How to enable 2FA on ID.me

Why protecting your ID.me account with 2FA matters

Your ID.me account can be a sign-in route to some of your most sensitive personal information. Depending on the services you use, it can connect you to:

Tax information: IRS Online Account provides access to tax records, payment activity, and certain notices.
Social Security information: ID.me can be used to sign in to my Social Security, where available account services include earnings records, benefit statements, and managing direct deposit for people receiving benefits.
Veterans’ health and benefits: VA services accessed through ID.me include medical records and benefits information.

That makes protecting this login especially important. An account takeover could expose private information or disrupt your access to essential services. The exact risk depends on the accounts you use and each agency’s additional security checks.

With code-based 2FA enabled, a stolen password alone is not enough to complete the normal sign-in. Sign In, our authenticator app, provides that extra step by generating short-lived verification codes on your iPhone. Codes work offline and do not depend on text-message delivery.

Use a unique password as well, keep your recovery options current, and enter codes only on the genuine site. Verification codes can still be phished, so never share one with an unexpected caller or message sender. The steps below help you add this protection to your ID.me Wallet.

Before you start

Have your ID.me email address and password ready. If MFA is already enabled, keep your current method available while adding a new one. Use a computer or tablet for ID.me’s setup page so your iPhone can scan its QR code.

Sign In does not store your authentication secrets on our servers. Optional account backup uses your personal iCloud Keychain. See our Privacy Policy for details.

This guide covers code-based MFA. Sign In does not perform ID.me’s identity checks or approve its push notifications.

Open ID.me’s Code Generator settings

Sign in to your ID.me Wallet and complete any existing verification step.
From My Wallet, open Sign In & Security.
Find Code Generator and choose Set up.

If this is your first MFA enrollment, choose the code-generator method when ID.me asks how you want to verify sign-ins. Proceed through the browser’s instructions until the setup QR code appears.

ID.me’s setup help illustrates its own app. The instructions below use Sign In for the TOTP code-generator method, based on ID.me’s documentation of TOTP and third-party authenticators. Use the QR flow on another screen; the mobile app-launch shortcut is a different flow.

Scan the QR code with Sign In

Leave ID.me’s setup QR code visible on your computer or tablet.
On your iPhone, open Sign In and tap Add → Scan QR Code.
Scan the QR code. Check the account details, then tap Add Account.
Return to ID.me in your browser and enter the six-digit code shown in Sign In. Submit it and wait for confirmation that enrollment succeeded.

Adding the entry to Sign In alone does not activate MFA. ID.me must accept a generated code to finish pairing the account.

If you only have one iPhone available, return to setup when you can display the QR code on another device. ID.me’s published instructions do not document a manual setup key, so this guide does not rely on one. Keep the QR code private: it contains the secret used to generate future codes.

Save a recovery option before you finish

When you enroll in MFA for the first time, ID.me may offer Generate recovery code. Save it securely somewhere you can reach without your phone. This option does not appear when you add a secondary MFA method.

That recovery code works once. When you use it, save the replacement ID.me provides; the old one stops working. Some organizations do not accept recovery codes, so keep another permitted method available.

ID.me also offers a separate Backup Codes method with 12 single-use codes. It is distinct from the recovery code above. If you choose that option, follow ID.me’s backup-code instructions and store the set securely.

Consider adding a passkey or security key as another supported method. SMS or phone-call verification can also provide a fallback where available. Choose an option you could still use if your iPhone were lost; ID.me recommends having at least two MFA methods.

Use your ID.me code when signing in

After entering your ID.me credentials, select the code-generator method. Open the ID.me entry in Sign In and enter its current six-digit code. Codes refresh every 30 seconds, so wait for the next one if the timer is almost finished.

Sign In can generate the code offline, but the browser still needs a connection to complete the sign-in. Only enter verification codes on the genuine site you intended to visit. Never give a code or setup QR image to an unexpected caller or message sender.

If your code is rejected or your phone is missing

Check the account. Use the ID.me entry for the wallet you are signing into. An old entry from an earlier enrollment may no longer work.
Try a fresh code. Enter it before the timer expires. If fresh codes keep failing, check Settings → General → Date & Time → Set Automatically on your iPhone.
Keep a working way in. Do not remove your existing MFA method or erase your old phone until you have confirmed that the replacement works.

If your phone is unavailable, try another enrolled method or your recovery code if accepted. If none is usable, begin ID.me’s MFA recovery process from the sign-in screen after entering your credentials.

ID.me may ask you to confirm wallet ownership, for example through a selfie, a video call, or identity documents. Its instructions require enrolling a new MFA method within 30 minutes after ownership is confirmed. Follow the recovery prompts if you need to restart. Sign In cannot reset ID.me’s security settings or recover your wallet for you.

Official help and further reading

Instructions reviewed against ID.me’s official documentation on October 15, 2026. No live account enrollment was performed.

For a broader explanation of account protection, read why two-factor authentication matters or compare authenticator codes, passkeys, and other authentication methods.