Kamji:
"I'm curious about how having an online “My Social Security account” prevents identity theft."
I think that having such an account DOES help protect against ID theft.
To log into SS, one needs first to create an account with either id.me or login.gov, for purposes of verification.
I've created accounts at both of the above.
Login.gov was easier than id.me (I'll explain later).
When you go the SS site to view your account, you are directed to (either) login.gov or id.me to establish your login credentials.
There's a "two-factor" authentication process:
1. enter username (or email)
2. enter password
3. wait for a text message to your cell phone (can also be sent to home phone)
4. enter that one-time access code to complete verification.
Even if an id thief has your username and password, he can get no further without the access code that has been sent to YOUR phone.
Getting into the IRS.gov site now is even more involved than it used to be.
I found this out, having created an account some time back, then discovering it would no longer "get me in".
You now MUST use id.me to access your account at IRS (at least for now).
BUT... creating an account with id.me is more involved than with login.gov.
You need a smartphone (I don't have one), and you must go online with it (AND with the computer), and transmit to them a photo of a driver's license (some other documents accepted, must have photo). Then (again using the smartphone), you are sent a special app that takes a "live" picture of you and compares that vis-a-vis the document (with pic) that you sent them.
I tried getting this set up with a friend earlier this week, and we got to just about the end and... it failed (for him). Will have to try again next time I get over there.
As I mentioned, I don't own a smartphone, so the process I just described... wasn't going to work for me.
Instead, I had to use the computer to upload photos of my license, and then (using my MacBook Pro), go to a face-to-face live online meeting with an id.me employee, who (I presume) then compared the face she saw in the live messaging app (me) to the photo on the driver's license I had previously sent.
Then I was given some codes (or something) to complete the application for verification.
Once done, NOW I can log into the IRS.gov site.
Again, I believe that two-factor authentication is used, before it "lets you in" you have to enter a one-time code sent to you by phone.
It took me more than one try over the course of several days to get all this working.
The reasoning behind having accounts with both Social Security and the IRS is to have my Social Security number associated with "an established account". That just might make it more difficult for some illegal to steal my SS# for whatever reason...