EU wallet security: phishing, lost phones, fake verifiers

The EU Digital Identity Wallet changes the attack surface of identity. Passwords and scanned ID copies can be phished or leaked in bulk, whereas a wallet stores credentials on your own device behind device-bound keys. That does not make it unbreakable. This page explains the main threats, the protections built into the design, and what you can do about the remaining risks. For the privacy side, see wallet privacy.

What the design protects against

The regulation and the Architecture and Reference Framework set a high bar. Wallets must reach the assurance level ‘high’ (explained in levels of assurance) and must be certified. Core protections include:

• Device-bound keys. The keys that prove your credentials are yours are created for your device and held in protected hardware where possible. Copying the credential file to another phone does not give an attacker a working credential.
• Strong user authentication. Opening the wallet and releasing credentials requires your PIN or a biometric check on the device.
• Registered verifiers. Services that read your credentials must be registered and prove their identity, and the wallet shows who is asking.
• Attestations about the wallet and device. The design provides for checks that the wallet app is genuine and the device meets security requirements, which lets issuers refuse to issue to compromised wallets.
• Revocation. If a wallet is lost or compromised, the provider can revoke the wallet unit so that credentials stop working.
• Certification and open source. Independent certification and published application code give outsiders a chance to find flaws.

The risks that remain

Phishing and fake verifiers

The most likely attacks target you rather than the cryptography. A scammer may send a link or QR code that opens a wallet request that looks routine, or impersonate a bank, a landlord or an authority. The wallet’s registration checks help, but they only work if you read the screen.

Treat unexpected requests like unexpected login prompts. Do not approve a request you did not start, and be suspicious of any message that creates urgency. Our guide to phishing-resistant MFA shows why binding a login to the real site or service matters, an idea the wallet follows.

A lost or stolen phone

Because the wallet lives on your phone, losing it is the classic scenario. The PIN or biometric lock slows down a thief, and device binding prevents easy copying. Still, you need a plan:

1. Report the loss to the wallet provider or the authority named in your country’s wallet app, so the wallet can be revoked.
2. Use your phone’s ‘find my device’ and remote lock features.
3. Install the wallet on the new device and re-issue your credentials. Do not assume an automatic cloud backup restores everything, since device-bound credentials are by design not copyable. How recovery works varies by country.

The same thinking applies to other accounts: see account recovery.

Malware and compromised devices

A wallet on a phone with malware, a rooted device or a fake app store is exposed. Install the wallet only from the official source named by your government, keep the operating system updated and avoid sideloading unknown apps. Some issuers may refuse to issue credentials to devices that fail integrity checks.

Social engineering and coercion

Attackers may convince you to ‘verify’ yourself for a fake service or to hand over your phone and PIN. A strong, unique PIN that you never share is the basic defence. Do not reuse a PIN you use elsewhere. Biometric unlock is convenient, but know its limits, which we discuss in biometric login.

Weak spots at the edges

The wallet is only as secure as the process of getting credentials into it. If issuance relies on a weak identity check, a bad credential can end up in a strong container. Likewise the remote signing infrastructure and the national registers behind the wallet are targets. These are reasons for independent certification and for official oversight, such as the work of ENISA on a European certification scheme for wallets.

Compared with passwords and ID scans

A password can be phished, guessed, reused or leaked from a breached database, and an ID scan, once uploaded, is out of your control. A wallet credential cannot be reused by someone who has only seen a presentation, because every presentation is bound to your device key and, in many cases, to a fresh challenge from the verifier. That is the same principle that makes passkeys resistant to phishing, applied to identity data. The trade-off is concentration: the phone becomes a single point of failure, which is why recovery planning matters.

What providers and authorities add

Wallet providers must meet security requirements set by the implementing acts and pass certification. Member states supervise the framework, publish lists of trusted issuers and registered verifiers, and can withdraw trust from a service or an issuer that misbehaves. Independent researchers can inspect the open source application code and the specifications, which helps to find flaws earlier.

Your checklist

• Install the wallet only from the official link given by your government.
• Update your phone’s operating system and the wallet app promptly.
• Use a screen lock and a unique PIN, and never tell the PIN to anyone.
• Read every request: who is asking, what attributes, and why.
• Do not follow links in unexpected messages that lead to a wallet request.
• Learn in advance how to report a lost phone to the wallet provider.
• Keep your physical ID and your other login methods, such as passkeys, up to date as a fallback.

How secure is it overall?

For ordinary users the wallet is likely to be safer than today’s mix of passwords, SMS codes and ID photo uploads, provided it is implemented well and certified. The residual risk is mostly human and device-related. Because the first wallets are still going through certification in 2026, it is reasonable to wait for the published certification result for your national wallet and to start with low-stakes uses. For the overall picture see the EU Digital Identity Wallet explained.