Why am I being sent to ID.me when I'm trying to use the IRS website?

The IRS replaced its old account login system with ID.me in 2022. ID.me is a separate company that handles identity verification and sign-in for many U.S. government agencies — IRS, Social Security, VA, state unemployment offices, and others. When you 'set up 2FA on your IRS account', you're actually setting it up on your ID.me account, which then signs you in to irs.gov. One ID.me account gives you 2FA for all the agencies that use it.

Do I need the ID.me Authenticator app, or will 2FA Studio work?

ID.me's documentation specifically names the ID.me Authenticator app for their Code Generator option, but the QR code they show you follows the standard time-based one-time password (TOTP) format. Any TOTP-compatible authenticator app — 2FA Studio, Google Authenticator, Authy, 1Password — reads the same QR and generates the same 6-digit codes. We recommend 2FA Studio because it works for every TOTP service you use, not just ID.me.

Do I have to verify my identity with ID.me before I can set up 2FA?

Yes, if you're creating an ID.me account for the first time. ID.me will ask you to upload a photo of a government ID (driver's license or passport), take a selfie, and sometimes complete a short video chat with an agent. This typically takes 10–20 minutes and only happens once — after that, your ID.me account works for the IRS and any other agency. If you already have a verified ID.me account from accessing the SSA or VA, no extra verification is needed.

My selfie or document upload isn't being accepted — what do I do?

Selfie failures are common, especially with glasses, hats, or harsh lighting. Try again with even, front-facing light and a plain background. If it still fails after a few attempts, ID.me offers a Trusted Referee video call as a fallback — a real person verifies you over video. From the failed verification screen, choose Verify with a Trusted Referee. Wait times for the video call vary; expect anywhere from 10 minutes to a few hours.

Will I have to set up 2FA again next tax season?

No. Your ID.me account is permanent and your 2FA settings persist. Once a year is usually enough to test that your authenticator app still works and refresh your recovery information — and every time you switch phones, update your MFA methods before retiring the old one.

irs.gov

How to set up 2FA for the IRS on iPhone

About 5 minutes

Verified May 2026

Supports Authenticator app · Push notification · SMS · Hardware key · Backup codes

If you’ve tried to sign in to your IRS online account and ended up on a screen asking you to set up two-factor authentication, you’re in the right place. This guide walks you through it end to end. About five minutes for the 2FA part itself — though if you’re brand-new to ID.me, plan another 10–20 minutes for the identity verification step before you start.

Here’s the first thing to know: the IRS doesn’t run its own 2FA system anymore. Since 2022, signing in to irs.gov goes through ID.me — a third-party identity service the IRS partnered with. When you “set up 2FA on your IRS account”, you’re actually setting it up on your ID.me account, which then signs you in to the IRS website. The upside: that same ID.me account also works for the Social Security Administration, VA, many state unemployment offices, and dozens of other government services. One 2FA setup, everywhere.

What you’ll need

An iPhone (this guide is written for iOS 16 and newer)
About 5 minutes for the 2FA setup itself
An ID.me account (we’ll create one if you don’t have one — add 10–20 minutes for identity verification)
A government-issued photo ID and a webcam or phone camera handy if you’re verifying for the first time
A free authenticator app on your iPhone (see recommendation below)

We recommend 2FA Studio for this. It works with ID.me’s standard QR code, stores your codes encrypted in your iCloud (so they survive switching phones), and works with every other service we cover. You can also use Google Authenticator, Authy, 1Password, or even ID.me’s own Authenticator app — all of them read the same QR and generate the same 6-digit codes.

A note on ID.me’s MFA options: ID.me lets you pick from six methods (Passkey, Code Generator, Push Notification, SMS, Security Key, NFC Security Key). This guide covers Code Generator, which is the option that works with 2FA Studio and any standard authenticator app. It’s also classified by ID.me as a “strong” security level — the same tier as Passkey and Security Key, and stronger than SMS.

Step-by-step setup

The setup starts on irs.gov but jumps to ID.me almost immediately. Don’t worry about that — it’s expected. Have your iPhone next to you with 2FA Studio (or your authenticator app of choice) installed before you begin.

Start at irs.gov and click Sign In to Your Online Account

Open a web browser and go to irs.gov. Click Sign in to Your Online Account at the top of the page. On the next screen, click Sign in with ID.me. You’ll be redirected to ID.me’s sign-in page — this is normal.

Sign in to or create your ID.me account

If you already have an ID.me account (because you’ve used it for the SSA, VA, or another agency), sign in with your ID.me email and password. Skip to step 3.

If you’re new to ID.me, click Create an ID.me account. Enter your email, choose a password, and confirm your email when ID.me sends you a verification link. ID.me will then walk you through identity verification: upload a photo of your driver’s license or passport, take a selfie, and confirm your details. This is a one-time process — once you’re verified, you don’t have to do it again. Expect 10–20 minutes for this part. The FAQ at the bottom of this page covers what to do if your selfie isn’t accepted.

Once your identity is verified, ID.me will push you straight into MFA setup. That’s step 3.

Choose "Code Generator" as your MFA method

ID.me’s MFA setup screen offers six options:

Passkey — strongest, uses Face ID
Code Generator — works with any authenticator app (pick this one)
Push Notification — requires the ID.me Authenticator app
Text Message or Phone Call — easiest but least secure
Security Key — physical USB key
NFC Security Key — physical key, tap-to-sign

Click Set Up next to Code Generator, then click Continue.

Scan the QR code with your authenticator app

ID.me shows a QR code on your screen. Open your authenticator app on your iPhone, tap the + button (usually bottom-right), and choose Scan QR Code. Point your iPhone’s camera at the QR code on your computer.

Your authenticator app will add a new ID.me entry showing a 6-digit code that refreshes every 30 seconds.

If you can’t scan (you’re using ID.me on the same phone, for example), click the Can’t scan? link below the QR code to reveal a setup key. Copy it, then in your authenticator app choose Enter Setup Key and paste it in.

Enter the 6-digit code to confirm

Back on ID.me, type the current 6-digit code from your authenticator app into the box, then click Continue.

ID.me confirms Code Generator is now active on your wallet. You’ll see it listed under your Multi-Factor Authentication settings as Code Generator — Strong.

Add a second MFA method as backup

ID.me strongly recommends setting up at least two MFA methods so you’re not locked out if you lose your phone. From your ID.me dashboard, click Sign In & Security in the left sidebar, then Multi-Factor Authentication. Click Set Up next to a second option.

For most people, SMS or Phone Call is the simplest backup. If you’d rather not depend on SMS (which is vulnerable to SIM-swap attacks), pick Code Generator a second time on a separate device, or set up a Security Key if you have one. ID.me does not offer printable backup codes the way some services do — your “backup” is having a second MFA method.

What if you lose your phone?

The good news: if you followed step 6, you have a path back in. ID.me’s recovery story depends entirely on the second MFA method you set up.

You set up SMS or Phone Call as backup. Sign in to ID.me with your email and password as usual. When prompted for an MFA code, click I don’t have my Code Generator, then choose your SMS or phone-call method. ID.me sends you a code. Once you’re in, go to Sign In & Security → Multi-Factor Authentication, remove the old Code Generator entry, and set it up fresh on your new phone.

You set up Code Generator on a second device. Use the second device to sign in. Replace the lost-phone entry with a fresh setup.

You only set up Code Generator on the lost phone, no backup. Contact ID.me support at help.id.me. They’ll require you to re-verify your identity (the same selfie + document process from initial setup) before they can reset your MFA. Expect this to take a few hours to a few days depending on volume. The IRS itself can’t help because the 2FA lives on ID.me’s side.

If you’d rather not worry about losing access to your codes when you switch phones, 2FA Studio’s encrypted iCloud sync means your codes follow your iCloud account — not a single device. When you sign in to iCloud on a new iPhone, your ID.me code (and every other code) shows up automatically. Your codes stay end-to-end encrypted; we never see them, and they don’t sit on someone else’s server.

A note on tax season

The most common time people get locked out of their IRS account is mid-April, when they urgently need to look up a payment, retrieve a transcript, or file an extension and the authenticator app on their old phone won’t load. Test your IRS sign-in once before tax season — every January is a good rhythm. Two minutes now saves a panicked phone call in the wrong week.