Digital Authentication and Identity Proofing in Unemployment Insurance (UI) Applications
By Elizabeth Bynum Sorrell, Researcher and Ariel Kennan, Fellow
Digital Benefits Network at the Beeck Center for Social Impact + Innovation at Georgetown University
May 19, 2023, last updated May 19, 2023
← Back to Main Project Page
On this page, we share data and observations about authentication and identity proofing steps for online unemployment insurance applications.
The findings below outline our current understanding of requirements and practices as documented in publicly available information. As we continue to gather feedback and update our datasets, these numbers may change. These points should be understood as general observations to help users quickly make sense of this dataset. You can also view the Digital Benefits Network’s data on authentication and identity proofing practices across core benefits programs on the Digital Benefits Hub.
Digital Authentication and Identity Proofing in Unemployment Insurance Applications Dataset: Spreadsheet
Digital Authentication and Identity Proofing in Unemployment Insurance Applications Dataset: Gallery
High-level Findings
Note: During our data collection, Vermont’s online application for initial unemployment insurance claims appeared to be unavailable. However, we still included details related to that application in our dataset based on the understanding that it would normally be accessible online.
Login and Registration Requirements
Most UI portals require users to register and create an account before applying.
- 46 labor agencies required UI claimants to register or login before starting an application. The seven remaining agencies required users to create a login when returning to their claim at a later date or asked them to create a login later in the claims filing process.
- 36 applications required users to provide an email to create an account.
- We found evidence that 41 agency portals had some additional account security measures in place. Some of the most common additional authentication measures included security questions, PINs, authentication codes sent via email or SMS, and emailed validation links. Most applications that have additional authentication measures in place offer more than one option.
- Nine agencies use a state-wide single sign-on (SSO) system as the login for unemployment portals. Three other agencies were using a federated approach in which users accessed the portal using existing credentials from other providers such as Google, Facebook, and ID.me.
Identity Proofing Requirements
During our research we found that many labor agencies require claimants to complete some type of active identity proofing process.
- We found evidence that 27 labor agencies required UI claimants to actively prove their identities at some point before, during, or following the claims filing process.
- Of the 27 agencies that require identity proofing, ten prompt claimants to complete identity proofing actions before they can initiate an application and ten incorporate identity proofing during the application process. One state labor agency (Nebraska) requires identity proofing actions after application submission. Iowa also allows claimants who decline or fail identity proofing during the application process to submit identity documentation online, by mail, or in person. For five agencies that seemed to require active identity proofing actions, it was unclear when identity proofing would take place.
- For fifteen agencies, it was unclear whether a program required identity proofing, or whether they required it for all claimants.
- Based on information in claimant guides and other documentation online, we found six agencies that do not require claimants to take active identity proofing actions.
- Five other agencies require identity proofing only in some cases.
- Because our protocol used publicly available information and did not involve filling out UI applications, we could not see whether a claimant who is unable to successfully verify their identity is given an option to proceed with the application and verify their identity later in the process. Thus, the data on UI applications documents where an identity proofing prompt or requirement appears in an application; we cannot necessarily account for what happens when that process fails.
Identity Proofing Vendors
Many agencies are using or have used ID.me, a private identity verification provider, however the way each incorporates the service differs.
- As of April, 2023, ID.me lists twenty-three state labor agencies as clients, and in our research, we found 27 agencies that were currently or were previously using ID.me. As noted in our dataset, we found five agencies that either appear to have discontinued using ID.me or it was unclear whether they are still using the service.
- We found evidence that four state labor agencies (Iowa, Kansas, Rhode Island, and Wisconsin) are using LexisNexis Risk Solutions for knowledge-based verification (KBV), although other research shows this number is likely higher.
- Some agencies also use state-specific identity verification tools such as Illinois’s Department of Economic Security, which uses ILogin (the state’s SSO) for sign-in and identity proofing for claimants. (ILogin uses Experian for identity proofing.) The Oklahoma Economic Security Commission is also using a customized identity proofing solution, VerifyOK, built by IDEMIA.
Identity Proofing Methods
Most labor agencies that use front-end identity proofing are using facial recognition technology that prompt users to upload identity documentation and a video or live selfie.
- Across labor agencies, we found that the most common active or front-end identity proofing method, which was used by 22 agencies, involved uploading identity documentation and a video selfie.
- We found evidence that ten state labor agencies used knowledge based verification (KBV) as an identity proofing method.
- We found evidence that nine agencies allowed claimants to mail, fax, or present identity documentation in person.
- A small number of state labor agencies (five) appear to offer claimants choices in identity proofing methods. For example, Iowa allows users who choose not to complete KBV or cannot complete it to upload or mail in their identity documentation.
Personally Identifiable Information (PII) Requested
Social Security numbers (SSNs) are always required when submitting a UI application online. Some applications also request or require that claimants enter a driver’s license number or state ID number.
- We are interested in what types of personal identifiable information (PII) users must submit during an application process that are not necessarily part of a document upload for identity proofing. Claimants must provide a SSN to receive unemployment insurance compensation based on section 1137(a)(1) of the Social Security Act). While we were not able to fill out UI applications, we did observe evidence or indications that in practice an SSN is a required field to submit online.
- For 17 unemployment insurance applications, driver’s license number or state ID number also appeared to be required. Ten agencies may request state ID or driver’s license number, but not require it. For 24 agencies we found information suggesting that a driver’s license number or state ID number was not required within the application. For two agencies, the requirement was unclear.
Additional Context on Identity Verification in Unemployment Insurance Applications: U.S. Department of Labor Alert Memo
In early April 2023, the U.S. Department of Labor’s Office of Inspector General released an alert memo stating that there are “urgent equity and security concerns” regarding the use of facial recognition technology in unemployment insurance programs.
The memo provides background on facial recognition technologies and their use in unemployment insurance systems following the start of the pandemic. The memo also included assessments of contracts between 24 state workforce agencies (SWAs) and identity verification service contractors using facial recognition technology. The memo found that many of the contracts were missing key elements. For example, some had no clear information regarding whether a contractor was using one-to-one or one-to-many matching for face recognition, while others had no provisions to address requirements for secure data storage and privacy. The memo made three recommendations to the Employment and Training Administration (ETA):
- Provide guidance that ensures SWAs provide upfront, clear, consistent, and fair alternatives to services that rely on facial recognition technology.
- Require SWAs that use facial recognition technology to test each system for biases and design procedures to mitigate any uncovered biases. SWAs need to report findings from bias testing to ETA regarding implementation or use of identity verification services that rely on facial recognition technology.
- Provide guidance to SWAs to help ensure that contracts with identity verification service providers include requirements related to the secure storage of identity data, destruction of the data once a contract is concluded, and purging of any large datasets collected by identity verification service providers on a regular basis
As outlined in the published memo, ETA has concurred with these recommendations and stated they will issue guidance by September 30, 2023 to meet them. To develop its recommendations, the OIG surveyed 46 state workforce agencies that it stated were using identity verification service contractors, and 44 states responded.
On April 27, 2023, the ETA released Unemployment Insurance Program Letter No. 22-21, Change 2. The program letter announced additional ARPA funding and support (up to $200 million) “for states to strengthen UI program integrity, including ID verification, fraud prevention and detection, and overpayment recovery efforts in all UC programs.” The guidance “strongly encourages states to carefully review ID proofing solutions that use biometrics such as facial recognition” based on the potential for negative implications for equity or potential violations of states’ nondiscrimination obligations.
Feedback and Engagement
We are publishing this dataset openly and publicly at this stage of our research to share knowledge and also to solicit feedback and engagement from various stakeholders and users. We envision this dataset as a starting point, and hope that people who visit the dataset will help ensure the accuracy of the data, fill in any gaps, conduct their own analysis, and share ideas for further extensions of this work.
This data represents a point in time. We also know that the information we were able to access may not reflect the most up-to-date experiences of claimants, and that application requirements and processes can be complex. For that reason, this data is not meant to be a guide for claimants seeking benefits. This project also does not provide context on state level policies.
To submit general feedback or specific feedback about an application included in the dataset, you can use our designated feedback form.
Data Collection: UI Applications
Between October 1, and November 20, 2022, we reviewed publicly available information on unemployment insurance applications including agency websites, application portals, claimant guides, news coverage, vendor websites, and contracting repositories. For UI applications a valid SSN is often required early in the claims process. Because some state labor agencies appear to immediately check the validity of SSNs entered, we decided to not enter false SSN information or other sample applicant data into these systems. We also did not register for accounts with these portals.
We spent approximately 75 to 90 minutes reviewing each labor agency’s unemployment compensation application during initial data collection and quality checks. After completing an internal review of the data in early December 2022, we shared this dataset with members of the UI Technology Coordinating Coalition for feedback and made small modifications based on member responses. When entering information into our dataset, we erred on the side of caution. This meant leaving fields blank or marking specific columns as “unknown” if there were contradictions or ambiguities in the information we found. We have also used the Public Notes column in the dataset to document those complexities and open questions. Since launching the UI dataset in February, we have continued to make small updates based on new information from state agencies and feedback.
← Back to Main Project Page
