The Audit Record on Login.gov: One Open Recommendation, One Missing Escalation Clock

If you have read that Login.gov’s identity proofing “failed its audit,” read the audit record first. The most recent Government Accountability Office statement on Login.gov, delivered as testimony to the House Oversight Subcommittee on Government Operations in July 2026, does not report a fresh failure of the identity check. It reports the status of prior recommendations—and the one recommendation GSA has not closed is not about whether the proofing works. It is about whether partner agencies have a clock for getting their problems fixed.

That distinction matters for anyone who sits in a procurement review, an oversight hearing, or an agency integration meeting. A program can pass its technical milestones and still be unaccountable to the agencies that depend on it. The GAO record shows exactly where that seam sits.

What Login.gov actually is, per the audit record

GSA launched Login.gov in 2017 as a government-wide single sign-on and identity verification service. According to GAO’s testimony, it uses a non-biometric, three-step process to verify identity, following guidelines from the National Institute of Standards and Technology (NIST). The three steps, as GAO describes them:

• Resolution: the applicant submits identifying information—name, address, date of birth, Social Security number, and often images of a driver’s license or passport—which the credential service provider compares against authoritative records to determine which specific person is being claimed.
• Validation: the provider checks that the submitted evidence is genuine, current, and represents a real identity—examining document images for alterations and checking that identification numbers follow standard formats.
• Verification: the applicant takes a photo of themself to match against the document photo, and an enrollment code is sent to a validated phone number to confirm possession and control of that number.

GAO notes that Login.gov began providing identity proofing aligned with NIST’s Digital Identity Guidelines in October 2024. That alignment was itself a remediation item, not the original state of the system.

The scale of the investment is worth holding alongside the governance questions: in 2021, GSA allocated about $187 million in technology modernization funds to enhance Login.gov, including security, anti-fraud protections, and ease of agency adoption.

The four challenges GAO previously reported

GAO’s testimony summarizes earlier findings about GSA’s implementation of Login.gov. The challenges it lists are specific:

1. Ensuring Login.gov data was backed up regularly to prevent data loss.
2. Aligning Login.gov with federal digital identity guidelines to provide an appropriate level of assurance when verifying users’ identities.
3. Resolving technical challenges reported by agencies using Login.gov.
4. Documenting and applying lessons learned from its Login.gov pilot programs.

Read that list as a governance map rather than a scorecard. Two items are internal engineering and documentation problems. One is a standards-alignment problem. And one—the third—is a shared-service interface problem: what happens when a partner agency reports that the central system is not working for its users.

What GSA has closed, and what remains open

According to the testimony, GSA has taken steps to implement all but one of GAO’s 2024 and 2025 recommendations. The agency provided evidence that it had begun testing processes for backing up Login.gov data, and it took steps to ensure Login.gov offers remote identity-proofing services that comply with federal digital identity guidelines.

The open recommendation is the one that sits at the partner-agency boundary. GAO states that GSA has not established time frames with its partners for addressing agency-reported technical challenges. The consequence GAO draws is direct: without proposed actions and time frames for addressing those challenges, agencies will continue to experience technical issues with the system.

This is the finding to carry into your next oversight conversation. It is not a claim that identity proofing is broken. It is a finding that the shared-service model lacks an agreed escalation clock—the mechanism by which a dependent agency can say “this defect is blocking our users” and get a dated commitment in return.

The fraud signal in the contract record

There is a second item in the testimony that deserves careful reading. GAO reports that in May 2025, GSA issued a contract modification for Login.gov indicating that the program’s Anti-Fraud Team determined that fraudulent accounts passed the identity proofing services, and that the sophistication of the attempts would increase exponentially in the future.

Treat this as what it is: a reported determination by the program’s own anti-fraud team, relayed through a contract modification and summarized by GAO. It is not an independent GAO finding, and the record retrieved here does not establish the scale of the problem. But it is consequential for oversight precisely because it comes from inside the program. When a system’s own fraud team reports that accounts it considers fraudulent cleared proofing, the right questions are about detection, redress, and notification obligations—not about declaring the system a failure or a success.

For practitioners, the useful move is to separate two questions that are often collapsed: Does the proofing mechanism meet the standard? and What happens when the operator’s own fraud team says it was defeated? The audit record addresses the first through NIST alignment. The second is a policy and contract question that the record leaves open.

Why the open item is the one that matters most

A recommendation status of “all but one” is easy to read as near-completion. Read it structurally instead. The closed items—backup testing, NIST alignment—are things the central provider can fix on its own. The open item is the one that requires the central provider to make commitments to someone else, on a schedule, in public. That is the harder governance work, and it is the work that determines whether partner agencies can plan around the service.

This is a pattern worth recognizing across shared public digital infrastructure. Centralization concentrates capability, but it also concentrates the risk of unresponsiveness. A partner agency that cannot get a dated commitment on a reported defect has no lever except escalation through oversight channels—which is slow, uneven, and unavailable to the individuals whose benefits or filings are blocked in the meantime.

GAO’s own framing supports this reading: the recommendation exists because without time frames, agencies will continue to experience technical issues. The remedy is procedural, and procedures are exactly what procurement and oversight can demand.

Questions to raise in your next procurement or oversight meeting

If your agency uses Login.gov, or if you are reviewing a contract for a shared identity service, these are the questions the audit record supports asking:

• Which recommendations remain open, and who owns each one? Ask for the current status of every GAO recommendation tied to the service, with the responsible office named.
• What is the escalation path for a partner-reported defect, and what are the time frames? A shared service should be able to show a documented triage and resolution schedule agreed with partner agencies—not just an internal backlog.
• When the anti-fraud team identifies accounts that passed proofing, what are the detection, redress, and notification obligations? Ask how those determinations are documented, who is informed, and what happens to affected individuals.
• How are partner agencies involved in change management? When the central provider modifies the service, what notice and testing windows do dependent agencies get?

The audit record on Login.gov is not a story of a failed ID check. It is a story of a program that has closed most of its technical gaps and has not yet closed the governance gap at the boundary with the agencies it serves. That gap is the one your oversight can actually reach.

Frequently asked questions

Did GAO find that Login.gov’s identity proofing failed?

No. The retrieved GAO testimony reports on the status of prior recommendations. It states that GSA has taken steps to implement all but one of GAO’s 2024 and 2025 recommendations, including steps to ensure remote identity proofing complies with federal digital identity guidelines. The open recommendation concerns the absence of agreed time frames with partners for addressing agency-reported technical challenges.

Is Login.gov’s identity proofing biometric?

GAO describes it as a non-biometric, three-step process. The verification step includes matching a selfie to a document photo and confirming control of a validated phone number, but the testimony characterizes the overall process as non-biometric.

What did the May 2025 contract modification say?

According to GAO, the modification indicated that Login.gov’s Anti-Fraud Team determined fraudulent accounts passed the identity proofing services, and that the sophistication of attempts would increase. The retrieved record does not establish the scale of that determination, and it is not an independent GAO finding.

What should a partner agency ask for first?

Ask for the documented escalation path and time frames for agency-reported technical challenges. That is the specific gap GAO identifies as unresolved, and it is the item most directly within a partner agency’s power to press.

Primary source: U.S. Government Accountability Office, testimony before the Subcommittee on Government Operations, Committee on Oversight and Government Reform, House of Representatives, GAO-26-109261, July 15, 2026. The testimony summarizes GAO’s October 2024 (GAO-25-106640) and June 2025 (GAO-25-107000) reports on Login.gov’s identity proofing processes.