The federal government's system for verifying who receives taxpayer money is so weak that fraudsters can slip through with minimal effort, a new Government Accountability Office report warns. The GAO found that the General Services Administration and other agencies have failed to implement consistent, reliable identity verification, leaving billions of dollars in federal spending vulnerable to theft.
The findings land at a moment when fraud across federal programs has already reached staggering levels. During the pandemic alone, criminals exploited loose controls to siphon off enormous sums from unemployment insurance, small business loans, and other emergency programs. The GAO's latest audit makes clear that the underlying vulnerabilities have not been fixed.
The GAO report, first reported by Just the News, examined how federal agencies verify the identities of individuals and entities seeking access to government systems, benefits, and contracts. The watchdog concluded that GSA, which manages Login.gov and other shared services used across the federal government, must strengthen its identity verification policies to help prevent fraud.
Login.gov serves as a single sign-on platform that lets the public access participating government agencies' websites and applications. Millions of Americans use it to interact with federal services. The GAO found that the platform's identity-proofing processes did not consistently meet National Institute of Standards and Technology guidelines, the federal benchmark for secure digital identity verification.
That gap matters because Login.gov is not some obscure back-office tool. It is the digital front door for dozens of federal agencies. When its verification standards fall short, every program that relies on it inherits the same weakness.
The GAO's findings fit a broader pattern of federal agencies failing to screen out bad actors before money goes out the door. A federal fraud-screening tool already exists, yet adoption across agencies and state partners has been inconsistent at best. The result is a system that practically invites exploitation.
The watchdog agency issued several recommendations aimed at tightening GSA's identity verification framework. These include aligning Login.gov's proofing processes with NIST standards, improving oversight of how agencies use shared identity services, and establishing clearer accountability when verification failures occur.
GSA generally agreed with the GAO's recommendations, though the agency's timeline for implementation remains unclear. The GAO noted that until these changes take effect, the federal government will continue operating with identity verification gaps that fraudsters have already proven they can exploit.
The stakes are not theoretical. Federal investigators have spent years cataloging the damage caused by weak identity controls during the pandemic spending surge. Fraudulent unemployment claims alone cost taxpayers tens of billions of dollars. Criminal rings, including some operating overseas, filed claims using stolen or fabricated identities that state and federal systems failed to catch.
The problem extends well beyond unemployment. The DOJ recently charged 455 defendants in a record $6.5 billion health care fraud sweep spanning 41 states, a case that illustrated how porous identity controls enable fraud at industrial scale. When the government cannot confirm who is on the other end of a transaction, every program becomes a target.
Identity theft does not just drain the treasury. It harms real people whose personal information gets weaponized. Stolen identities have been used to file fraudulent tax returns, open lines of credit, and even obtain medical care under someone else's name. The consequences for victims can be devastating and long-lasting, as medical identity theft cases have shown in alarming detail.
Login.gov launched with a straightforward promise: give Americans one secure account to access government services, while giving agencies a reliable way to verify that users are who they claim to be. The platform now serves more than 100 million accounts across dozens of agencies.
But the GAO found that GSA had not ensured Login.gov met the identity assurance levels required by NIST Special Publication 800-63, the federal standard for digital identity verification. That standard establishes three levels of identity assurance, each requiring progressively stronger evidence that a person is real and is who they claim to be.
For high-value transactions, such as accessing tax records, applying for benefits, or managing federal contracts, NIST calls for the highest assurance level. The GAO's audit raised concerns that Login.gov's proofing process did not consistently reach that bar, meaning some users could pass verification without providing the level of evidence the standards require.
The distinction between "good enough" and "standards-compliant" identity proofing might sound technical. In practice, it is the difference between catching a fraudster before they access a system and catching them after the money is gone.
The GAO report also highlighted a coordination problem. Multiple federal agencies rely on Login.gov, but each agency has its own risk tolerance and its own rules about what level of identity assurance it needs. GSA's role is to provide a platform that can meet the highest common standard. When the platform falls short, agencies that assumed they were getting strong verification may not realize they are exposed.
This kind of assumption gap has fueled fraud across the federal government for years. Watchdog reports from inspectors general at the Small Business Administration, the Department of Labor, and other agencies have repeatedly flagged identity verification as a root cause of improper payments. The GAO's findings suggest the problem is structural, not confined to any single agency or program.
The vulnerability is compounded by the sheer scale of data already compromised. Declassified records have alleged that foreign actors harvested hundreds of millions of Americans' personal records, providing raw material for identity fraud on a scale that overwhelms any system built around basic name-and-date-of-birth checks.
The GAO made specific recommendations to GSA, including strengthening Login.gov's identity-proofing process to meet NIST standards, improving documentation of how identity assurance levels are assessed, and establishing stronger oversight mechanisms to catch gaps before they are exploited.
GSA's general agreement with the recommendations is a positive signal, but agreement and implementation are two different things. Federal agencies have a long history of accepting watchdog recommendations on paper while dragging their feet on execution. The GAO tracks implementation rates, and many recommendations related to fraud prevention have languished for years.
The broader question is whether the federal government can move fast enough to close these gaps before the next wave of fraud hits. Emergency spending programs may have receded from pandemic peaks, but federal benefits, contracts, and grants continue to flow at enormous volume. Every dollar that reaches a fraudster is a dollar taken from a legitimate recipient or from taxpayers.
Previous watchdog findings have shown that fraudsters exploited policy gaps to steal billions in taxpayer funds, and the pattern will repeat until verification systems catch up with the sophistication of the criminals targeting them.
The GAO's report adds to a growing body of evidence that identity verification is not a side issue in federal fraud prevention. It is the front line. If the government cannot reliably confirm who is requesting money, no amount of after-the-fact auditing will stem the losses.
Congress has shown intermittent interest in the problem, with hearings and legislative proposals aimed at modernizing federal identity systems. Whether this latest GAO report generates sustained pressure remains to be seen. Lawmakers on both sides have expressed frustration with pandemic-era fraud, but translating that frustration into binding requirements for agencies like GSA has proven difficult.
For now, the GAO has laid out the problem in plain terms: the systems the federal government uses to verify identity are not meeting the standards the federal government itself has set. The gap between policy and practice is where fraud lives.
When the front door does not lock, it is not a question of whether someone will walk in uninvited. It is a question of how much they will take before anyone notices.
