller demanding a code is a major warning sign.
What if I cannot pass verification?
Use the video-call or in-person option shown in the official flow, or ask the agency about another method. Do not send documents to an unofficial helper.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Can someone create an ID.me account in my name?
Impersonators may try. Report suspected fraudulent Wallet creation through ID.me’s official suspicious-activity process, secure your email and passwords, contact the affected agency, and consider a credit freeze or fraud alert if identity information was exposed.
Is Login.gov safer than ID.me?
There is no universal verdict. Login.gov is government-operated, while ID.me is private; agencies may require different providers, and GAO has identified issues involving both. Use the legitimate option the agency supports and compare the data and recovery choices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
