ID.me gathers lots of data besides face scans, including locations. Scammers still have found a way around it.

But despite the scale of the data gathering by the company, ID.me, revealed in newly released records, the system has been exploited by scammers. Federal prosecutors last month said a New Jersey man was able to verify fake driver’s licenses through an ID.me system in California as part of a $2.5 million unemployment-fraud scheme.

ID.me has pointed to the scam as an example of how well its systems work, noting that it referred the case to federal law enforcement after an internal investigation. But the criminal complaint in the case shows that ID.me’s identification systems did not detect bogus accounts created around the same day that included fake driver’s licenses with photos of the suspect’s face in a curly wig.

An ID.me spokesman declined to explain how the suspect was able to win approval for fraudulent accounts and referred other questions to the Justice Department.

The company said in a statement that “the tactics of fraudsters are constantly evolving,” that it “uses extensive analytics and models to prevent identity theft” and that it is “continuously updating controls that protect against new and emerging fraudulent activity.”

The revelations raise new questions about the McLean, Va.-based contractor, which saw its business explode during the pandemic: 10 federal agencies, 30 states and more than 500 companies now pay ID.me to confirm the identities of Americans seeking services such as unemployment insurance or online tax records. The company last year was valued at $1.5 billion, and its government contracts have totaled in the hundreds of millions of dollars.

The company abruptly reversed course this week following reports from The Washington Post and other outlets and backlash from members of Congress, saying it would no longer require people to submit a “video selfie” for a facial recognition scan to access basic government services.

In a statement, ID.me CEO Blake Hall said that the company is “deeply committed to access, equity, security and privacy” and that it had worked “to advance a consumer-centric model of identity verification where individuals — not data brokers or credit bureaus — get to decide how their data is shared.”

But the company uses other controversial technologies for what it calls “identity proofing, authentication and group affiliation verification,” leading privacy and civil rights advocates to voice concerns over how that data could be misused.

This level of data collection “raises a lot of questions not only on the privacy front but in the dimension of what roles are appropriate for private companies,” said Jay Stanley, a senior policy analyst with the American Civil Liberties Union.

It also suggests the company could be “morphing from a privatized identity-verification investigator into a privatized FBI,” Stanley said — and without public oversight or federal guidelines like the Privacy Act, which constrains how government agencies store personal data.

A company spokesman said its data gathering and analysis techniques are standard industry practice.

ID.me has championed the sophistication of its fraud-fighting software in messages to government officials. In an email revealed as part of a Freedom of Information Act request, which the ACLU shared with The Post, an ID.me manager last spring sent a “threat intelligence memo” to officials with the Oregon Employment Department touting that the company’s security team had identified new “threat vectors” for fraud.

Included in that memo, the manager wrote, were details of how the company had worked with the private contractor Palantir for “data analytics and trend analysis.” The software, he said, could help government clients assess whether a single Internet Protocol address “tied to multiple verified accounts is, say, a homeless shelter or social service agency, or an organized crime ring.”

The company official said the ID.me security team was “spending significant time monitoring and infiltrating criminal rings on the Dark Web,” but the email did not say how the software linked a person’s IP address, which every online device has, to an organized crime ring, and the memo was not provided as part of the FOIA request.

An ID.me spokesman said the company uses Palantir’s Foundry software to help process information and that ID.me “is the only entity with access to the data and analysis.” The Oregon employment agency said it does not use Palantir and referred questions to ID.me.

Palantir, named for a mysterious orb from “Lord of the Rings” and co-founded by the billionaire investor Peter Thiel, has built software to map connections between pieces of data, such as phone and Internet records, that U.S. Immigration and Customs Enforcement agents have used to track down undocumented immigrants. The company did not respond to requests for comment.

Olga Akselrod, a senior staff attorney with the American Civil Liberties Union, said the software risked potentially blocking people from government services if they were falsely linked to crime. She said there could be many reasons different people might be using the same IP address, including people who use public computers or seek assistance from legal services, members of the same family, people who share a home and those who share devices because they can’t afford their own.

“We have seen time and again how these analyses are often built on discriminatory data and assumptions,” she said. That, she added, would compound the technical difficulties of the company’s identity-verification process, which is already “really inaccessible to the many, many people on the wrong side of the digital divide.”

ID.me’s state contracts say it stores a vast assortment of personal data alongside people’s “selfie” photos and videos, including home addresses, geolocation data, voice recordings and “inferred citizenship” status based on submitted passport documents.

An Internal Revenue Service privacy assessment in November said people’s “mobile phones are used as a piece of identity evidence themselves,” and that geolocation data can be collected from the wireless phone carriers “in the event of an investigation into a user.”

The company says that kind of data is critical to flushing out identity theft. Its privacy policy says it can use people’s sensitive and personally identifiable information to “cooperate with law enforcement activities,” and Hall told The Post that the company alerts its government clients to “clear cases” of fraud.

In testimony that ID.me submitted to the Montana Legislature for a state committee meeting Wednesday, the company said it had received 35 subpoenas and three warrants. The company said it does not sell data or “contribute data in bulk to any state or federal law enforcement databases” but that it shares information regarding identity theft or fraud with state agencies, who “may involve law enforcement at their discretion.”

The company has said it abides by federal cybersecurity guidelines and has helped its state and federal government clients prevent hundreds of billions of dollars in government benefit fraud.

But as the California prosecution shows, the technology is fallible. One man, Eric Jaklitsch, was indicted last month after federal prosecutors alleged he had filed at least 78 fraudulent claims worth a total of $2.5 million in California for pandemic unemployment assistance and other benefits.

In the claims, prosecutors said, Jaklitsch falsely used other people’s names and said they had been laid off because of the coronavirus from jobs including “Aqua Fitness Instructor,” “Children’s Zoo Caretaker” and “Chauffeur, Funeral Car.”

He uploaded fake driver’s licenses with those people’s names and photos of himself — several of which were included in court documents showing him wearing a curly wig — then verified those same bogus documents by submitting “live photos of himself,” prosecutors said.

Those unemployment claims then went to California’s Employment Development Department, which has relied on ID.me to check the identities of hundreds of thousands of people since October 2020. The fraudulent submissions were then approved “based in part on the ID verification from ID.me,” investigators wrote.

Before Jaklitsch’s alleged scheme was detected, 68 fraudulent claims had been approved, according to federal prosecutors. By the time of his indictment last month, more than $900,000 of state and federal money had been lost. (The indictment does not detail how Jaklitsch allegedly obtained the information for so many false driver’s licenses.)

The case is ongoing. Neither the California agency nor Jaklitsch’s attorney responded to requests for comment.

After the case was investigated, the company began saving people’s “selfie data” into an internal database and running Amazon’s facial recognition software, Rekognition, on the scans to ensure that no one is registering multiple identities, an ID.me spokesman said. (Amazon founder Jeff Bezos owns The Post.)

In a previous statement, ID.me declined to publish details about its “identity theft countermeasures,” saying disclosure could “jeopardize the effectiveness of our controls while putting real people in harm’s way.”

Aaron Schaffer contributed to this report.