So, you should know when you voluntarily share, but we see some fraud around that. Then, of course, you have close relations, somebody living in the same household, they can get, you know, they typically have access to each other′s devices and they will know the password, so that′s, we have seen some fraud around that area.
There are technical attacks, they′re not very normal these days, but a really bad one is the victims of trafficking, where you bring in people to the country, they get on a work contract, but you say, well, now you′re here, you get the national identification number, you get a BankID, and I′ll handle the BankID for you.
So, what they do, the criminals will then use that BankID, register a company on behalf of that individual, because that takes about 50 minutes to do, using your BankID, and then they spend money and take up a big loan on that company, and then the victim is then responsible, because everything′s been done with their BankID, which is then legally signed by them.
And the last thing I would mention is what I call hacking people, where I would, as a criminal, I would call you and say, hey, I′m from the bank, you know, I need to help, your money is in danger, you need to move them, so here is a BankID request. You respond to that one, thinking it′s genuine, and, of course, what I do is I take your money and run.
So, there are several cases here. So, in most cases, you won′t know until it′s too late.
Today, I would say no, because we don′t check who is using it. We check the owner of the EID, the one that signed up for it, that we know, because we have all the cryptographic mechanisms and so on. But nothing prevents me from lending my phone to a grandkid and let them buy alcohol in my name.
So, today, there is no check. I haven′t seen any EIDs which actually do that. They have what they call step-up authentication, but it′s all about additional technical. There′s no verification that it′s actually me, a physical being, using it. I think several reasons.
I mean, it′s a cost factor. Of course, if you′re going to check more often, it′s a cost factor. And maybe we don′t think the problem is as big as I think it is. I mentioned trafficking victims, which is a big problem. They get into a lot of trouble. We′ve seen close relations. And we have this confidence that, well, if you have access to the device, you must be you. And then we throw in the word, well, the device has biometrics.
Well, yeah, it does have a biometrics. That′s a convenience feature. They′re not trusted biometrics. You don′t know who added those biometrics to the phone.
So, you cannot depend on those biometrics to know it′s me, right? It′s to access the phone.
And also, again, the biometrics on the phone will fall back to the PIN code if they fail several times. So, I think it′s both lack of recognition of this, but also the cost factor. We′re not doing anything about it. And I′m surprised this is not higher on the discussion, for example, of the EU identity wallet, where this is going to be an even bigger problem, potentially much more value with the identity wallet. And then it′s a more attractive target for the criminals. And like I said, I′m missing that from the discussion around the wallet.
Why aren′t we checking that the owner is the same as the user, who′s using it right now is actually the owner? Well, I mean, I lose complete control of everything, right?
I mean, I have no control of what′s being shared. If somebody else is me, if somebody is using my digital identity, they can do whatever. They are me in the digital world. And that is the challenge. I′ve lost control. They can do anything, as I said, buy a car, sell your house, take up a loan, take up a credit card, whatever.
And even, as I mentioned, set up a company and take up a loan in that company′s name. And whoever is the owner is responsible for all these actions. Because we have established, you know, an electronic signature is equally valid as a handwritten one. But then we don′t really check, is it really me signing this document? And that′s what′s happening with e-signatures today. We don′t really know that is me using it. Yep.
So, I′m hoping to raise awareness around this challenge. Like I said, the challenge will increase with more value in the EID. Nordics are pretty high up there and we see a lot of fraud. The rest of Europe is coming. And when we see more fraud or more users of EID, there will be more fraud. It′s going to be more interesting for the criminals to attack this. And we really need to take this seriously. How do we bind a biological identity to a digital identity? And now I haven′t even mentioned, how do you bind an AI to a digital identity? Which is also a complex problem.
Relate to do the same thing here. Could AI use my identity? That would be So, bottom line, awareness. We need to focus more on validating that the user of an EID or a wallet is the owner.
