What you should know about the new I Bond rate and the Treasury's new login process

The Treasury Department has announced that I Bonds, which are considered inflation-proof investments, will start paying an annual interest rate of 5.51%, if you purchase them between now and April.

Since the early years of the pandemic, I Bonds have become a more attractive investment vehicle as inflation has risen. In 2022, they offered a record 9.62% interest rate rate.

While the rate has dipped since then, the rate is now the highest it's been since November 2022. But those trying to buy I Bonds will encounter a new system they have to navigate: ID.me, a third-party service that has raised concerns from lawmakers and experts.

Here's what you should know about these investments and using ID.me.

How I Bonds work

The interest rate on I Bonds are based on a fixed rate, which remains the same rate you bought it at throughout its 30-year lifespan, and an inflation rate, which is based on the Consumer Price Index and changes every six months. Because the inflation rate changes every six months, so does your overall rate.

I Bonds are considered inflation proof because they will always pay out more than inflation thanks to that fixed rate.

The current 5.51% total rate is based on an annual fixed rate of 1.4%, the highest it's been in 20 years, and an annual variable or inflation rate of 4.08%, the highest it's been since 2022.

You are allowed to purchase up to $10,000 in electronic I Bonds each year.

Are these I Bonds worth the investment?

Chris Woods, a financial adviser and the founder of Silvis Financial, said the current rate is attractive. But he noted that with the 10-year Treasury close to 5%, you can find corporate bond funds that have a 4% to 6% return, with liquidity. I Bonds can't be redeemed during their first 12 months, and if you redeem them in less than five years, then you lose the last three months of interest.

Woods said he would consider adding them in a fixed-income portfolio as part of an intermediate (18 months to seven years) or long-term strategy (seven years or more), but there would have to be other investments in that portfolio as well.

What you should know about transitioning to Treasury Direct's new login system ID.me

Treasury Direct is the only place online where you can buy and redeem U.S. savings bonds, although you can buy other securities outside of the Treasury Direct system, like Treasury bills and notes.

Starting last week, ID.me — a third-party service — became the only method to log in to your Treasury Direct account. To gain access, you'll need to go through the ID.me setup process. Other government agencies also use ID.me, including the Internal Revenue Service and the Social Security Administration.

A FAQ on TreasuryDirect says that it's making the transition because it's "a more standardized, secure way of logging in."

"It uses a government-trusted method to verify your identity, which protects your sensitive personal and financial information from identity theft and unauthorized access," the FAQ states.

The process entails listing either your Social Security number and uploading some form of verification, which can include photos of either your license or state ID; your passport; or your passport card. Afterwards, you'll also have to take a video selfie using your phone.

Without ID.me, you won't be able to access Treasury Direct, but any previous investments you had with the Treasury “are not permanently frozen or seized,” according to the FAQ.

Is ID.me safe?

Last week, Democratic Senators Elizabeth Warren of Massachusetts and Ron Wyden of Oregon sent a letter to government officials raising concerns about the transition to ID.me and asked them to at least halt the implementation of the service until after the 2027 tax filing season. They recommended the use of login.gov instead.

Both senators pointed out that there may be a steeper learning curve for certain groups, including older Americans and those without modern devices, and noted that biometric matching can be inaccurate, especially for people of color. A 2019 federal study found that facial recognition systems misidentified people of color more frequently than white people.

They also referenced the IRS' transition to ID.me several years ago. At the time, Democrats in Congress were also concerned about having Americans entrust a third-party service with sensitive information, like their biometric data, and said that a biometric database would be a target for cyberattacks.

Anton Dahbura, executive director of Johns Hopkins University's Information Security Institute, said that the ID.me rollout should not deter people from buying bonds if they had already planned to.

But Dahbura said there are aspects of the service that are "murky" and should be made transparent to the public, like how exactly your information is protected and how your information is deleted.

"Using a private contractor isn't inherently a security problem, and what matters is that the government maintains strong oversight and can demonstrate that the contractor meets the rigorous security and privacy requirements for these kinds of things," he said.

Nancy Kim, a professor emerita at Illinois Tech’s Chicago-Kent College of Law, has concerns with the service and pointed out that if someone takes your biometric data, you can't change that information like you can with your password. She also said that even if you ask ID.me to delete your data, they can keep it for up to three years. Kim said she doesn't find anything reassuring in ID.me's Terms of service, pointing out that even though they state they won't sell your data, they also have the ability to change their terms. (The ability to change terms “is common in terms of service but was and is still not common in most paper contracts," Kim said.)

The company's liability to you is also capped at $1,000. "If something happens to you, the hassle is going to be way more than $1,000," Kim said.

Marketplace reached out to a ID.me spokesman, who wrote: “IDMe has earned and maintained the trust of 24 federal agencies, over 50 state government agencies, and millions of users by making security and privacy the center of our business. We do not sell, rent, or trade users’ personal information and as a credential service provider for federal agencies, our business depends on meeting extensive oversight from the government.”

The spokesman said that your biometric data “stays within IDMe’s walls, is never sold or shared, and is not compared to outside databases.” He added that the platform uses algorithms tested across demographics by the National Institute of Standards and Technology, an agency in the U.S. Department of Commerce. Those algorithms have a “demonstrated accuracy above 99.3%,” the spokesman said.

With so much of our information online now, Dahbura said that you should do the best you can to practice good "cyber hygiene" in general.

Dahbura said you should always check your credit reports and he said you should take advantage of multi-factor authentication (which ID.me does enable). MFA requires you to provide at least two forms of identification to log in.

"To avoid these issues would be to pretty much hide from everything, and so it's important to be smart, be vigilant, and be aware of best practices and what you can do to reduce the impact of a potential breach," Dahbura said.