A Blog by Jonathan Low

 

Feb 15, 2022

IRS Facial Recognition Exploited By Scammers Who Grab $2.5 Million

The IRS has backed off of requiring citizens requesting documents online to submit to facial recognition, especially since the Service's own FR contractor couldn't distinguish real from fraudulent. 

Back to the lab...JL 

Tim Cushing reports in Tech Dirt:

The system has been exploited by scammers. Federal prosecutors said a New Jersey man was able to verify fake driver’s licenses through an ID.me system in California as part of a $2.5 million unemployment-fraud scheme. Humans might have been able to shut this fraud down. But ID.me doesn't have the human personnel on hand to backstop questionable calls by its facial recognition and is relying on mostly unproven tech to decide who is or isn't entitled to government benefits. Unfortunately, the IRS also suffers from a shortage of humans and now they will be expected to do more with less.

ID.me -- the facial recognition company that has managed to snag several lucrative contracts -- has gotten the brushback from perhaps its most lucrative government partner, the IRS. ID.me promised government agencies better control over distributions of unemployment benefits and other payments to the public, citing its own (unexamined) prowess at recognizing faces as well as an astounding claim that governments have been duped out of $400 billion in unemployment benefits by fraudsters -- a claim it has yet to back up with actual evidence.

That the pitch worked so well isn't a surprise. After all, governments hate to give money to taxpayers and most governments have deficits they'd like to trim down. Anyone promising millions in savings is bound to be given a second, third, or fourth chance even after it's become obvious claims about fraud are, at best, dubious, and that the company can't really do the job it promised to do: eliminate fraud.

Misspending tax dollars is a national pastime. The bizarre embrace of ID.me is no exception. The IRS may have walked back its reliance on ID.me for identity verification, but problems persist. States are still relying on ID.me, even if the feds aren't. And ID.me doesn't seem to have the personnel on hand to backstop questionable calls by its facial recognition tech, as Corin Faife reports for The Verge.

Internal documents and former ID.me employees say the company was beset by disorganization and staffing shortages throughout 2021, as shortcomings in the automated systems created tensions among the company’s workforce, particularly the human verification workers who have to step in when the algorithms fail. Even now, the company plays a central role in how claimants access benefits across the United States — working on behalf of 27 state-level uninsurance employment programs to verify applicants — and the underlying issues are far from settled.

Current and former employees who spoke to The Verge paint a picture of a company described as being in “permanent crisis mode,” changing policies rapidly to keep up with fluctuating demand for its services and fight a slew of negative press. In particular, they say a lack of human review capacity has been a chokepoint for the company, leading to stress, pressure, and a failure to meet quality standards.

This verifies accusations raised earlier by other critics of ID.me -- critics who were forced to become users of faulty systems due to several states making ID.me the barrier between claimants and their benefits. Those locked out of their benefits complained the company offered few options for review of their supplied info. ID.me claimed it was performing reviews on the regular, but social media comments suggested this simply wasn't true. Actual humans were nearly impossible to reach. This report confirms what was suspected: the company simply did not have enough humans employed to deal with the problems generated by its verification processes.

Claimants were given no option but to put all their biometric eggs into one malicious hacker-tempting basket owned and operated by ID.me. When glitches separated people from their payments, the company's CEO blamed users for not being better at using an entirely new verification system. When these problems persisted, the CEO claimed most false negatives were actually the company thwarting fraudsters.

But ID.me can be duped. And it can be duped fairly easily it seems. A Washington Post report shows one person illicitly secured nearly $1 million in unemployment benefits using little more than an extremely obvious wig.

[D]espite the scale of the data gathering by the company, ID.me, revealed in newly released records, the system has been exploited by scammers. Federal prosecutors last month said a New Jersey man was able to verify fake driver’s licenses through an ID.me system in California as part of a $2.5 million unemployment-fraud scheme.

ID.me has pointed to the scam as an example of how well its systems work, noting that it referred the case to federal law enforcement after an internal investigation. But the criminal complaint in the case shows that ID.me’s identification systems did not detect bogus accounts created around the same day that included fake driver’s licenses with photos of the suspect’s face in a cartoonish curly wig.

I mean… [images via DOJ criminal complaint]:

Humans might have been able to shut this fraud down immediately. But it's clear ID.me doesn't have enough humans and is relying on mostly unproven tech to decide who is or isn't entitled to government benefits.

The IRS's walk-back on ID.me use may end up causing at least as many problems as it solves, unfortunately. The IRS also suffers from a shortage of humans and now they will be expected to do more with less outside assistance as tax return season shifts into high gear. By the time the IRS was forced by public and Congressional pressure to make a change, it was already up to its eyeballs in returns. Taxpayers can now expect delays ranging from several weeks to several months at least partially as a result of the agency's regrettable decision to do business with ID.me and its questionable track record.

1 comments:

David Millar said...

amazing website, this is really some good quality content. loved the way you explained through words keep writing the best article
Red Cobra Kai Jacket

Post a Comment