A new Government Accountability Office (GAO) audit found the Internal Revenue Service (IRS) has not exercised sufficient oversight of its digital identity-proofing program which is central to safeguarding taxpayer information across more than 30 online applications. Identity proofing for most IRS applications requires personally identifiable information to be collected from taxpayers and businesses to verify their identities.

At the core of GAO’s audit report is IRS’s partnership with ID.me, a private credential service provider tasked with verifying users’ identities before granting access to services that may involve sensitive data such as tax filings, payments, and refunds.