GSA’s Login.gov looks to device fingerprinting to fight fraud, AI agents and bots

The General Services Administration is seeking to combat identity fraud by adding more device fingerprinting to Login.gov, the government's unified account manager, according to contracting documents posted Tuesday.

The sophistication and volume of fraud attempts have grown as the service's user base and agency adoption have expanded, the request for information said.

While login.gov already uses fingerprinting within its identity verification flow, they go on to explain that the capability is essential for detecting sophisticated fraud attacks including account takeover, synthetic identity fraud, automated bot activity, residential proxy abuse, and emerging agentic threats.

Device fingerprinting identifies visitors through browser device and network signals rather than just traditional identifiers like IP addresses or cookies, the request said.

The solution GSA is exploring would integrate fingerprinting into account creation and sign-in, provide real-time risk signals for fraud detection, and identify returning devices, even when users attempt to evade detection through VPNs, residential proxies, incognito browsing, cookie clearing, or browser tampering, the document said.

GSA is hoping to find a provider for these capabilities alone, not a full app suite or platform, unless other components are required.

The request said the solution should also detect and classify automated traffic like bots and agentic AI.

including large-language model-based agents from ChatGBT, Claude, and Gemini, and future-proof to adapt to the rapidly changing technology.

Responses to the RFI are due September 11th.

The RFI comes at a time of change for Login.gov, which recently named Treasury Department CIO Sam Korkos as its acting assistant commissioner, as you heard on yesterday's episode.

The General Services Administration is seeking to combat identity fraud by adding more device fingerprinting to Login.gov, the government's unified account manager, according to contracting documents posted Tuesday.

The sophistication and volume of fraud attempts have grown as the service's user base and agency adoption have expanded, the request for information said.

While login.gov already uses fingerprinting within its identity verification flow, they go on to explain that the capability is essential for detecting sophisticated fraud attacks including account takeover, synthetic identity fraud, automated bot activity, residential proxy abuse, and emerging agentic threats.

Device fingerprinting identifies visitors through browser device and network signals rather than just traditional identifiers like IP addresses or cookies, the request said.

The solution GSA is exploring would integrate fingerprinting into account creation and sign-in, provide real-time risk signals for fraud detection, and identify returning devices, even when users attempt to evade detection through VPNs, residential proxies, incognito browsing, cookie clearing, or browser tampering, the document said.

GSA is hoping to find a provider for these capabilities alone, not a full app suite or platform, unless other components are required.

The request said the solution should also detect and classify automated traffic like bots and agentic AI.

including large-language model-based agents from ChatGBT, Claude, and Gemini, and future-proof to adapt to the rapidly changing technology.

Responses to the RFI are due September 11th.

The RFI comes at a time of change for Login.gov, which recently named Treasury Department CIO Sam Korkos as its acting assistant commissioner, as you heard on yesterday's episode.