Fraudulent accounts bypassed Login.gov identity checks, GAO warns

An auditor for the U.S. Government Accountability Office (GAO), Congress’ investigative arm, told a House subcommittee that fraudulent accounts had successfully gotten past the government’s Login.gov identity proofing process, and that technical problems reported by agencies using the system have not been fully resolved.

Marisol Cruz Cain, director of GAO’s Information Technology and Cybersecurity branch, told members of the House Committee on Oversight and Government Reform’s Subcommittee on Government Operations that in May 2025, the General Services Administration (GSA) “issued a contract modification for Login.gov that indicated the program’s Anti-Fraud Team determined that fraudulent accounts passed the identity proofing services and that the sophistication of the attempts would increase exponentially in the future.”

“The team’s assessment determined that the sophistication of these attempts would increase exponentially and that without the execution of an additional verification layer, the Login.gov platform would be at greater risk for fraud attacks,” Cain added.

Cain further warned that “GSA has not established time frames with its partners for addressing agency reported technical challenges,” and that “without GSA proposed actions and time frames for addressing the challenges, agencies will continue to experience technical issues with the system.”

Login.gov, launched in 2017, provides government-wide sign-on and identity verification. GSA received about $187 million from the Technology Modernization Fund in 2021 to expand the service, improve security and anti-fraud protections, and make it easier for agencies to adopt.

The finding of fraud is significant because Login.gov began offering identity proofing aligned with National Institute of Standards and Technology requirements in October 2024. By March 2025, GSA had completed testing of remote IAL2 identity proofing and made it available to all users. IAL2 is intended to establish that an applicant is associated with a specific real-world identity.

The online process relies heavily on outside verification services. GAO said Login.gov sends identity document information to LexisNexis Risk Solutions for document authentication and identity validation, uses the American Association of Motor Vehicle Administrators’ Driver’s License Data Verification Service, and sends names, Social Security numbers, dates of birth and telephone numbers to LexisNexis for phone validation.

Login.gov also offers fraud monitoring tools involving behavioral biometrics, which GAO said can analyze how people interact with their devices, including how they touch and move them, to distinguish legitimate users from potentially fraudulent activity.

GSA has made substantial progress on earlier GAO findings. The watchdog confirmed in July that the agency had begun annually testing Login.gov backups, completed its remote identity-proofing pilot and established a process for capturing lessons learned from pilot programs.

One significant recommendation remains unresolved.

“To combat these threats,” Cain said, “the Login.gov program has taken and plans to take steps to prevent fraud. According to its December 2025 Program Roadmap, a cross-agency Threat Intelligence Working Group was introduced to collaborate on threat-related issues, such as coordinated fraud campaigns. The goal of the group is to share information on cybersecurity, digital identity, and fraud in order to improve the government’s ability to detect and respond to fraud.”

GAO previously found that nine agencies reported technical problems including high failure rates, inadequate visibility into authentications and insufficient fraud controls.

GSA subsequently created a public roadmap and Partner Advisory Group, but GAO said it still has not demonstrated that the specific problems were fixed or established mutually agreed deadlines with participating agencies for resolving them.

“Without GSA-proposed actions and time frames for addressing the challenges, agencies will continue to experience technical issues with the system,” Cain said.

The report also shows GSA is treating fraud as an increasingly coordinated, government-wide problem, and warned that increasingly widespread breaches mean government agencies can no longer safely assume that possession of Social Security numbers, driver’s license information and other personal data establishes identity.

The watchdog has urged federal agencies instead to assume such information may already have been compromised and build stronger verification controls around it.

Article Topics

biometrics  |  digital identity  |  fraud prevention  |  GAO (Government Accountability Office)  |  Login.gov  |  remote identity proofing  |  U.S. Government