DOGE allies want more online identity verification despite its mixed efficacy
ArtemisDiana/Getty Images
By
Natalie Alms
New testing at DHS shows a wide range in the performance of online identity proofing systems. Some simply don’t work well.
Some affiliates of billionaire Elon Musk’s U.S. DOGE Service are pushing for the government to require identity verification before paying out government benefits, as part of the administration’s fight against fraud.
Just this week, the Social Security Administration announced new requirements for people applying for benefits by phone to verify themselves online or in person, sparking concerns about access as the agency sheds employees and shutters offices.
Meanwhile, Rep. Marjorie Taylor Greene, R-Ga., called for more identity verification software on federal payment processors, citing claims that doing so could save a trillion dollars a year, although that savings forecast lacks evidence. Greene chairs a DOGE-focused subcommittee.
Earlier this month, a Musk associate in the General Services Administration also called the government’s digital identity proofing system, Login.gov, “a critical part of Government-wide efforts to promote efficiency and fight fraud.”
New testing results from the Department of Homeland Security’s research arm, however, show that the technology used to identity proof people online isn’t always effective.
Digital identity verification solutions that require people to take a photo of their physical ID and a selfie to prove that they are who they claim to be proliferated across some benefit programs during the pandemic.
The government did face legitimate problems with identity theft-fueled fraud in some programs. The Government Accountability Office estimated that up to $135 billion in unemployment went out the door to fraudsters during the pandemic, with identity fraud being a “major contributor.”
One major factor in that spike, however, was Congress’ decision to initially not require documentation at all when it set up a new jobless aid program for gig workers during the pandemic, opening the door for bad actors.
DHS tested each part of the process for commonly used digital identity checks — the technologies used to verify IDs, match selfies to photos of those IDs and check that someone isn’t spoofing the system.
Of over 3,000 combinations of different technologies for each of the three steps, only 5% worked at least 90% of the time in allowing legitimate, real people to successfully complete the process, said Arun Vemury, director of the biometric and identity technology center at the Science and Technology Directorate.
His team found that, among systems trying to match selfies with ID photos, just over half of the systems matched the pair over 99% of the time, although the best system matched 100% of documents to selfies.
Even in terms of rooting out bad actors, DHS found that only 63% of the tested systems rejected 99.9% of imposters.
As for detecting fake IDs from real ones, “the error rates were quite large,” said Vemury — so large that DHS didn’t even release details so as not to inform bad actors’ efforts. Physical licenses aren’t necessarily made with security features meant to be validated online, as opposed to in person.
This isn’t the first time testing has shown a wide range in the performance of digital identity systems. When the government teamed up with academia to test five commercial solutions last year, only two produced equitable results across different demographics like race and ethnicity.
Even companies providing digital identity verification don’t always know how well their solutions work. They often rely on feedback from their customers on how much fraud is getting through or how many real people are being blocked by the system as they try to find the right balance of both, said Vemury, who will be continuing further testing meant to push industry to improve these types of systems.
A question of savings
Claims of what could be saved with more or better identity proofing are also hard to verify.
Greene posted that “nearly $1 TRILLION dollars per year of fraudulent and improper payments could be saved simply by putting identify verification software on federal government payment processors.” The source: Haywood Talcove, CEO of LexisNexis Risk Solutions for Government, one of the vendors that support Login.gov.
During a DOGE subcommittee hearing last month, Talcove said that “between federal, state, and local government … you can save $1 trillion a year by simply putting in front-end identity verification, eliminating self-certification and monitoring the backend of the programs that are providing the benefits.”
He also claimed that $1 trillion went out the door to fraudsters during the pandemic. LexisNexis didn’t provide details on how Talcove arrived at these numbers.
In terms of what’s lost to fraud caused by identity issues, the Government Accountability Office doesn’t have an estimate for fraud losses across pandemic programs, but it has estimated that up to $521 billion could be lost to fraud annually. It’s not clear how much of that estimate would be due to identity theft issues in particular, Johana Ayers, the managing director of the Government Accountability Office’s forensic audits and investigative service, told Nextgov/FCW over email.
Federal agencies report improper payments — a category that includes agency and recipient mistakes, not just fraud — but it’s also currently not feasible to estimate what portion of improper payments are due to identity-related issues, she said, as agencies can’t report identity issues as a “root cause” for these improper payments.
As for what could be saved annually, more checks could help, but they’d also cost money to implement. It’s not immediately known what they’d save, said Ayers.
At SSA, the majority of overpayments aren’t due to fraud, said Kathleen Romig, the director of Social Security and disability policy at the Center on Budget and Policy Priorities. The agency recently eliminated the option of fully applying for benefits over the phone, requiring online or in person identity checks, but phone fraud isn’t a major problem for SSA, she said.
Big picture, when a real person is rejected by one of these online identity proofing systems, it’s easy to think that the system caught a fraudster, said Vemury, noting that there’s often an assumption that technology is right.
“If you make the friction really high, people are just not going to follow through,” he continued, “and it's hard to know if something was a fraud attack or just somebody who kind of just gave up on the process.”
If you have a tip you'd like to share, Natalie Alms can be securely contacted at nalms.41 on Signal.
NEXT STORY: Senate Democrats want details on DOGE and DHS attempts to access IRS data