Topic starter
14/08/2026 6:33 pm
TL;DR: Lost or stolen physical IDs can expose enough personal information to support fraud, prompting Yoti to argue that digital identity should share less data and add device-level protections; the article says more than 20 million people have downloaded its ID app. The governance lesson is that identity proofing should minimise disclosure and reduce what a stolen document can reveal.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Lost or stolen ID? Here’s what to do next to protect your identity”.
By the numbers:
- More than 20 million people have downloaded the Yoti ID app.
Key questions
Q: How should organisations reduce identity fraud risk when documents are lost or stolen?
A: Organisations should minimise the amount of personal data exposed during identity proofing, recovery, and age verification.
Q: Why does a lost ID create more than a replacement problem?
A: A lost ID can become a fraud enabler because it may expose enough personal information for impersonation, convincing social engineering, or account recovery attempts.
Q: What are the best practices for digital identity proofing on mobile devices?
A: Use device-level protections such as passcodes and biometrics, and require additional verification for sensitive actions that expose or use identity credentials.
Practitioner guidance
- Limit identity claims to the minimum attribute needed Redesign age and identity checks so the relying party receives only the claim required for the transaction, such as over-18 status rather than full date of birth or address.
- Treat lost IDs as fraud-risk events Build an incident workflow that includes issuing replacement documents, notifying the issuer, logging police references where relevant, and monitoring for misuse across banking and credit channels.
- Apply device-level protection to digital identity flows Require passcode, biometrics, and step-up verification before sensitive identity actions so possession of the phone does not equal unrestricted use of the identity credential.
Bottom line: Lost identity documents are a governance issue because they can expose personal data that is still usable after the original holder has lost control of the document.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:38 pm
Identity proofing still leaks too much when the proof is the document itself: Physical IDs are often treated as the proof of identity rather than as one input to an identity decision. That creates unnecessary exposure because the verifier sees far more than the transaction requires. The practitioner takeaway is simple: proofing should be designed around the minimum needed claim, not the maximum available data.
A question worth separating out:
Q: What should security teams do after a passport or driving licence is stolen?
A: They should report the theft, arrange a replacement, keep records of the incident, cancel related cards if needed, update important passwords, and monitor accounts and credit activity for misuse. The objective is to contain downstream identity abuse, not just replace the lost document.
👉 Read our full editorial: Digital ID reduces exposure when physical identity documents are lost