The General Services Administration must take additional steps to strengthen its Login.gov identity verification platform or risk continuing to leave federal agencies vulnerable to fraud and identity theft, according to findings in a new Government Accountability Office report.

In the report, titled "GSA Needs to Address Fraud Threats and Technical Issues," the watchdog said GSA has made progress implementing most of its previous recommendations but has yet to fully adopt clear plans and timelines for resolving technical problems with Login.gov that federal agencies have reported. 

Growing number of cyberattacks and data breaches has made the need for stronger safeguards essential

GAO warned that without those changes, agencies across the federal government could continue to experience security and operational weaknesses that increase the risks of fraud. "Without GSA-proposed actions and timeframes for addressing the challenges, agencies will continue to experience technical issues with the system," the report read.

Login.gov serves as the federal government's central identity verification service, allowing members of the public to securely access government websites and services. The platform was created to help agencies confirm users' identities while protecting sensitive personally identifiable information (PII).

GAO said the growing number of cyberattacks and data breaches has made the need for stronger safeguards essential, given that stolen personal information can be used to commit fraud across multiple government programs.

"The proliferation of cyberattacks on federal agencies and other organizations has led to an increased risk of stolen personally identifiable information (PII) being used to commit fraud," GAO wrote. The report noted that criminals have used stolen data to fraudulently obtain government benefits, redirect Social Security payments and open financial accounts in victims' names.

The watchdog also noted that identity theft can lead to financial losses for victims and reputational damage for government agencies.

"In this type of fraud, thieves use identifying data, such as Social Security numbers and driver’s license numbers, to open new financial accounts without a person’s knowledge. These types of attacks can result in financial loss and damage to the reputation of federal agencies and financial institutions," GAO said. "Protecting PII and preventing identity theft is critical, as the harms can range from lost funds to emotional distress," GAO also said.

Still undergoing tests, but GSA has failed to implement recommendations

GAO reviewed several previous findings involving Login.gov, including whether the system regularly backed up user data, complied with federal digital identity standards, addressed technical issues reported by agencies and documented lessons learned from pilot programs.

Congress provided approximately $187 million through the Technology Modernization Fund in 2021 to expand Login.gov's capabilities, including improving security, strengthening anti-fraud protections and making it easier for agencies to adopt the service.

While the agency has addressed most of those concerns, it is still testing Login.gov's data backup processes and whether the remote identity-proofing services fully comply with federal digital identity guidance. GAO said the agency has not fully implemented one of its key fraud-fighting recommendations.

"Specifically, GSA has not established timeframes with its partners for addressing agency-reported technical challenges. Without GSA-proposed actions and timeframes for addressing the challenges, agencies will continue to experience technical issues with the system," read the report, referencing Login.gov.

The report said fully implementing the remaining recommendation "would help the federal government ensure PII is better protected and lessen the risk of identity theft."

GAO said it will continue to track GSA's efforts to address the outstanding recommendation as the Login.gov platform remains a cornerstone of identity verification for a host of federal agencies.