Login-dot-gov explores more device fingerprinting to combat fraud, AI agents and bots

The General Services Administration is seeking to combat identity fraud by adding more device fingerprinting to Login-dot-gov, the government’s unified account manager, according to contracting documents posted Tuesday.

The “sophistication and volume” of fraud attempts have grown as the service’s user base and agency adoption have expanded, the request for information said. While Login-dot-gov already uses fingerprinting within its identity verification flow, “there is an opportunity to enhance the platform’s comprehensive fraud prevention strategy,” documents said.

“This capability is essential for detecting sophisticated fraud attacks including account takeover, synthetic identity fraud, automated bot activity, residential proxy abuse, and emerging agentic [artificial intelligence] threats,” they said. 

Device fingerprinting identifies visitors through browser, device and network signals rather than just traditional identifiers like IP addresses or cookies, the request said. 

The solution GSA is exploring would integrate fingerprinting into account creation and sign-in, provide real-time risk signals for fraud detection and identify returning devices, “even when users attempt to evade detection through VPNs, residential proxies, incognito browsing, cookie clearing, or browser tampering,” the documents said.