ESBD_551287_1787088856649_RFI 304-27-081826AK Anti-Fraud Services.pdf

RFI 304-27-081826AK

RFI 304-27-081826AK – Anti-Fraud Services

DON HUFFINES

TEXAS COMPTROLLER OF PUBLIC ACCOUNTS

Request for Information (RFI) for

Anti-Fraud Services

RFI No. 304-27-081826AK

August 18, 2026

Schedule of Events

August 18, 2026 Issuance of RFI

August 28, 2026 Deadline for Submission of Questions (2:00 p.m., CT)

September 4, 2026 Release of Answers to Questions

(or as soon thereafter as practical)

September 16, 2026 Deadline for Submission of Responses (2:00 p.m. CT)

Late Responses will not be considered

A. Summary

1. Type of Document: Request for Information (RFI)

2. Deadline for Responding to RFI: September 16, 2026 @ 2:00 p.m., Central Time (CT)

Respondents are solely responsible for ensuring receipt of their Responses at the emails addresses specified in Section A.4 on or before the specified deadline; late Responses will not be considered.

3. CPA Point of Contact for this RFI: Alexander Kost, CTCD/CTCM

Email: researchcpa@cpa.texas.gov

4. Method of Submitting Responses: Responses must be submitted by email to

Email: researchcpa@cpa.texas.gov

5. RFI Addenda: CPA will post any amendments to this RFI as addenda on the Electronic

State Business Daily (ESBD) located at http://www.txsmartbuy.com/esbd. It is the responsibility of an interested party to periodically check the ESBD for updates to the RFI prior to submitting a RFI Response.

6. Questions and Answers: Questions regarding this RFI must be submitted in writing to CPA’s Point of Contact, Alexander Kost, at researchcpa@cpa.texas.gov, no later than

August 28, 2026; 2:00 p.m. CT. Telephone inquiries will not be accepted. CPA intends to post answers to questions received on the

ESBD on or about September 4, 2026.

7. Respondent Presentations: In CPA’s sole discretion and to assist with additional information gathering, CPA may invite Respondents to give a presentation to explain in further detail the recommendations made, or information provided in the RFI Response. Any presentation(s) will be performed virtually or at

CPA offices located in the LBJ Building, 111 E. 17th Street, Austin, Texas

78774; presentation date(s) and time(s) to be arranged.

B. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Information

(RFI) to solicit information from the public about commercially available solutions for remote identity verification and fraud prevention.

CPA is conducting this market research to better understand commercially available solutions, capabilities, implementation approaches, and pricing models that may enhance the agency’s ability to remotely verify individuals and identify potentially fraudulent activity.

C. Background

CPA currently utilizes a fraud screening process that incorporates various data sources, to identify potentially suspicious claims. This initial screening process generates risk indicators that may result in a claim being referred for additional investigation.

mailto:bidcpa@cpa.texas.gov mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd mailto:bidcpa@cpa.texas.gov

The agency processes a high volume of claims annually, with the combined volume across the applicable business areas estimated at approximately 350,000 claims per year. The volume of claims that would ultimately require secondary identity verification is currently undetermined.

CPA is seeking to enhance this process by adding a secondary layer of remote identity verification and fraud analysis for cases requiring further review, along with the ability to verify official documents issued by foreign entities. The agency's objective is to provide personnel with additional information and evidence to assess whether an individual is the legitimate claimant or applicant, particularly when the individual is not physically present.

The desired solution should provide a flexible approach to remote identity verification and fraud prevention. Depending on the respondent’s recommended approach, relevant capabilities may include identity verification and proofing, advanced biometric liveness detection, detection of deepfakes and other presentation attacks, device intelligence, fraud analysis, and risk or confidence scoring. CPA is open to comprehensive, modular, or layered approaches that can work with existing processes and adapt over time to address emerging fraud patterns, evolving threats, and changes in technology.

D. Definitions and Acronyms

• Advanced Liveness Detection: Liveness verification capabilities designed to detect more sophisticated presentation or injection attacks, including techniques involving deepfakes, synthetic or AI-generated imagery, virtual cameras, or other attempts to circumvent conventional liveness detection. Advanced liveness capabilities may utilize passive, active, hybrid, or other methods.

• Active Liveness Detection: A liveness verification method that requires an individual to perform a specific action or respond to an interactive prompt, such as turning their head, blinking, or following other instructions, to demonstrate that they are a live person.

• AI (Artificial Intelligence): Technologies that enable computer systems to perform tasks that typically require human intelligence, including analysis, pattern recognition, decision-making, or detection of potentially fraudulent activity.

• API (Application Programming Interface): A defined method through which software applications communicate with and exchange data with one another.

• FedRAMP (Federal Risk and Authorization Management Program): A U.S. government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring of cloud products and services.

• ISO 27001: An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system.

• Passive Liveness Detection: A liveness verification method that evaluates an individual's facial characteristics or other biometric signals without requiring the individual to perform a specific action or follow an interactive prompt.

• PII (Personally Identifiable Information): Information that can be used to identify, distinguish, or trace an individual, either alone or when combined with other information.

• RFI (Request for Information): A procurement market research document used to obtain information from potential vendors regarding available products, services, capabilities, approaches, and other relevant market information. An RFI is not a solicitation and does not constitute a commitment to purchase.

• SDK (Software Development Kit): A collection of software development tools, libraries, documentation, and other resources used to develop or integrate software applications.

• SOC 2 (System and Organization Controls 2): An auditing framework used to evaluate controls relevant to security, availability, processing integrity, confidentiality, and privacy of information and systems.

• TxRAMP (Texas Risk and Authorization Management Program): The State of Texas program for assessing and authorizing the security of cloud computing services used by Texas state agencies.

• VPN (Virtual Private Network): A technology that creates an encrypted network connection and can alter or obscure the apparent network location of a user or device.

E. Scope

1. Company and Solution Overview

a) Provide a brief overview of your company, including years in business, primary service offerings, and experience providing identity proofing or fraud prevention solutions.

b) Describe the solution(s) you recommend for this use case. If your recommended approach includes multiple products, modules, or third-party technologies, describe how they work together.

c) Identify any federal, state, or local government agencies currently using your solution for identity verification, fraud prevention, or similar investigative purposes.

d) Identify any active Texas Department of Information Resources (DIR) contracts through which your proposed solution or services are available, if applicable. Include the DIR contract number and a brief description of the products or services available through the contract.

2. Identity Verification

a) Describe how your solution verifies the identity of an individual who is not physically present.

b) Describe the types of identity documents your solution can validate (e.g., driver's licenses, state IDs, passports, Permanent Resident Cards, domestic and foreign passports and other foreign identification documents).

c) Describe any capabilities to verify or compare identity information using authoritative data sources or historical identity records.

d) Describe how your solution detects altered, forged, expired, invalid, or otherwise suspicious identity documents.

e) Describe the geographic coverage of your identity verification solution, including verification capabilities for individuals within the United States and from foreign countries, and the number of foreign countries supported.

f) Describe how far back your solution can access or validate identity information, including any availability of historical records, legacy data sources, or archival identity documentation.

g) Describe any limitations or prerequisites associated with your identity verification capabilities.

3. Biometric Liveness Detection

a) Describe the liveness detection technologies utilized by your solution.

b) Describe how your solution detects presentation attacks, spoofing attempts, synthetic identities, deepfakes, AI-generated imagery, virtual cameras, or similar fraudulent techniques.

c) Describe whether your solution utilizes passive, active, advanced, hybrid, or other liveness verification methods.

d) Describe any independent testing, certifications, or standards applicable to your liveness technology.

e) Describe how investigators can review the results of the liveness verification process.

4. Device Intelligence and Fraud Signals

a) Describe the device intelligence capabilities included with your solution.

b) Describe the types of device or behavioral indicators analyzed during identity verification, including but not limited to:

1. Device fingerprinting

2. Emulator detection

3. Virtual machines/devices

4. Virtual agents

5. Spoofed user-agents

6. Synthetic devices

7. Device spoofing

8. Browser anomalies

9. VPN or proxy detection

10. Geolocation anomalies

11. Rooted or jailbroken devices

c) Describe how device intelligence contributes to overall fraud detection or confidence scoring.

5. Fraud Analysis and Risk Assessment

a) Describe how your solution evaluates the overall confidence that a claimant is the legitimate individual.

b) Describe the risk scoring or confidence scoring methodology provided to investigators.

c) Describe what supporting evidence is available to explain the assigned score.

d) Describe any artificial intelligence or machine learning capabilities used to detect fraudulent activity.

e) Describe any automated workflows, decisioning, or other functions that can reduce the need for manual investigation.

f) Describe how investigators can distinguish between low-risk and high-risk verification results.

g) Describe how your solution is updated and improved to address emerging fraud patterns, new attack methods, evolving technologies, and other threats. Include the frequency and general process for deploying updates.

6. Investigator Experience

a) Describe the investigator workflow following completion of identity verification.

b) Describe the reports, dashboards, audit logs, and evidence available to investigators.

c) Describe whether evidence can be exported or retained for investigative or legal purposes.

d) Provide sample screenshots or reports, if available.

e) Describe any case management or investigative workflow capabilities included with the solution.

7. Integration and Technical Architecture

a) Describe the overall architecture of your solution.

b) Describe available APIs, SDKs, or other integration methods.

c) Describe how your solution integrates with existing claims management or fraud detection systems.

d) Describe available integration capabilities with Salesforce, including APIs, connectors, supported integration methods, and any prerequisites or limitations, if applicable.

e) Describe authentication methods and identity management options supported by your solution.

f) Describe any implementation prerequisites or customer infrastructure requirements.

8. Security and Compliance

a) Describe your security architecture and controls.

b) Identify any applicable certifications or compliance programs, including but not limited to TxRAMP, FedRAMP, SOC 2, ISO 27001 or other relevant standards.

c) Describe how biometric information and personally identifiable information (PII) are secured, retained, and disposed of.

d) Describe audit logging capabilities available within the solution.

9. Implementation and Support

a) Describe your recommended implementation approach.

b) Provide a typical implementation timeline for an organization of similar size and complexity.

c) Describe the implementation services provided by your organization.

d) Describe available training, documentation, and ongoing technical support.

e) Describe your standard service level commitments and support options.

10. Licensing and Commercial Information

a) Describe your licensing and pricing methodology (e.g., subscription, transaction-based, per user, enterprise licensing).

b) Identify any optional modules or services that are licensed separately.

c) Describe any implementation or professional services typically associated with your solution.

d) Identify any assumptions that significantly affect pricing or implementation.

e) Provide, if available, indicative or budgetary pricing for the proposed solution, including any assumptions regarding transaction volume, number of users, implementation, optional capabilities, contract term, or other factors that materially affect pricing.

11. Future Direction and Industry Best Practices

a) Describe emerging technologies or industry trends that organizations evaluating identity proofing and anti-fraud solutions should consider over the next three to five years.

b) Describe any capabilities you believe differentiate your solution from other commercially available offerings.

c) Provide any additional information or recommendations that would assist CPA in understanding the current marketplace.

F. Required RFI Response Materials

Respondents must email an RFI response titled “Response to Anti-Fraud Services RFI” to the designated CPA Point of Contact on or before the deadline for Responses (see Section A.2) and as otherwise required by Section A (Summary) of this RFI. The RFI Response should include the items listed below and be organized in the following manner:

• Entity’s name and address.

• If applicable, the organization the Respondent is a member of included in the email subject line.

• Point of contact information for Respondent regarding its RFI Response (i.e., name, title, telephone number and email address of Respondent’s designated personnel).

• A brief summary describing each item requested in Section E of this RFI, in the order listed.

• Any other information that the Respondent deems pertinent or relevant to this RFI (e.g., brochures or other company literature).

• RFI responses must be submitted via email to researchcpa@cpa.texas.gov

G. No Award Results from this RFI

This RFI is issued solely for the purpose of obtaining information. This information may assist CPA in determining activities that may be requested in a future solicitation, and no contract will be awarded in connection with this RFI.

CPA is under no obligation to issue a solicitation. Respondent’s submission of a Response is voluntary and failure to respond will have no impact on the evaluation of responses to any subsequent solicitation.

H. No Compensation or Cost Recovery

CPA shall pay no costs, expenses, or any other amounts to any entity that are incurred under or related to this RFI.

I. Ownership of Responses, Copyright, Public Nature of Responses mailto:bidcpa@cpa.texas.gov

Responses to this RFI will be the property of CPA. CPA, in its sole discretion, may consider or disregard any information submitted in a Response to this RFI. Responses to this RFI will not be returned to Respondents. Responses will be public information and available for public inspection without redaction. Consequently, a Respondent should not submit any information in its Response that is asserted by Respondent to be confidential or proprietary.

In the event CPA receives a request for portions of a Response marked as confidential CPA shall forward the request to the Attorney General for an opinion on whether CPA may withhold such information from disclosure under the

Texas Public Information Act. CPA will notify the Respondent whose Response is the subject of the request when the information is forwarded to the Attorney General. CPA assumes no obligation for asserting legal arguments on behalf of a Respondent.