I received several emails from TreasuryDirect saying that it will replace the existing login system with a third-party service called ID.me. The ID.me login is available on TreasuryDirect’s website today. You can still use the existing login system through October 28, 2026, but ID.me will be the only way to access your account online afterward.
What Is ID.me
ID.me is a private digital identity provider. It has obtained certifications required by some government agencies. In essence, ID.me ties an email address to a real person by matching an image of the person to a photo ID. Without the image, you can create a login and say who you are, but only submitting a driver’s license doesn’t prove who’s submitting it. ID.me requires seeing you via a selfie or a video call.
ID.me has landed contracts with the IRS, Social Security, VA, and now TreasuryDirect. After you log in with ID.me, ID.me tells the agency positively who just logged in.
How It Works with TreasuryDirect
I already have an ID.me account because the IRS requires it to use its IP PIN system (see Stop Tax Return Fraud: Sign Up for the IRS IP PIN Program). I tried my login at TreasuryDirect.
After I logged in through ID.me, it asked for my permission to share these pieces of information it has on me with TreasuryDirect. I wasn’t too concerned with sharing because I had already given these separately to TreasuryDirect when I opened the TreasuryDirect account.
ID.me sent me back to TreasuryDirect. TreasuryDirect asked for permission to retain the information sent over by ID.me. You won’t be able to use the TreasuryDirect website if you don’t give permission.
TreasuryDirect uses the Social Security Number sent by ID.me to search for accounts associated with it. Normal account access continues after you choose an account. You may not see this screen if you have only one account under your Social Security Number.
Log Out of ID.me
Logging out of TreasuryDirect does not automatically log you out of ID.me. As a best practice, I went to the ID.me website manually and clicked on the “Sign in” button on the top right. This brought me back into ID.me without any further authentication. Then I logged out of ID.me.
The ID.me session will probably time out eventually anyway, but I prefer not to keep it active for any longer than necessary.
Privacy Concerns
I already have an ID.me account because I was forced by the IRS to create one. It worked smoothly for me at TreasuryDirect.
However, if you don’t have an ID.me account yet, you may be concerned about giving your ID documents and selfie to a private company. It’s a serious concern, but TreasuryDirect is forcing your hand. You won’t be able to access your TreasuryDirect account after October 28, 2026 if you don’t create an ID.me account.
TreasuryDirect says this in its ID.me transition FAQs:
Will I be required to use ID.me to access my TreasuryDirect account online after October 28, 2026?
Yes. After October 28, 2026, ID.me will be the only method to log in to your TreasuryDirect account. You will have the option to use your traditional TreasuryDirect login between September 13, 2026, and October 28, 2026.
If you do not sign up and/or connect your TreasuryDirect account(s) to ID.me by October 28, 2026, you can easily restore online access at any time by completing the ID.me setup process and linking your TreasuryDirect account(s).
Without an ID.me Wallet, you will still be able to manage your account by submitting paper forms. However, you will not be able to:
- Sign in to TreasuryDirect online.
- Make new purchases.
- Set up new reinvestments of marketable securities. (Existing reinvestments already in place will continue.)
- View or download your tax forms online.
If you need a copy of your Form 1099 for the current tax year, you can request one by mail after the forms become available in January of the following year by contacting TreasuryDirect Customer Support at 844-284-2676 (toll-free).
You won’t be able to make new purchases. You can sell your existing holdings only by submitting paper forms. TreasuryDirect says on its home page that those requests “may take ten months or longer to process.”
Change.org Petition
Waiting ten months or longer to sell existing holdings isn’t a real choice. Some users started a petition at Change.org about this issue. You can sign the petition if you don’t like being forced to create an ID.me account. The petition has received 204 signatures as I’m writing this.
Creating an ID.me Account
I’m not optimistic that TreasuryDirect will listen to the user protests and change course. If you decide to relent, you can create an ID.me account by going to the ID.me website and clicking on the “Sign in” button on the top right.
Be prepared to submit a government-issued photo ID, such as a driver’s license or a passport, and your Social Security card. As I remember it from when I created my account some time ago, ID.me sent me a link to take a selfie. Or you can join a video call with a verifier, who will match your face with your photo ID. The process wasn’t too difficult.
Securing ID.me Account
It’s crucial to secure your ID.me account because it’s linked to your Social Security Number. If someone logs in to ID.me as you, they will be able to access the IRS, Social Security, and TreasuryDirect as you.
ID.me offers several multi-factor authentication (MFA) methods. I would only consider the three strongest methods.
| MFA Method | Strength |
|---|---|
| (Hardware) Security Key on a computer | Very Strong |
| NFC Mobile Security Key (requires ID.me Authenticator app) | Very Strong |
| Passkey | Very Strong |
| Code Generator (requires ID.me Authenticator app) | Strong |
| Push Notification (requires ID.me Authenticator app) | Moderate |
| Text Message or Phone Call | Fair |
Using a hardware security key on a computer requires buying at least two security keys (one primary, one backup), which cost $29 each. You can use the same two security keys to secure your email accounts and Vanguard account. See PSA: Secure Your Email Account to Prevent Wire Fraud and Security Hardware for Vanguard, Fidelity, and Schwab Accounts.
The NFC Mobile Security Key method requires both the hardware security keys and the ID.me Authenticator app on a mobile phone. It isn’t more secure than using a hardware security key on a computer. The ID.me Authenticator app is one more thing to manage, and you probably don’t want it on a phone that you take everywhere anyway.
A passkey is a software version of a hardware security key. It’s stored in a passkey manager application. If you’re already familiar with using passkeys and a passkey manager app, it’s as secure as using a hardware security key, and you don’t have to buy hardware keys. Many other websites support passkeys now. It’s good to learn how to use passkeys anyway.
I use hardware security keys with ID.me because I already bought them. Otherwise, I would use a passkey stored in a passkey manager app.
Abandon TreasuryDirect
If you don’t want ID.me, you have until October 28, 2026 to do anything at TreasuryDirect using your existing login. Otherwise, you will have to use paper forms and wait 10 months or longer.
If you have marketable securities (Treasury Bills, Notes, Bonds, and TIPS), you can’t sell them before maturity. If they will mature soon, you can turn off automatic reinvestment and wait for the payouts every six months and at maturity. Make sure your linked bank account is correct and keep the bank account in good order until you receive every payment from TreasuryDirect. Print or save your current holdings to a PDF, and create calendar reminders for all expected interest and principal payouts.
If the Treasury Notes, Bonds, and TIPS in your TreasuryDirect account won’t mature for some years, you can start the transfer process to move them to a brokerage account such as Fidelity, Charles Schwab, or Vanguard. The transfer may take a year to complete, but at least it will happen before your holdings mature.
You can buy new Treasuries in a brokerage account with no fee. See How To Buy Treasury Bills & Notes Without Fee at Online Brokers.
If you have savings bonds, you can redeem them as long as they’re more than 12 months old since the issue date. Redeeming savings bonds triggers taxes on the accrued interest. You can save the page that displays the interest to a PDF, or you can ask TreasuryDirect to mail you the 1099 forms by calling customer service next year. Be prepared for long hold times if many users choose to call.
If you have savings bonds not yet 12 months old, you can start the paper Form 5512 now. The bonds will be over 12 months old by the time they get to it.
Wait for Login.gov
Social Security online accounts offer a choice between ID.me and Login.gov. Login.gov is a similar service run by the GSA, which is a government agency, not a private company. Login.gov is also used by Homeland Security for the Global Entry and TSA Pre programs.
There’s an initiative to make Login.gov available for all public-facing websites run by the federal government within two years. TreasuryDirect must have received the memo, but it still only offers ID.me at this time.
If you don’t want ID.me but you don’t want to redeem everything and abandon TreasuryDirect just yet, waiting for Login.gov is another option. You will lose access to your account between October 28, 2026 and whenever Login.gov becomes available. It can take a year or two.
***
You have three bad choices: (a) Give sensitive information to a private company picked by the government agency; (b) Sell everything and pay taxes; and (c) Lose access to your account for an unknown length of time. I really don’t like this, but I don’t think they will change.
Learn the Nuts and Bolts
I put everything I use to manage my money in a book. My Financial Toolbox guides you to a clear course of action.
ReaderInCA says
I have rolling treasuries at Treasury Direct, with my kids as beneficiaries. A major concern for me is that if I die and the funds are still at TD, my kids may (will?) have to create an ID.me account and create a TD account just to provide a death certificate and get the funds (and wait months for that to happen). What a nightmare. My total amount is only 37k.
I use these rolling funds as insurance that if I am incapacitated and can’t re-roll the funds, they will automatically mature into my checking account and cover two years of expenses. Therefore, my son (POA) won’t have to worry about my bills being paid, which are on autopay.
My alternative to leaving TD is to open an overdraft account at my bank (BofA, which pays .1% interest) and fund it with one or two years of expenses. So I will be giving up several hundred dollars in interest if I provide enough for one year.
Is that loss worth it to leave TD and avoid ID.me for myself and my kids? I think so, mainly because I don’t trust a private company with such precious information. On Bogleheads there are many links to all the past problems with ID.me. For only 37k, I don’t want the hassles or the risk. What a pain.
Do you have any thoughts on this situation? You seem to have accepted the risk. What am I missing?
Thank you for this article and info!
Harry Sit says
I edited the post to add some information about regular Treasuries at the end. You can let them run to maturity and wait for the payouts. You can buy Treasuries with no fee in a brokerage account to recreate your rolling Treasuries. See How To Buy Treasury Bills & Notes Without Fee at Online Brokers.
ReaderInCA says
Thank you, Harry. Yes, I also have treasuries at Vanguard and in Merrill, but nothing will automatically mature into my checking account at the bank like TD does or like the BofA savings account will (at .1% interest). That’s my issue re: incapacity protection.
RobI says
Are there any alternatives to buy and sell iBonds other than TD?
Harry Sit says
No. TreasuryDirect is the only place to buy I Bonds. You can buy TIPS in a brokerage account. TIPS work differently. They’re better as long-term holdings because they have a higher yield.
Bill Greggs says
Thanks for this, Harry.
Social Security online accounts also requires ID.me…
Any bets on how long it will take AI to break through this “wall”?
Harry Sit says
Social Security online accounts offer a choice between ID.me and Login.gov. Login.gov is run by the GSA, which is a government agency, not a private company. People who don’t like ID.me can at least choose to use Login.gov at Social Security.
S Jay says
Nothing is easy when the federal government is involved. I already have a Login.gov account for online access to Social Security, Global Entry, OPM Services, etc. Now I have to give up more personally identifiable information to establish an ID.me account. The government should have come up with an option to also use Login.gov for Treasury Direct.
“… government is not the solution to our problem; government is the problem.”
Ronald Reagan
ReaderInCA says
White House mandates agencies use Login.gov for public-facing websites
https://www.nextgov.com/digital-government/2026/08/white-house-mandates-agencies-use-logingov-public-facing-websites/415741/
Harry Sit says
I added a third option: to wait for Login.gov implementation. You will lose account access until TreasuryDirect complies with the directive to offer Login.gov. No one knows when that will come or whether it will come. Some people may prefer this third option over either signing up for ID.me now or selling everything and paying taxes.
RobI says
IRS only offers ID.me for login to pay estimated taxes!!
Harry Sit says
IRS Direct Pay doesn’t require a login. At least you have a choice there if you don’t want ID.me.
S Jay says
Robl – Login.gov can also be used for EFTPS.
Harry – Thanks for the Login.gov update re: Treasury Direct.
Harry Sit says
EFTPS is going away. “All individuals will be required to transition from EFTPS.gov later in 2026.” Direct Pay will be the only option to pay estimated taxes online if you don’t want ID.me (until the IRS also adds Login.gov).
Dunmovin says
Harry, as always…excellent!
We have two personal accounts (different email), sole proprietorship, and a trust…4 accounts. We have never used e-filing for taxes or Soc Sec. Looking at taxes for 2026 and given TD unnoticed changes to the public, in the last couple of weeks ALL ibond holdings over 1 year have been redeemed! 2026 potential tax info downloaded from TD so year end 1099s not needed.
I want to reiterate two aspects/Qs on submitting paper 5512 now even though there are months until 1 year holding period expires…any particular concerns (e.g. never used “signature guarantees” but have used the “stamp” that banks used to use on/at paper bond redemptions and it worked TD and I have a copy!) about filling out 4 forms for (no “as of” dating?) all four accounts NOW and paper mailing? Is there any way to get TD to waive the one year holding requirement (arguably “misrepresentations” by the Gov’t in failing to disclose terms and condition changes and then on an retroactive basis, no known Fed Register notice/comment, etc. ) to merely getting the principal back asap (assuming it wouldn’t take “forever” to get action on it by TD)?
Again, thanks!!!
Harry Sit says
I don’t think TreasuryDirect will waive the 1-year requirement, but you can call and ask. The current processing time is 10 months. I doubt it will get faster. You can hold off on mailing your form if you’re concerned that someone will pick it up before the 1-year holding period and reject it.
Deb T says
For anyone wondering if there will be issues with their current id.me login. I logged into the updated system yesterday after the upgrade. It walked me through getting a passkey which took about 30 seconds and a couple of clicks. Account was then immediately functional again.
Jim says
Great article, thank for all you do for us! A couple of comments/questions
1. I successfully use my password manager (Proton Pass) for the one-time authenticator code to log into ID.me. I don’t have the ID.me authenticator app. (I also use Yubikeys)
2. You mention abandoning TD accounts. I haven’t used mine for a few years. Is there any way to delete a TD account? I poked around on the TD help and FAQ pages but could not find any mention of deleting (or disabling) the account. No particular reason to do this other than I prefer to get rid of old accounts.
Doug says
If you do not log in to your account for 18 months and it is empty, it will automatically be deleted.
Harry Sit says
Jim – If you have an existing ID.me account and have previously set up authentication codes, your previous setup still works. If you delete the authentication code setup and start over, setting up new authentication codes now requires the ID.me Authenticator app. ID.me no longer provides the seed or QR code to third-party authenticator apps. A script on GitHub reverse-engineered the ID.me Authenticator app and reveals the seed, but using it requires technical knowledge and verifying or trusting the script. Regular (new) users should stick with hardware security keys or passkeys.
Jim says
Thanks for the clarification, Harry.
Jim says
Thanks Doug – I ‘ll have to remember to not log into TD for the next couple of years. I wish more entities deleted accounts after a period of inactivity!
Erik says
Thanks Harry. I followed your instructions and successfully switched to ID.me. Note I did to the account info page and noticed my drivers license expiration date needed to be updated which I did.
Yuliy says
Thanks Harry — this is very helpful, timely, and good information.
Regarding the MFA methods summarized in the table above, I have a two-part comment:
(1) I question whether a passkey truly qualifies as “MFA” when stored in the same password manager alongside the password. If that password manager is compromised, there is no second factor external to it. For this reason, I’m not sure passkeys warrant a “Very Strong” rating (understanding this rating comes from ID.me, not you).
(2) Conversely, the Code Generator option can serve as a genuinely independent MFA factor — provided it is kept separate from the primary password manager. (As a side note, it does not require the ID.me Authenticator app; any authenticator app works, such as Google Authenticator, Microsoft Authenticator, or various others, including browser extensions. Many people likely use one already, so there’s no need to set up and maintain anything new.)
In my view, the strength ratings for these two approaches should be swapped: Code Generators should be rated “Very Strong” and passkeys “Strong.” In either case I would avoid storing any second factors in a password manager, as doing so trades security for convenience — a compromise that is likely unwise for sensitive accounts.
Harry Sit says
(1) This gets into using passkeys in general, not specific to ID.me. I replaced the phrase “password manager” with “passkey manager.” Passkeys must be stored somewhere. Wherever you choose to store them is your passkey manager. It doesn’t have to be your password manager, and you gave good reasons for keeping passwords and passkeys separate.
(2) ID.me no longer works with 3rd party authenticator apps for new setups. See my previous reply to Jim. Authenticator codes aren’t phishing-resistant. That’s why they’re rated lower than passkeys (when used correctly).
LiftLock says
Harry,
Thanks for the very helpful article. I have used ID.me about 3 times in the past several years. I have found the user interface difficult to follow every time I have logged in. It uses terminology which is not well defined and unfamiliar to me. In addition, ID.me wants to take a new picture of my face to verify who I am every time I log in. Most recently, it wanted me to select options for multi-factor authentication which you outlined in your post. I do not understand what might be involved in using the any of the more secure choices begin presented so I opted for the least secure choice “Send code via Text message.” I know very little about how Pass Keys work and I find it hard to believe I am alone in that regard.
I have been managing my spouses account at Treasury Direct and logging into it on her behalf. I am not sure I will be able to continue doing that with ID.me. She is unlikely to ever become skilled at using ID.me to log in to her account own her own. It’s not something that is going to be used very often. My larger concern is how will ID.me work for authorized representatives (e.g. an executor or someone with financial power of attorney) who may need to my spouses account which is going to require ID.Me. I wonder whether Uncle Sam has contemplated or considered that need. I am thinking the best course of action may be to liquidate or transfer my spouses TIPS to her brokerage account to avoid the potential future mess.
Harry Sit says
I don’t think it’s worth creating an ID.me account for her. If she only has TIPS in TreasuryDirect, she can’t sell them before maturity anyway. Just let them run to maturity and wait for the payouts if the TIPS will mature soon. Keep the linked bank account in good order. Or transfer the TIPS to a brokerage account and be done with TreasuryDirect.
LiftLock says
Harry,
Thanks for your reply.
It turns out my spouse has iBonds, not TIPS, which were purchased and are held in electronic form at Treasury Direct (TD). From what I am reading iBonds in electronic form cannot be transferred to a brokerage account. They must be liquidated at Treasury Direct so that funds can be transferred somewhere else.
It does appear that Treasury Direct has a procedure for my spouse to grant me rights to transact business on her behalf. It is security specific and requires me to set up a TD account in my own name which my spouse then uses to grant me rights. Once that is done, I can log in to my own TD account using my own ID.me, sell her iBonds and transfer the funds elsewhere. This should work well while we are both mentally able. My wife will need to be able to log in to TD using ID.me to grant rights to a representative other than me. That isn’t going to be a workable if she were to become mentally or physically disabled. The best solution appears to be to liquidate the iBonds , transfer the funds to another financial institution where it would be easier for an authorized representative to transact financial business on her behalf.
Harry Sit says
I Bonds don’t mature until 30 years from the issue date. Orderly liquidation makes sense. Granting rights on I Bonds to another person is in How To Grant Transact or View Right on Your I Bonds.
Dunmovin says
Harry, perhaps I missed this… If an owner of Ibonds does not want to register at ID.me and wants to redeem next year (after one year holding expired) w/o a paper request…why not add a new registration with the primary owner (not ID.me registered) and change or add a (trusted) co-owner who has a TD account AND ID.me account), provide transaction rights to secondary owner. Then next year after one year hold the secondary owner redeems the ibond with the funds going to that person’s bank of record. Taxes are still the responsibility of the primary owner. Thereafter the Ibond is redeemed in a lot shorter time through the co-owner ID.me rather than a paper redemption request. Seems like it would work…what do you think? An interim step would be to redeem some Ibonds this year by the new co-owner (e.g. $50) from an account that is over 1 year old. Thanks!
Harry Sit says
That works in the narrow scenario as you described. Other customers (a) may not have savings bonds still within the 1-year holding period; (b) may not have a trusted secondary owner; or (c) their trusted secondary owner may not have or want ID.me either. Go for it if all three line up well for you.
It’s not that intuitive to see or redeem bonds as a secondary owner. See the Shared Securities section in this other post. It’s a good idea to test with a small redemption.
Dunmovin says
Thank you. The primary owner does not want to register at ID.me but has a trusted person (currently registered on ID.me and just opened a TD account with/through that ID.me registration) who will replace the current co-owner (who does not want to register ID.me either). The purpose of the $50 redemption (on older ibonds) is to “test” the system (and not get locked, etc. out!) but it seems to me this is a more expedited way to redeem balance (that’s the goal) of ibonds after 1 year hold.
No problem with the primary owner not being in ID.me and a co-owner being registered there?
CJG says
I use ID.me for my IRS, Social Security, Medicare and now Treasury Direct. Some may think that ID.me is not secure because it is a private company. It can’t be as bad as the US government’s Office of Personnel Management. They lost almost all their files to the Chinese government due to a data breach. This included all security clearance information which had much more information on me (including my fingerprints) than ID.me has. See https://en.wikipedia.org/wiki/2015_Office_of_Personnel_Management_data_breach
Dunmovin says
I feel so much better that they are both “bad.” That isn’t my criteria for choice or…. OPM is worst in your opinion. Your data can be at risk if/when an private entity goes BK, the gov’t won’t do that! Have you read the exclusions from liability?
Josh D says
Yes. Good to keep some perspective here. And, make no mistake – Login.gov is just a government front-end that ties together private company services like LexisNexis, Socure, and more. Login.gov will likely be added in the future when it meets Treasury’s security needs but people thinking their data is wholly validated by the government only are mistaken. Ask for a copy of your data from these companies that you’ve never intentionally done business with and you will be shocked at how much data they have hoovered up on you.
CJG says
I’m sure that if ID.me went bankrupt, it would be immediately taken over by the US government. When OPM had its fiasco, there was no compensation for the victims of that identity theft. All you could do was freeze all of your credit and never ever travel to China.
Dunmovin says
“I’m sure.” (Under this Administration/AG) we like that. And we note that is from your reading of the exclusions . And the terms that provide for same are readily available and the provisions in the customer/ID.me contract mean nothing. Go for it! The readers here appreciate your assurances!
Dunmovin says
Harry, a colleague has successfully changed existing registrations over Ibonds to primary owner (no ID.me registration) to a trusted person (has had ID.me for awhile), the latter was authorized to conduct “transaction” authority for former and the latter has successfully redeemed all of the eligible more than one year Ibond holdings, as mentioned. However, there currently remains Ibonds less than one year for the primary owner in a sole proprietorship account as well as being a trustee (another individual listed there after the “or”) account (none are registered with ID.me), how can someone redeem them next year after one year if that individual is not ID.me registered? Proprietorship? Trust?
Is THE only option as noted above is the submission of a paper request for redemption?
As an aside, everyone should read about the hack at the FBI
Thanks!
Harry Sit says
A sole proprietor account or a trust account has only one account manager. It can’t grant rights to another account. The three available options are to register for ID.me, wait for Login.gov, or use the paper form.
Dunmovin says
Can one change one of the trust co-trustees and thereafter change the registration on TD to that other/new co-trustee who is ID.me registered person and then that latter person can redeem the ibonds after one year? Looking for a way to do it, not a way to not do it. Thanks
Harry Sit says
As far as I know, a trust account in TreasuryDirect has only one account manager. The trust itself may have multiple trustees, but those other trustees can’t be added to TreasuryDirect as additional account managers. That one registered account manager can be changed by using a paper form.
erik says
i keep hearing about a concern of our individual data out there {meaning this site and others]. I operate under the assumption that I walk around naked. meaning my neighbors, the local community, and everyone around the world knows exactly who I am. For example, I received this in my mailbox, tradition paper mail, …”unauthorized individuals accessed certain data on our computer network.”
The world, law enforcement, the media, and everyone can find out everything about you already.
Eric says
I voluntarily moved to ID.me because login.gov forced me to allow SMS as a 2FA choice. How foolish.
Regarding 2FA in general, I am a huge fan of requiring two physical devices. I use a dedicated computer at home with a dedicated Google account used only for ID.me and my most important financial institutions that itself has strong 2FA for my first factor, and a phone that has the ID.me authenticator app as a second factor.
My motto is multiple factors, requiring multiple devices
RobI says
Their website indicates other MFA methods than SMS are supported. Haven’t tried it myself to verify.
https://www.login.gov/help/create-account/authentication-methods/
Eric says
Yes, other 2FA methods are supported. My criticism is that SMS cannot be deactivated. The 2FA security devolves to the weakest method