Login-dot-gov explores more device fingerprinting to combat fraud, AI agents and bots
The General Services Administration is seeking to combat identity fraud by adding more device fingerprinting to Login-dot-gov, the government’s unified account manager, according to contracting documents posted Tuesday.
The “sophistication and volume” of fraud attempts have grown as the service’s user base and agency adoption have expanded, the request for information said. While Login-dot-gov already uses fingerprinting within its identity verification flow, “there is an opportunity to enhance the platform’s comprehensive fraud prevention strategy,” documents said.
“This capability is essential for detecting sophisticated fraud attacks including account takeover, synthetic identity fraud, automated bot activity, residential proxy abuse, and emerging agentic [artificial intelligence] threats,” they said.
Device fingerprinting identifies visitors through browser, device and network signals rather than just traditional identifiers like IP addresses or cookies, the request said.
The solution GSA is exploring would integrate fingerprinting into account creation and sign-in, provide real-time risk signals for fraud detection and identify returning devices, “even when users attempt to evade detection through VPNs, residential proxies, incognito browsing, cookie clearing, or browser tampering,” the documents said.
GSA is hoping to find a provider for these capabilities alone, not a full app suite or platform, unless other components are required, it said.
The request said the solution should also detect and classify automated traffic like bots and agentic AI, including large language model-based agents from ChatGPT, Claude and Gemini, and “future-proof” to adapt to the rapidly changing technology. Responses are due Sept. 11.
The RFI comes at a time of change for Login-dot-gov, which recently named Treasury Department CIO Sam Corcos as its acting assistant commissioner.
Marisol Cruz Cain, the Government Accountability Office’s director of IT and cybersecurity, told the House Oversight and Government Reform Subcommittee on Government Operations in July that GSA has not taken all the recommended steps to collaborate with agencies to address the single sign-on platform’s technical challenges.
Agencies reported that they lacked visibility into authentications, the system had a high failure rate and lacked fraud controls, she said.
“To their credit, they have been taking the issue very seriously and partnering with new technologies and new companies to enhance their fraud controls, but they need to partner with the users,” she said. “If the users can’t use it, the technologies can be great, but if your users are still having issues using the system, you’re going to lose that user base.”
