What to know about the updated I Bond yield and Treasury Direct's new sign-in system

The Treasury Department says I Bonds, a savings product often described as inflation-resistant, will pay an annual rate of 5.51% for buyers who purchase them through the coming months.

I Bonds have become more appealing since inflation surged in recent years. At one point, they reached a record 9.62% rate in 2022.

Although the return has eased from that peak, it is now at its highest level since late 2022. Buyers, however, will also run into a new access requirement: ID.me, a third-party identity service that has drawn scrutiny from lawmakers and experts.

Here is a closer look at how I Bonds work and what to expect from the ID.me login process.

How I Bonds work

I Bond interest is built from two parts: a fixed rate, which stays in place for the life of the bond, and an inflation rate tied to the Consumer Price Index that changes every six months. Because the inflation component resets twice a year, the overall rate changes as well.

They are viewed as inflation-proof because the fixed portion ensures the bond always pays above inflation.

The current 5.51% composite rate reflects a 1.4% fixed rate, the highest in two decades, plus a 4.08% variable inflation rate, which is the strongest since 2022.

Investors may buy up to $10,000 in electronic I Bonds each year.

Are I Bonds a good investment?

Chris Woods, a financial adviser and founder of Silvis Financial, said the current yield looks attractive. Still, he noted that with the 10-year Treasury near 5%, investors can also find corporate bond funds returning 4% to 6% with greater liquidity. I Bonds cannot be redeemed during the first 12 months, and cashing out before five years means losing the last three months of interest.

Woods said he would view them as one part of a fixed-income portfolio for an intermediate horizon of 18 months to seven years or a longer-term plan of seven years or more, but only alongside other investments.

What to know about Treasury Direct's move to ID.me

Treasury Direct is the only online platform where consumers can buy and redeem U.S. savings bonds, though other Treasury securities such as bills and notes can be purchased outside that system.

Recently, ID.me became the only way to sign in to a Treasury Direct account. Users must complete the ID.me setup process to gain access. Other federal agencies, including the Internal Revenue Service and the Social Security Administration, also use ID.me.

Treasury Direct's FAQ says the switch is intended to provide a more standardized and secure way to log in.

The FAQ says the service uses a government-trusted identity check that helps protect sensitive personal and financial information from theft and unauthorized access.

To complete the process, users must provide a Social Security number and upload verification documents such as a driver’s license or state ID, a passport, or a passport card. They must also record a video selfie on a phone.

Without ID.me, users cannot access Treasury Direct, though the FAQ says existing Treasury investments are not permanently frozen or seized.

Is ID.me safe?

Democratic Senators Elizabeth Warren of Massachusetts and Ron Wyden of Oregon recently sent a letter to government officials questioning the transition to ID.me and asking that it be paused until after the 2027 tax filing season. They urged the government to use login.gov instead.

The senators said some people, including older Americans and those without modern devices, may face a steeper learning curve. They also warned that biometric matching can be less accurate for people of color, citing a federal study from 2019 that found facial recognition systems misidentified people of color more often than white people.

They also pointed to the IRS's earlier move to ID.me. At that time, Democrats in Congress raised similar concerns about Americans giving a third party sensitive biometric information and argued that such a database could become a cyberattack target.

Anton Dahbura, executive director of Johns Hopkins University's Information Security Institute, said the ID.me rollout should not stop people from buying bonds if they already planned to do so.

He added that some parts of the service remain unclear and should be made more transparent, including how information is protected and how it is deleted.

“Using a private contractor isn't inherently a security problem, and what matters is that the government maintains strong oversight and can demonstrate that the contractor meets the rigorous security and privacy requirements for these kinds of things,” he said.

Nancy Kim, professor emerita at Illinois Tech’s Chicago-Kent College of Law, said her concern is that biometric data cannot be changed the way a password can. She also said ID.me can keep data for up to three years even if deletion is requested. Kim said she finds little reassurance in the company’s terms of service, noting that while the company says it will not sell user data, it can change its terms. She added that the ability to revise terms is common in online service agreements, but not common in most paper contracts.

The company’s liability to users is capped at $1,000. “If something happens to you, the hassle is going to be way more than $1,000,” Kim said.

Marketplace asked an ID.me spokesman for comment. In response, the spokesman said: “IDMe has earned and maintained the trust of 24 federal agencies, over 50 state government agencies, and millions of users by making security and privacy the center of our business. We do not sell, rent, or trade users’ personal information and as a credential service provider for federal agencies, our business depends on meeting extensive oversight from the government.”

The spokesman also said biometric data “stays within IDMe’s walls, is never sold or shared, and is not compared to outside databases.” He added that the platform uses algorithms tested across demographics by the National Institute of Standards and Technology, part of the U.S. Department of Commerce, and that those algorithms have a “demonstrated accuracy above 99.3%.”

With so much personal information now online, Dahbura said people should focus on strong “cyber hygiene” in general.

He said consumers should routinely check their credit reports and take advantage of multi-factor authentication, which ID.me supports. MFA requires at least two forms of identification to log in.

“To avoid these issues would be to pretty much hide from everything, and so it's important to be smart, be vigilant, and be aware of best practices and what you can do to reduce the impact of a potential breach,” Dahbura said.