Login.gov explores persistent device fingerprinting to strengthen fraud detection

The U.S. General Services Administration (GSA) is exploring a new device fingerprinting capability for Login.gov that could recognize returning computers and phones even when users change IP addresses, delete cookies, browse in private mode or use technologies intended to obscure their devices.

The Request for Information, issued by GSA’s Technology Transformation Services, seeks vendors offering device intelligence and fingerprinting technology that could supplement fraud controls already used by Login.gov. Responses are due September 11.

The draft requirements remain subject to change, but they show that GSA is considering a fraud detection layer built not only around what credentials a user presents, but around whether Login.gov recognizes the device behind them, what techniques that device is using to conceal itself and how its activity compares with what the system has seen before.

Despite the terminology, the “fingerprinting” contemplated by the RFI does not involve physical fingerprints. Device fingerprinting attempts to distinguish one computer, phone or browser from another by analyzing combinations of browser, device and network characteristics.

GSA says Login.gov already uses device fingerprinting during identity verification but is considering extending complementary device intelligence to other parts of the user journey, including account creation, sign-in and the conclusion of identity verification.

The draft requirements call for a persistent device identifier that remains associated with the same device across sessions.

The technology would have to recognize returning devices despite VPN use, private or incognito browsing and cookie deletion.

It also needs to identify devices using Apple’s iCloud Private Relay, detect browser tampering and device-attribute spoofing, and recognize traffic routed through residential or data center proxies.

The system would generate real-time risk signals intended to help Login.gov distinguish trusted visitors from potentially fraudulent ones.

GSA wants detection of automated and headless browsers, anti-detect browsers, VPNs, virtual machines, Tor traffic and attempts to spoof location or time zone information.

Mobile requirements include detection of rooted or jailbroken devices, cloned applications, geolocation spoofing and tampered requests.

Those indicators could be combined into a configurable risk score, with Login.gov able to adjust how much weight individual signals receive.

One of the RFI’s more consequential provisions asks whether all generated device identifiers, risk scores, risk indicators and event details can be exported so the government can conduct its own historical and behavioral analysis of retained information.

The RFI calls this “pattern-of-life” analysis and asks vendors whether data could be provided through streaming, batch transfers, webhooks or APIs, potentially in real time.

The RFI also reflects GSA’s concern about autonomous AI.

The system would need to distinguish humans from legitimate automation and malicious bots, including credential stuffing tools and scrapers.

GSA also wants detection of AI agents operating autonomously for people or organizations, explicitly citing agents based on ChatGPT, Claude and Gemini, along with AWS, Microsoft and Google cloud AI services and autonomous browsing tools. For detected AI agents, the system would identify the provider and product, determine whether the agent’s identity has been verified and whether its requests contain valid authentication credentials.

Login.gov would then be able to allow approved agents, block suspicious ones, challenge unverified agents, impose rate limits and log their interactions.

GSA says the capability should function as a targeted component rather than requiring Login.gov to adopt another broad fraud management platform.

The agency also wants to know whether the system can operate within a government-controlled environment without sending user data to a non-FedRAMP external service.

Article Topics

AI agents  |  device fingerprinting  |  digital identity  |  GSA  |  Login.gov  |  procurement  |  RFI  |  U.S. Government