Creating Online Accounts for Social Security, IRS, and ID.me

[myrdale]

Social Security and IRS both have websites. Since Social Security no longer mails statements each year, I had signed up for an account to view my information. One major advantage of having an account at SSA.gov is if you have a personal account locked in, there is less of a possibility of a scammer successfully signing up in your name. The same applies for IRS.gov.

Both of these sites (as well as a handful of others) now use a service, ID.me.

ID.me is NOT a government site. It is a private company. To create an account with ID.me you have to submit via text photos of your drivers license, face, and maybe passport (I didn't).

Once you have an ID.me account, your SSA.gov and IRS.gov logins are tied back to that account.

ID.me also uses Yubikey, so even if your user name and password were compromised, with out your security key, they can not get in.

There is a good chance you'll never need these services. But it doesn't hurt to lock them down anyway as another layer of protection against identity theft.

[ua_guy]

You actually have two choices for identity verification, ID.me, and Login.gov. Both act as single sign-on keys for different government sites.

While it's good to establish your credentials on those sites, as well as check the accuracy of information listed in your SSA benefit statements and earnings history, doing so comes with additional responsibility. You need to maintain the health of those credentials, use them periodically, and rotate passwords.

[myrdale]

You need to maintain the health of those credentials, use them periodically, and rotate passwords.

That applies to most all websites.

I am unaware of if they would delete your accounts after some period, months? years? of non-activity.

I've mentioned the security key option before on here. If you take advantage of that, then you have to keep up with the physical key. In my case I maintain (3). I keep the first secure in my home for daily use. I keep the second in my truck in the off chance I should need it while traveling. The third is stored off site in a safety deposit box. I register all three on any site which accepts them.

Passwords are easy once you develop and implement a system. At last count I am near 80 different log ins. While most use my email as the user name, everyone of them has a different password, which I could fairly easily determine.

On a side note discussion about password, I recently purchased a password journal from Amazon for my mother. She has the habit of recording her passwords in one of three different notebooks, or a rollerdex, or slips of paper. HOPEFULLY which this we can consolidate them all to one location so emails / facebook / banking / etc are easily recoverable as she tends to lock herself out of accounts on a regular basis.

[ua_guy]

That applies to most all websites.

I am unaware of if they would delete your accounts after some period, months? years? of non-activity.

I've mentioned the security key option before on here. If you take advantage of that, then you have to keep up with the physical key. In my case I maintain (3). I keep the first secure in my home for daily use. I keep the second in my truck in the off chance I should need it while traveling. The third is stored off site in a safety deposit box. I register all three on any site which accepts them.

Passwords are easy once you develop and implement a system. At last count I am near 80 different log ins. While most use my email as the user name, everyone of them has a different password, which I could fairly easily determine.

On a side note discussion about password, I recently purchased a password journal from Amazon for my mother. She has the habit of recording her passwords in one of three different notebooks, or a rollerdex, or slips of paper. HOPEFULLY which this we can consolidate them all to one location so emails / facebook / banking / etc are easily recoverable as she tends to lock herself out of accounts on a regular basis.

If those services are doing the right thing, the accounts should automatically lock after a period of inactivity (6 months, 1 year, etc) and require verification and password reset in order to unlock them.