US Social Security becomes major test of digital identity at scale

The Social Security Administration (SSA) has reached 105 million my Social Security accounts, placing access to the agency’s online services behind a digital identity layer as the federal government moves to make Login.gov a common gateway for covered online public services.

SSA is becoming more than a large agency promoting online self-service. It is emerging as one of the largest tests of whether the federal government can make robust digital identity verification a routine gateway to public services without making that gateway an obstacle for the people those services are intended to reach.

The agency’s latest formal target is considerably more modest than the one SSA Commissioner Frank Bisignano set less than a year ago.

SSA’s 2026-2030 strategic plan established an Agency Priority Goal of 110 million my Social Security accounts by the end of fiscal 2027. The plan projected 105 million accounts by the end of fiscal 2026. The agency has now reached that projection, an SSA spokesperson told Nextgov/FCW.

That contrasts sharply with Bisignano’s earlier goal of reaching 200 million account holders by the end of calendar 2026. SSA publicly announced the target in November 2025, saying it wanted to build on nearly 20 percent growth in online transactions during the previous fiscal year.

SSA has not said it abandoned the larger ambition. An agency spokesperson told Nextgov/FCW that SSA was still striving for 200 million my Social Security account holders but did not provide a new deadline.

The numbers, however, tell only part of the story. SSA’s digital-first strategy is also turning one of the federal government’s largest public-facing programs into an enormous practical test of digital identity proofing.

As of June 7, 2025, SSA no longer allows access to its online services with the agency’s old Social Security username and password.

Users must sign in through Login.gov or ID.me, and those who have not previously established the necessary credentials must verify their identity with the provider they select, according to SSA’s account guidance.

SSA describes Login.gov as best for most users in the U.S. and ID.me as serving users inside or outside the country. Customers with a foreign mailing address are specifically directed to create an ID.me account.

Both services provide identity verification and access to my Social Security, making identity proofing increasingly inseparable from SSA’s effort to move interactions online.

For one of SSA’s two enrollment paths, biometrics are explicitly part of that process.

An SSA guide for creating an account with ID.me instructs users to upload images of the front and back of a government-issued identification document and then take a selfie. The guide says ID.me uses the selfie to verify that the user is the person depicted on the ID.

Login.gov requires a more careful distinction.

The government identity service offers several service levels. Its basic identity verification service requires users to provide identity information and identification but does not use facial matching and does not meet the National Institute of Standards and Technology’s Identity Assurance Level 2 standard.

Login.gov’s enhanced IAL2 service adds a selfie and facial matching, comparing the selfie with the portrait on the user’s identification document. Users may also be offered in-person identity verification at participating U.S. Postal Service locations.

SSA’s current public account instructions say Login.gov users need government-issued photo identification, but they do not state that SSA requires Login.gov’s enhanced facial-matching service for my Social Security.

Login.gov’s privacy and identity verification policies say a self-photograph is required when a partner agency requires verification through biometric comparison.

An August 31 Office of Management and Budget (OMB) memorandum designates Login.gov as the universal sign-on for covered public services and directs agencies to use its identity verification service for covered public-facing services that require identity proofing, unless an agency determines that Login.gov cannot meet requirements specific to the user population, risk profile, or operations involved.

The policy does not prohibit agencies from keeping other identity providers.

OMB says agencies may also offer another authentication or identity-verification solution when Login.gov cannot fully meet a particular use case or when doing so is necessary to avoid imposing additional burdens on a significant population of users.

The memo specifically notes that people living abroad may have limited official records that make identity verification more difficult and may warrant another solution. SSA currently directs customers with foreign mailing addresses toward ID.me.

Agencies using alternatives must promote Login.gov as the default for new accounts among populations it can serve and routinely reevaluate whether other solutions remain necessary. OMB also directs agencies to phase out alternatives that do not meet its specified exceptions.

The directive acknowledges a problem that becomes more significant as digital identity systems become gateways to government benefits.

Agencies must consider how their identity requirements affect users and avoid friction that is not justified by the risk of a transaction.

OMB specifically directs agencies to monitor measures including verification pass rates, abandonment rates, and completion times to identify user burden or limitations on access.

Agencies should consider those measurements alongside fraud and security metrics and privacy considerations.

Nextgov/FCW found examples of those barriers among SSA users.

Legal aid attorneys described clients having difficulty with ID.me video proofing and others waiting for Login.gov verification codes by mail.

The publication also reported that identity verification services can present difficulties for people without current photo identification, people who are unhoused, and those whose identities cannot be successfully established through data matching.

Login.gov provides in-person verification at participating U.S. Postal Service locations for eligible agency services, while ID.me provides a remote video call option for people who cannot complete automated verification.

Nextgov/FCW identified both as alternatives available to people having trouble establishing my Social Security accounts.

However, an AARP survey published in August suggests unsuccessful account creation is not the main reason tens of millions of Americans have yet to establish an SSA account.

The survey, based on a nationally representative sample of 1,390 U.S. adults, found that 44 percent said they had a my Social Security account, ranging from 66 percent of people 65 and older to 29 percent of those ages 18 to 49.

Among respondents who said they did not have an account or were unsure, 90 percent said they had never attempted to create one. Only 3 percent said they had tried and were unable to do so.

Those numbers suggest SSA faces two different problems as it tries to expand the portal: persuading people who see little immediate reason to create an account and ensuring that those who do need access can successfully pass identity verification.

The second problem is likely to grow in importance. SSA’s strategic plan says the agency intends to make nearly all transactions available through my Social Security or state-of-the-art telephone services and wants its online offerings to become safe and convenient enough that customers prefer conducting their business online.

The agency is already adding more substantive services to the account. In July, SSA added online submission for several disability adjudication forms, expanded online case-status tracking at the hearings and appeals levels, and made additional hearing-related notices available via My Social Security.

Moving from 105 million accounts to the commissioner’s still-stated aspiration of 200 million would mean attracting another 95 million accounts into a system in which access now depends on federated sign-on and identity-proofing services.

Meanwhile, OMB is pushing the rest of government toward the same Login.gov-centered architecture and explicitly requiring agencies to measure whether their identity controls create user burden or limit legitimate access, while weighing those results against fraud, security, and privacy measures.

Article Topics

digital identity  |  identity proofing  |  identity verification  |  Login.gov  |  Social Security Administration (SSA)  |  U.S. Government