Topic starter
18/08/2026 2:31 pm
TL;DR: Mobile ID wallets are moving from convenience feature to high-value identity infrastructure, and Guardsquare argues they face cloned apps, malware tampering, MitM attacks, and API abuse unless security is built into the mobile SDLC. That shifts the governance problem from device trust to runtime, API, and attestation controls.
Editorial analysis by NHI Mgmt Group, based on content published by Guardsquare: “Mobile ID Wallets Offer Cross-Border Convenience, If They’re Secure”.
Key questions
Q: What breaks when mobile ID wallets rely only on device trust?
A: Device trust fails when attackers clone, modify, or instrument the wallet app itself, because the backend may still see what looks like a valid phone and a valid identity flow.
Q: Why do mobile ID wallets create more fraud risk than traditional identity documents?
A: Mobile wallets can be cloned, instrumented, or attacked through APIs, which means the attacker may not need to forge the identity itself.
Q: What are the signs that a mobile wallet trust model is failing?
A: Watch for abnormal API traffic, bot-like client behaviour, repeated failed or unusual authentication patterns, and requests that behave differently across devices or app builds.
Practitioner guidance
- Implement mobile application security testing across the wallet SDLC Use static and dynamic testing before release, then repeat testing after major code changes so security issues are caught while remediation is still cheap.
- Add runtime hardening to protect wallet logic Use obfuscation, encryption, and runtime integrity checks so decompiled code, tampering, and repackaging are far harder to operationalise.
- Require app attestation for wallet-facing APIs Reject requests that do not come from a genuine wallet on an acceptable device, and tie attestation results to API authorisation decisions.
Bottom line: Mobile ID wallets move identity risk into the app layer, where cloning, tampering, and API abuse can undermine the trust placed in the credential itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:18 pm
Mobile identity assurance now depends on app integrity, not just issuer trust: once a wallet becomes the delivery mechanism for government identity, the application runtime becomes part of the trust chain. That changes the governance problem from document issuance to application assurance, where tampering, cloning, and API misuse can invalidate otherwise sound identity policy. Practitioners should treat wallet integrity as a first-class control domain.
A question worth separating out:
Q: How should public-sector teams govern mobile ID wallets and backend APIs?
A: They should treat wallet security as a combined identity, application, and API governance problem. That means defining attestation requirements, validating runtime integrity, monitoring abuse continuously, and assigning ownership across identity, mobile engineering, fraud, and security operations.
👉 Read our full editorial: Mobile ID wallets need app-layer security to withstand fraud