TreasuryDirect: Transitioning to ID.me for Account Access

The U.S. Treasury is upgrading the way users access their accounts. To enhance security and streamline the user experience, TreasuryDirect is integrating ID.me, a digital identity verification service. This transition is designed to protect your financial assets while making the login process more intuitive.

Why the Change?

The primary driver for this shift is the need for robust identity assurance. Traditional password-based systems are increasingly vulnerable to cyber threats. By utilizing ID.me, TreasuryDirect can ensure that the person accessing an account is truly the owner.

"The integration of ID.me represents a significant leap forward in our commitment to safeguarding taxpayer funds and personal information against unauthorized access."

Key Improvements

• Enhanced Security: Implementation of multi-factor authentication (MFA).
• Simplified Access: Use a single, verified identity across multiple government platforms.
• Fraud Reduction: Stronger verification reduces the risk of account takeovers.

---

Comparing the Login Experience

The transition marks a shift from legacy authentication to a modern, identity-centric model.

---

How the New Process Works

When you attempt to access your account, the system will now redirect you through a secure "handshake" with ID.me.

Technical Implementation

Under the hood, the system uses a secure token exchange. While users see a simple login screen, the backend performs a check similar to this logic:

{
  "auth_request": {
    "provider": "ID.me",
    "endpoint": "https://api.id.me/v1/verify",
    "required_assurance_level": "IAL2",
    "action": "authenticate_user"
  }
}

---

Your Transition Checklist

To ensure you don't lose access to your securities, please complete the following steps:

• Create an account at ID.me.
• Upload a valid government-issued photo ID.
• Complete the "selfie" verification process.
• Link your verified ID.me profile to your TreasuryDirect account.
• Update your contact email to ensure notifications are received.

Important Security Note

The security of your account can be represented by the following logic: $\text{Security} = (\text{Something you know}) + (\text{Something you have}) + (\text{Something you are})$

By combining your password (knowledge), your mobile device (possession), and your biometric data (inherence), the probability of unauthorized access $\text{P}(\text{breach})$ approaches zero: $\lim_{security \to \infty} P(\text{breach}) = 0$

---

Warning: TreasuryDirect will never ask you for your password via email or text. Always ensure you are on the official .gov domain before entering your credentials.