ID.me asks for your Social Security number so it can find the exact person in a federal agency’s records that you’re claiming to be. The number is used for identity resolution: matching you to one specific file among millions of people who may share your name or birth date. It isn’t treated as a password or as proof of identity on its own, it’s encrypted the moment you submit it, and federal privacy law controls what the agency behind the request can do with it.
What Your SSN Actually Does During Verification
The Social Security number has a narrow job in the ID.me process. Because common names and birth dates repeat across the population, the SSN is the data point that narrows the match to one individual in a government database. That step is called resolution.
Under the National Institute of Standards and Technology guidelines that govern federal digital identity verification, knowing an SSN is explicitly not enough to prove you are who you say you are. The number helps the system locate your record; a government-issued photo ID, a selfie compared against that ID, and other document checks are what prove the record belongs to you. That is why someone who obtained your SSN in a data breach still could not pass ID.me on that number alone.
Is Giving ID.me Your SSN Required?
The requirement comes from the agency you’re trying to reach, not from ID.me itself. NIST’s updated guidelines (SP 800-63-4) permit a credential service provider to collect an SSN when it’s needed for identity resolution, but collection is not mandatory under the standard.1National Institute of Standards and Technology. NIST Special Publication 800-63-4 The guidelines also tell providers to limit how far the SSN travels during proofing, using techniques like yes-or-no attribute checks that confirm a number is valid without passing the full SSN to third parties.2National Institute of Standards and Technology. Identity Proofing Requirements – Privacy
In practice, many federal agencies still require the SSN because they use it as the primary key in their own record systems. The IRS uses ID.me for online tax transcripts and payment tools, Veterans Affairs uses it for healthcare and benefits portals, and the Social Security Administration, Treasury, U.S. Patent and Trademark Office, FBI, and Department of Health and Human Services also rely on it for at least some services. State unemployment agencies have adopted it too. Whether the SSN prompt you’re seeing is optional or mandatory depends on which agency’s service sits behind the login.
How ID.me Protects the Number Once You Submit It
Once entered, your SSN is encrypted using AES-256, with dynamic key rotation, both in transit and at rest on ID.me’s servers. The encryption uses FIPS 140-2 validated algorithms, meaning the cryptographic modules have been tested and approved under the federal security standard for such tools.3ID.me. Security, Privacy, and Compliance FIPS 140-2 is being phased out in favor of FIPS 140-3, with all FIPS 140-2 validations scheduled to move to a historical list by September 2026.4National Institute of Standards and Technology. FIPS 140-3 Transition Effort
The infrastructure itself sits inside FedRAMP-authorized Amazon Web Services data centers in an isolated virtual private cloud. ID.me holds SOC 2 Type II certification, which reflects an independent audit of how well its security controls actually work over time, and ISO 27001 certification, an international standard for information security management.5ID.me Network. ID.me Announces New Major Security Acknowledgements, SOC 2 Type II and ISO 27001 Certification Verification runs through automated systems that compare your input against encrypted records, and the company operates on a least-privilege access model, so employees are generally blocked from viewing raw sensitive data like your full SSN.
Your Rights When You Hand Over Your SSN
The Privacy Act of 1974 governs how federal agencies and their contractors handle personal information, including your SSN. Any agency asking for the number has to tell you four things: the legal authority for the request, whether providing it is mandatory or voluntary, the principal purposes for which it will be used, and the consequences of declining.6Office of the Law Revision Counsel. 5 US Code 552a – Records Maintained on Individuals That disclosure usually appears as a Privacy Act Statement shown before or during the SSN prompt. Read it. It tells you whether you can walk away from the request without losing access to the service.
If ID.me pulls credit bureau data as part of verification, for instance by asking knowledge-based questions drawn from your credit file, the Fair Credit Reporting Act adds further protection. You can see what’s in your credit file, and you can dispute anything incomplete or inaccurate. A credit reporting agency that receives a dispute must investigate and correct or delete unverifiable information, typically within 30 days.7Federal Trade Commission. A Summary of Your Rights Under the Fair Credit Reporting Act
The updated NIST guidelines also require the credential service provider to give explicit notice at the point of collection: which attributes are being stored, whether providing them is voluntary or mandatory, the consequences of refusing, any retention schedule that applies, and your right to request deletion.8National Institute of Standards and Technology. Identity Proofing Requirements – General IAL
What to Do if Your SSN Won’t Verify
A mismatch error almost always means what you entered doesn’t line up with what government records already show. Before assuming the system is broken, work through these:
- Re-enter the number slowly. A single transposed digit fails the check.
- Confirm the legal name on your ID.me profile matches the name the Social Security Administration has on file. A recent marriage, divorce, or court-ordered name change that hasn’t been updated with the SSA will read as a mismatch.
- Compare what you entered against your physical Social Security card. If the card and your memory disagree, the card wins.
- If everything matches on your end and it still fails, visit a local Social Security office to fix the discrepancy in the SSA’s own records. You can retry ID.me once that’s resolved.
If You’d Rather Not Verify Online
You have alternatives if the ID.me flow isn’t working or you don’t want to complete it online. Most of them still involve your SSN at some point, because the underlying agency requirement doesn’t change with the channel.
Video Call With an ID.me Agent
ID.me offers a live video call where an agent reviews your identity documents on camera. You’ll need an original government-issued photo ID such as a driver’s license, state ID, passport, or passport card. This path still requires entering your SSN.
In-Person Verification at USPS
Some agencies allow in-person identity proofing at participating U.S. Postal Service locations. If it’s available for the service you’re accessing, you’ll get an email with an enrollment barcode, a list of nearby participating post offices, and a list of documents to bring. No appointment, no fee. A postal associate scans the barcode and reviews your original, unexpired ID in person.9USPS. USPS In-Person Identity Proofing
Going Directly to the Agency
Agencies keep their own fallbacks. On the IRS sign-in page, selecting “What if I can’t verify my identity?” surfaces alternatives specific to the tool you’re trying to reach.10Internal Revenue Service. How to Register for IRS Online Self-Help Tools The Social Security Administration lets people who can’t use online services prove identity in person at a local office.11Social Security Administration. What to Know about Proving Your Identity For most federal agencies, a physical office visit remains available as a last resort, though wait times vary.
Removing Your SSN and Other Data From ID.me
You can request deletion of your data or close your ID.me account after the fact. Sign in, go to “Sign In & Security,” then “Privacy.” Under “Manage my data,” pick “Remove my data” and follow the prompts to close your wallet. You’ll be asked to confirm and pick a reason. Biometric data such as the selfie captured during verification can be deleted separately through the same Privacy settings.12Treasury.gov. ID.me Guide for Recipient Organizations to Register and Enable Multi-factor Authentication
One caution before you delete: closing the account may cut off your access to any government service that uses ID.me for sign-in. Make sure you have another way in first.