ATO seeking biometric verification capability for myID

The Australian Taxation Office (ATO) has issued a request for information (RFI) for biometric verification capability to support myID.

Managed by the ATO, myID is an app that enables a user to prove who they are and logon to online services. Its currently used to access over 240 government online services. Between August 2024 and August 2025, myID was used over 95 million times.

The system currently supports three identity proofing levels; IP1 is a verified email address and self-asserted name and date of birth, while IP2 supports verified email, name and date of birth through the verification of two Australian identity documents via the Document Verification Service (DVS).

IP3, or Strong myID, is a verified email address, verified name and date of birth through the verification of two to three Australian identity documents via the DVS and face biometric verification against a source document (Australian Passport or Driver Licence) via the Face Verification Service (FVS).

There are currently over 14 million myIDs, with over 6 million who have verified their identity to IP3 (Strong), the ATO said.

Since the launch of Strong myID in 2021, the technology landscape for identity verification has evolved "significantly", according to the ATO, particularly in areas such as liveness detection and facial biometric matching.

As such, the ATO is inviting responses from suppliers with expertise in identity verification technologies, specifically in relation to liveness detection and facial image capture; biometric matching; and technical verification of credentials.

The current liveness detection solution was procured in 2021. thus the ATO is interested in exploring the availability of solutions available in the market today.

With over 14 million myID users, the ATO is also looking for biometric verification solutions that can support authentication at scale. This includes enabling users to verify their identity during login or account recovery without needing to re-prove their identity through manual processes which results in the need for call centre support.

myID currently supports verification only against Australian-issued identity documents. This presents a gap for offshore users who need to access services but cannot be verified through existing mechanisms. As part of the RFI, the ATO is seeking information on alternative biometric technical verification methods of document verification and biometric binding, such as NFC-enabled document reading that could support identity verification for individuals outside Australia.

In future, myID will also support additional IP levels, the first of which is IP1+, comprising of verified email address, verified name and date of birth through the verification of one Australian identity document via DVS

IP2 + requires a verified email address, verified name and date of birth through the verification of 2 Australian identity documents via DVS and face biometric verification against a source document (where an Australian Passport is not used) via FVS to achieve a Strong myID, users must complete a liveness test to confirm they are a real, live person.

The image captured during this process is securely transmitted to the relevant document source agency (e.g. the Australian Passport Office) via the FVS for a 1:1 face match against the official document photo. The result of this verification either a pass or fail is then returned to myID and displayed to the user.

The RFI closes on 28 May 2026 at 2:00 pm (ACT Local Time).

In the recent federal budget, the Government announced it's investing $654.3 million into Digital ID, with the ATO set to receive just over half of the funds to maintain operation of myID and the relationship authorisation manager, including implementation of additional security controls and functionality.