GSA Seeks Device Fingerprinting for Login.gov to Separate People From Bots and AI Agents

The General Services Administration is looking for expanded device fingerprinting for Login.gov, according to contracting documents posted on Tuesday. Responses to the request for information are due September 11.

The request says the sophistication and volume of fraud attempts have grown as the service’s user base and agency adoption have expanded. Login.gov already uses fingerprinting inside its identity verification flow, but the documents say there is “an opportunity to enhance the platform’s comprehensive fraud prevention strategy.” The capability is described as essential for detecting account takeover, synthetic identity fraud, automated bot activity, residential proxy abuse and emerging agentic artificial intelligence threats.

Device fingerprinting identifies visitors through browser, device and network signals rather than through IP addresses or cookies alone. The solution GSA describes would work at account creation and at sign-in, produce real-time risk signals, and recognise a returning device “even when users attempt to evade detection through VPNs, residential proxies, incognito browsing, cookie clearing, or browser tampering.”

A second requirement covers automated traffic. The documents ask that the system detect and classify bots and agentic AI, naming large language model agents from ChatGPT, Claude and Gemini, and that it be built to adapt as the technology changes. GSA says it wants a provider for these capabilities alone rather than a full application suite or platform, unless other components are required.

The request lands during a period of change at the service, which recently named Treasury Department chief information officer Sam Corcos as acting assistant commissioner. Its identity proofing panel has also been growing, with Xcelerate and Socure winning a $163 million call order in July and LexisNexis Risk Solutions expanding its role this month.

Federal auditors have flagged unresolved problems with the platform. Marisol Cruz Cain, director of IT and cybersecurity at the Government Accountability Office, told a House Oversight and Government Reform subcommittee in July that GSA has not taken all recommended steps to collaborate with agencies on the platform’s technical challenges. Agencies reported a lack of visibility into authentications, a high failure rate and insufficient fraud controls, she said. The same panel heard that the federal identity model cannot keep up with AI-driven fraud.

Sources: FedScoop

–

By Cass Kennedy