If your browser auto-fills your credentials, then you can be (reasonably) sure that the site is the one from which you originally saved those credentials.
But if it doesn’t fill-in anything, it could be for several reasons, one of which is a spoofed site.
Or if could be that the service changed its organization since you originally saved the password such that your browser no longer sees a match. I sometimes see this when a site migrates to a new DNS domain (possibly a new subdomain under the original primary domain). The original URL will redirect to the new one, but your password manager might not realize what’s going on. Which, IMO, is a good thing - it alerts you that something changed. You can now deal with it as you best see fit.
I too received that email from id.me. However, when logging into irs.govSSA.gov in the past, I have always used login.gov. My take on this is that ID.me is trying to get people to use it since there’s a financial gain to be made. This is what Perplexity.ai had to say:
ID.me does earn income from people using it to log into government websites, but not by charging you directly. Instead, government agencies pay ID.me for each identity verification or under subscription‑style contracts.
Do you use login.gov for an Individual online account at the IRS? No matter where I search on the IRS website, I can’t find any way to not use id.me for Individual account registration and log-ons.
(I have a login.gov account and would highly value a way to avoid using id.me)
So the answer appears to be, “Depends on whether, if you’re in the US, if you’re retired military (no expiration of verification), or anybody else (various lengths of time).
As an almost aside, I’ve found more online services who outsource both their email and some of their two-way communications to third-party outfits with having a page in their own website explaining that use, they outsource that stuff, and to whom. I pointed out to one of those outfits (Incogni) that they are expecting their subscribers to blindly give out information to a third party without anywhere saying that it’s a bona fide communication, and explaining how to verify that. As a result, at least a couple of (I’m guessing) twentysomething customer support people now think I’m a semi-paranoid, old crank. Which is a bit ironic when you reflect that the service they sell is getting your personal information out of data scoopers’ databases.
Oops, I was mistaken and corrected my previous comment. Rather than IRS.gov I meant the Social Security website, SSA.gov. The IRS did not trust login.gov enough. My apologies for the confusion.
Now it is possible to use id.meandlogin.gov to access personal IRS accounts. This is a positive development for anybody who doesn’t want to provide personal details, biometrics, and identity documents to a private company.
Wait, what? id .me is a private company and does collect those details… or have I misunderstood something?
I set up login .gov access years ago and had to re-identify with same documents a few times, and access got VA got messed up so I tried id .me and it was tedious, error filled and invasive but eventually set up and regained access.
IRS I hadn’t had success with but will try to set up access again. Need to, as the payment system via Treasury won’t work next year, estimated payments have to go thru an IRS account.
I suppose one positive from setting up id .me is that it’s also used to access the Apple veterans discount program and that saved some good cash on a recent MBAir purchase.
