The European digital identity wallet aims to reduce the number of copies of your documents in circulation. But storing several credentials on your phone also raises security questions. Hacking, phishing, tracking: what protections are planned, and what vulnerabilities remain?
Several credentials brought together on a phone
ID card, driving licence, diplomas: the European wallet is intended to let people present these credentials from their phone while limiting the information shared. But bringing them together is raising concerns about the risk of hacking.
The eIDAS 2 regulation requires each member state to offer a wallet by the end of 2026. In France, it will be developed from France Identité, although the Interministerial Digital Directorate (DINUM) refers to availability “sometime in 2027”.
The system does not provide for the creation of a single European database containing the credentials of all citizens. The attestations will be stored in the user's wallet, without deleting the administrative databases they come from.
Fewer copies exposed to breaches
Today, opening an account or renting a vehicle often requires sending a copy of your ID. Every organization that keeps it represents another target, and the data can be used to commit fraud.
📰 Insecurity, crypto attacks, degraded public services: will the French reject taxes?
In February, the DGFiP revealed fraudulent access to FICOBA, potentially affecting the bank details, identity and addresses of holders of around 1.2 million accounts. The wallet would not eliminate this database and therefore would not, by itself, have prevented this intrusion.
Its value lies instead in the ability to share only the necessary information. To prove they are an adult, a user could present an attestation stating that they are over 18, without revealing their full date of birth. If the recipient suffered a breach, less data would then be exposed than with a complete copy of their documents.
Hacking and phishing: threats that persist
The security of attestations becomes crucial when they are brought together. If an attacker managed to bypass the wallet's protections and access the information, combining it could facilitate identity theft or targeted scams. However, this does not mean that data will necessarily be more exposed than it is today.
Access will have to be protected by authentication mechanisms. Cryptographic keys will have to be kept in a certified secure device, built into the phone or relying on external infrastructure.
Phishing will also remain a threat if a fraudster persuades the user to share information outside the secure process. Services that use the wallet will have to register and declare the data they request. Users, in turn, will have to be able to identify the recipient before authorizing sharing.
Finally, some identifiers or signatures could be used to link multiple presentations and track usage. Protection will therefore depend as much on the ability to withstand attacks as on the information disclosed and the possibility of cross-referencing it.
Sources: The Blockchain for Good Association, Impots.gouv
