Fake People Walked Right Through the Government's ID Check — and Your Bank Is Next

Somewhere in the last year, someone created a fake account using a stolen identity, walked it right through the federal government's ID-checking system, and nobody caught it until auditors went looking. Not a hacker in a hoodie breaking down a firewall — just a fraudulent account, moving through the front door like it belonged there. That's the part that should bother you.

Login.gov is the system a lot of federal agencies use so you can prove you're really you before you get into your account for things like taxes, benefits, or veteran services. Think of it as the bouncer standing between you and your own government paperwork. The Government Accountability Office (GAO) — basically the government's internal fact-checker — just published a report saying that bouncer let some fake people through. Not hypothetically. It happened, and it happened enough times that GSA (the agency that runs Login.gov) had to go back and change its contract in response.

Wait — how does a fake person get through an ID check?

Here's the uncomfortable truth: identity checks like this one don't actually know you. They know your paperwork. Login.gov's system checks whether a name, birthdate, Social Security number, and a photo of an ID document line up in a way that looks legitimate. If a scammer already has your stolen personal information — and millions of people's information has been stolen at this point — they can sometimes assemble a profile that passes the check, even though the human on the other end isn't you at all.

According to the GAO's official report, "GAO-26-109261," titled Identity Verification: GSA Needs to Address Fraud Threats and Technical Issues, the agency's own Anti-Fraud Team confirmed back in May 2025 that fraudulent accounts had made it through the identity-proofing process. That's not an outside researcher poking holes in the system for fun. That's the government catching its own front door standing open. This article is part of a series — start with Your Rewards Points Just Became A Bribe For Your Face.

GAO investigators have urged federal agencies to assume that personal information used in identity verification may already be compromised — and to build stronger checks around that assumption, rather than treating a passed identity check as proof of a real, safe user. — summarized from Biometric Update

Let that sink in for a second. The government's own advice isn't "trust the check more." It's "assume the information behind the check might already be in a criminal's hands." That's a pretty stunning thing for a watchdog to say out loud about a system millions of people rely on to file taxes and collect benefits.

The part that should worry you isn't the hack. It's the trade-off.

Here's where it gets interesting, and honestly a little maddening. Every identity system is a balancing act between two failures: let too many real people get locked out of their own accounts, or let too many fake people sneak in. Tighten the check, and grandma can't get into her Social Security account because her ten-year-old driver's license photo doesn't match her face anymore. Loosen it, and a scammer with your stolen data walks right through.

Login.gov didn't even start offering the stronger version of its identity check — the one that meets the federal government's own security guidelines — until October 2024. Full testing of that stronger version wasn't finished until March 2025. And then, just two months later, GSA's own fraud team discovered fake accounts had gotten through anyway. The fix arrived, and the problem showed up right behind it, wearing a mask.

That timeline matters because it tells you something important: audits and fixes move slower than the people trying to break in. The bad guys don't wait for you to patch the hole. They're already testing the next one. Previously in this series: Facial Recognition Wrongful Ejection Retail Stores.

So — does more verification actually protect you?

Sometimes. Not automatically. That's the uncomfortable nuance nobody wants to sit with, because "more security questions" feels like more safety, the same way a longer password feels safer even if you just wrote it on a sticky note. Authority makes us relax. If a federal system, a bank, or an official-looking email says "we need to verify your identity," most people's instinct is to comply, fast, because pushing back feels like you're the one doing something wrong.

That instinct is exactly what scammers count on. If you've ever gotten a text saying "Unusual login detected — verify your identity now" and felt your stomach drop before you even thought about whether it was real, you already know how this works. The GAO report is basically confirming what a lot of security researchers have said quietly for years: the appearance of a security process and the actual strength of that process are two different things, and companies (and yes, agencies) don't always have a strong incentive to make you notice the gap.

If you've ever wondered whether a "verify your identity" request landing in your inbox is really coming from the institution it claims to be, that's the exact question this whole industry exists to answer — and it's worth taking seriously every single time, not just the first time.

Here's one thing you can actually do, starting tonight: never verify your identity through a link, call, or text you didn't ask for. If your bank, the IRS, or Login.gov itself needs something from you, close the message, open a browser yourself, and type in the real website address you already know. Real verification requests can wait five extra minutes for you to check independently. Fake ones can't — that urgency is the whole scam. Up next: Digital Identity Verification Three Layer Process Explained.

What happens next

Expect the "prove it's you" prompts to multiply. Agencies under pressure from reports like this one are going to respond the way institutions always respond to a watchdog report: add more steps. More document uploads, more one-time codes, more "please confirm your address," more everything. Some of that will genuinely help. Some of it will just be friction dressed up as security, giving everyone the feeling of protection without necessarily closing the gap fraudsters already found.

The GAO's own conclusion is blunt about where this goes if nothing changes: the sophistication of fraud attempts against systems like this will keep climbing, not leveling off, unless agencies build in stronger layers instead of just checking a compliance box. GSA has fixed most of the GAO's earlier recommendations, to be fair — this isn't a system standing completely still. But "most" isn't "all," and the fraud discovery happened after the compliance milestone, which tells you the finish line keeps moving.

Somewhere out there, a fraudster is sitting on a stolen Social Security number and a scanned driver's license, waiting for the next system that asks for exactly those two things to feel safe enough to trust. The GAO just proved that waiting works. So the real question isn't whether you'll be asked to prove your identity again soon — you will. It's whether the thing asking has any better idea of who you actually are than the last one did.