Notifications
Clear all
Topic starter
02/08/2026 12:14 pm
TL;DR: Digital ID can reduce festive-season scam exposure by enabling peer-to-peer verification, selective data sharing and safer volunteer checks, according to Yoti. The governance lesson is broader: identity assurance works only when verification, disclosure and device security are all controlled together, not treated as separate tasks.
NHIMG editorial — based on content published by Yoti: safer Digital ID use for festive shopping, meetups and volunteering
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations support Digital ID without increasing privacy risk?
A: Start by removing unnecessary data collection from the verification flow.
Q: Why do identity verification checks still fail in fraud scenarios?
A: They fail when the check is disconnected from context.
Q: What breaks when organisations rely on one-time identity checks?
A: One-time checks break when the identity can keep acting after the original trust decision is no longer valid.
Practitioner guidance
- Define minimum-attribute disclosure per use case Map each transaction to the smallest set of attributes required, then block full document sharing where age, name or verified presence is sufficient.
- Tie verification to a specific trust context Require that peer-to-peer checks and Verified Calls be used only for the intended interaction, such as pickup, visit or volunteer onboarding.
- Harden the device that holds the Digital ID Enable biometric login, keep the app updated and enforce device lock settings so the identity app is protected by the same baseline controls as other sensitive credentials.
What's in the full article
Yoti's full article covers the practical examples this post intentionally leaves for the source:
- How the peer-to-peer verification flow works in a real consumer app
- How verified calls and liveness checks are positioned for marketplace pickups and in-person meetings
- How the app handles selective sharing and which fields users can expose
- How biometric login and encrypted storage are presented as part of the app security baseline
👉 Read Yoti's guidance on safer Digital ID use for festive scams and identity checks →
Digital ID, fraud checks and privacy controls: what changes now?
Explore further
02/08/2026 1:17 pm
Selective disclosure is the real control boundary in consumer digital identity. The article correctly frames oversharing as the risk, not just identity proofing itself. For practitioners, the important governance question is whether the relying party truly needs a full identity artefact or only a narrow attribute set. That distinction matters because every unnecessary field expands fraud exposure and privacy liability.
A question worth separating out:
Q: Who is accountable when digital identity data is stored or shared incorrectly?
A: Accountability should sit with both the issuer and the provider that handles the data, because each controls a different part of the trust chain. Governance teams should assign ownership for proofing, storage, disclosure, and revocation separately so failures can be traced and corrected.
👉 Read our full editorial: Digital ID cuts festive scam risk by reducing oversharing
