Assuring Digital Identity: from passport checks to digital trust
Banks, insurers, and government bodies still largely rely on physical documents for personal identification. Sending selfies, scanning passports, filling in forms—it’s error-prone, costly, and vulnerable to fraud. The EU Digital Identity aims to put an end to this. TNO is developing methods and technologies to implement this securely and fraud-resistant.
From scanning documents to convenience and privacy
If you’ve ever applied for a mortgage, you know how much effort it takes to gather the right information from various organisations. Dozens of documents, just to prove your financial reliability. The current system is cumbersome, error-prone, and, crucially, susceptible to fraud.
More than an identity: your personal vault
Europe sees the solution in digital identity. Just as you use a passport to identify yourself in the physical world, soon you’ll have a digital identity. This will not only prove who you are, but also securely store your diplomas, licenses, driving license, and other data. Think of it as a digital vault you control.
When you need to prove your financial standing to a mortgage provider, you’ll no longer need to send piles of paperwork; just digitally signed statements from, for example, the tax authorities or the social security office. It’s much easier for both you and the lender.
Self-Sovereign Identity
The European Digital Identity is largely based on the principles of Self-Sovereign Identity (SSI). This gives you control over your identity documents, without relying on a third party to monitor their use. In Europe, the SSI concept is framed by the eIDAS 2.0 system, which ensures interoperability and the reliability of authentic sources.
Economic and social value
Digital identity is no longer a thing of the future. In Belgium, over 80% of the population already uses the Itsme authentication app for banking and government services. In countries like Bhutan, digital identity has given 78% of the rural population access to services that were previously out of reach. According to McKinsey, digital identity could unlock economic value worldwide equivalent to 3–13% of GDP. For 1.7 billion people without access to financial services, this could be the key.
New opportunities, new risks
Storing all personal data with individuals themselves also brings new risks. In Belgium, hundreds fell victim to fraud via Itsme in 2024 through social engineering. Victims were tricked into approving a transaction, which was actually a loan application.
Where banks could previously spot suspicious behaviour themselves, they now depended on the Itsme system. This highlights the challenge: while digital identity is cryptographically sound, new vulnerabilities arise in practice, especially when systems must work together. How do you ensure a digital identity is at least as reliable as a physical passport?
TNO’s three pillars for safer Digital Identity
The positive effects of digital identity are clear. But it only works if security is guaranteed. That’s why we focus on three crucial questions:
The first challenge is technical: how do you ensure that someone logging in digitally is who they claim to be? We’re exploring how to create a cryptographic key from someone’s biometrics, without involving a third party. Verification happens on your device, so sensitive data doesn’t need to be shared. This delivers the reliability of a physical passport check, but digitally.
The second challenge is procedural. Fraudsters always look for the weakest link. If every company has its own system, it’s hard to spot fraud patterns. That’s why we focus on collaboration. Through the eIDAS Risk Observatory, we’re developing methods for organisations to learn from fraud signals together. Imagine an ‘eIDAS SOC’—a security operations centre where incidents are analysed and patterns recognised collectively.
Passkeys against phishing
Earlier this year, together with the National Cyber Security Centre (NCSC), we researched the adoption of passkeys (pdf); a new authentication method that makes phishing nearly impossible. Major tech companies already offer this technology, but setting up and managing a passkey is still too complex for widespread adoption.
The third challenge is conceptual. We often think of identity as static: your name, place of birth, diplomas. But identity is much broader. It’s also about what you’ve done, the skills you’ve developed, and your current financial or medical situation.
We’re also exploring how to exchange dynamic data securely via a Personal Data Space. Think of medical sensors providing real-time data. Processing should happen in your personal vault, not at a healthcare provider. So, decision models are brought to the data, not the other way around.
Take the mortgage application. Now, you must submit stacks of documents: pay slips, bank statements, employer declarations. Soon, it will be much simpler. You’ll only share the answer to the question: “Am I creditworthy?” A green tick is enough. The underlying data stays with you.
'So far, we’ve only digitised the physical. Now, we need to truly issue digital credentials worldwide.'
Bridging ambition and security
Europe’s plans for digital identity offer organisations many benefits: more efficient processes, less administrative burden, and a better-organised digital market. A European system also means less dependence on non-European tech companies. But these benefits can only be realised if security is in order.
We help organisations strike that balance. We show where the risks lie, how to mitigate them, and which steps to take for a smooth transition. Ultimately, digital identity must become as reliable, or even more reliable, than a physical passport check, but far more convenient.
TNO Projects for Assuring Digital Identity
We combine technical expertise with practical sector knowledge. This means we conduct research into new cryptographic methods and advise on implementation in existing systems. Some current projects:
- eIDAS Risk Observatory: A platform where organisations learn together to detect identity fraud. We research what’s needed for passport-level verification and how to apply it securely.
- Pilot: towards a skills-driven labour market: Commissioned by employee organisations, we’re piloting a skills-driven labour market. Employees should be able to verify their skills without a central database. Initial selection needn’t be based solely on diplomas.
- Certification framework for the Dutch version of the European Digital Identity Wallet: We’re helping to develop the certification framework, ensuring Dutch wallets meet European security standards.
- Passkey adoption with the NCSC: Together with the National Cyber Security Centre, we’re researching how to introduce new authentication methods securely.
- Vision on identity for the Dutch Government: We supported the CIO office of the Dutch government in developing a new vision for employee identity management.
More Information
Curious how your organisation can safely transition to EU Digital Identity? Get in touch with our experts.
Contact us
-
Alexander van den Wall Bake
Functie:Business Consultant Digital IdentityHi I'm Alexander, working on the crucial building block for the digital world of trust: Digital Identity. Let's enable seamless transfer of data in a privacy preserving manner.
-
Standplaats:Den Haag - New Babylon
-
Email:Email Alexander
-
Get inspired
Rules as Code
Digitalisation and sustainability: how AI can help
Time setter story: Kallol Das
Digital Product Passport
Time setter story: Annemieke Kips
