Login.gov adds mobile driver’s licenses as AI fraud reshapes federal identity proofing

The General Services Administration (GSA) said in an announcement that Login.gov can now accept eligible mobile driver’s licenses stored in Google Wallet and Samsung Wallet , with support for additional digital wallets planned. Login.gov’s current list of accepted identity documents now includes an mDL or state ID in a digital wallet alongside physical state IDs and U.S. passport books and cards. Availability depends on the user’s state, device and wallet.

The change is significant beyond convenience. Instead of relying on an uploaded image of a physical identity document to determine whether that document is authentic, the mDL pathway allows Login.gov to cryptographically authenticate the credential and verify it has not been altered. GSA said the approach provides additional protection against fraud techniques including AI-generated deepfakes and counterfeit identity documents , threats that are increasingly challenging identity verification systems built around photographs of physical documents and faces.

The agency also said users can preview the identity information requested and disclose only the attributes needed for verification. The mDL option is voluntary and, according to GSA, is narrowly limited to identity proofing for access to government services. As of March, GSA said 20 states and one U.S. territory offered mDLs, potentially covering about 71.5 million drivers, with roughly 8 million people already using them.

The credentials are not universally available through Login.gov because state issuance, device and digital wallet support vary. The rollout was expected. In its December 2025 program roadmap , Login.gov said it was working with the National Institute of Standards and Technology (NIST) and its National Cybersecurity Center of Excellence to integrate verifiable digital credentials such as mDLs during 2026.

The roadmap also described a potentially more consequential change to identity proofing than simply replacing a plastic license with its digital equivalent. GSA said the planned mDL workflow would eliminate both photo capture of the identity document and the selfie step, reducing user friction while substituting cryptographic credential validation for some of the image analysis required during conventional remote proofing. The roadmap said the change also would reduce repeated document capture attempts and strengthen defenses against forged credentials.

Login.gov’s current public help documentation does not yet explain the mDL-specific proofing sequence in comparable detail. Its general identity verification instructions now list an mDL among accepted credentials but still describe the conventional process of photographing an ID and, in some cases, taking a selfie. GSA’s December roadmap specifically identified elimination of both document-photo capture and the selfie step as benefits of the planned mDL workflow.

The current instructions also indicate that presenting an mDL does not necessarily mean the digital credential becomes the only source used to establish identity. Login.gov says users verifying their identities generally also need a Social Security number and a U.S. phone number or mailing address, and that personal information is checked against public and proprietary records. The public documentation does not yet spell out how those steps differ, if at all, for an mDL transaction.

GSA’s March 2026 Privacy Impact Assessment (PIA) says Login.gov uses the American Association of Motor Vehicle Administrators to validate driver’s license data and the State Department to validate passport data, along with third-party services from LexisNexis and Socure. It says the identity verification and fraud detection services supplied by LexisNexis and Socure use products developed through machine-learning models, although Login.gov verification transaction data is not used to further develop those models. When required by a partner agency, a self-photograph can be compared with the portrait on a user’s state-issued ID by a third-party identity verification service.

The PIA says Login.gov also uses document authentication, records checks, address confirmation, in-person verification and fraud controls, depending on the level of assurance required by the government service. The mDL pathway does not mean that biometrics, commercial identity technology or records checks are disappearing from Login.gov as a whole. It introduces another form of identity evidence in which cryptographic verification can potentially remove some of the document-image and facial-matching steps associated with conventional proofing.

The March PIA predates the production mDL rollout and does not describe how mDL-derived information is handled or retained specifically, leaving unanswered questions about what information Login.gov receives from a digital wallet, what is retained following an mDL transaction, and which subsequent records checks and fraud controls are applied. Meanwhile, GSA has substantially expanded the commercial identity infrastructure supporting Login.gov. On May 1, GSA awarded LexisNexis Risk Solutions call orders valued at approximately $218 million across Login.gov’s next-generation remote identity-proofing program.

About $55 million covers document authentication, validation and biometric identity verification, while a roughly $163 million award covers identity resolution, attribute validation, behavioral intelligence and fraud detection, according to LexisNexis. Xcelerate Solutions and subcontractor Socure separately received a five-year, $163 million call order, also awarded May 1, for identity resolution, attribute validation, fraud detection, behavioral analytics and digital intelligence. The multiple awards are part of Login.gov’s multi-vendor next-generation identity-proofing acquisition.

The National Cybersecurity Center of Excellence has been developing the technical foundation for the mDL shift with Login.gov. Earlier this year, NIST announced a government-services phase of its mobile driver’s license project intended to demonstrate how mDLs could be used to establish identity for access to state and federal services, including Login.gov. In August, NIST said it had developed with GSA a reference architecture for citizen-to-government use of mDLs and that Login.gov would demonstrate an “enhanced, cryptographically verified identity verification process” backed by the credentials.

The mDL rollout is arriving at an especially consequential moment for Login.gov. On August 31, the Office of Management and Budget (OMB) issued Memorandum M-26-18 , which calls Login.gov the government’s “universal sign-on” and requires agencies to offer it as a sign-on option on in-scope public-facing websites that require authentication. Covered High Impact Service Provider websites generally have one year to implement it, while other existing in-scope websites generally have two years, absent the notice to OMB required by the memorandum.

For covered services that also require identity verification, agencies must use Login.gov’s identity-verification service unless they determine that it cannot meet requirements specific to the service’s user base, risk profile or operations. Agencies may continue offering other identity solutions under specified circumstances, but Login.gov is to be promoted as the default option for new accounts where it can serve the population. At the same time, GSA has been examining new ways to assess not just the credential a person presents, but the device and behavior behind a Login.gov transaction.

An August Request for Information sought information on technology capable of assigning persistent identifiers to computers and phones and recognizing returning devices across sessions despite efforts to obscure or alter identifying signals. The draft requirements also contemplated detection and classification of autonomous AI agents associated with systems such as ChatGPT, Claude, and Gemini, along with device recognition designed to persist despite changes in IP addresses, deleted cookies, private browsing, and other attempts to disguise a returning device. GSA’s current privacy documentation shows that device and behavioral information already plays a role in Login.gov’s fraud defenses.

The March PIA describes fraud mitigation involving device characteristics and other risk signals alongside identity information and records checks.