Notifications
Clear all
Topic starter
01/08/2026 10:49 pm
TL;DR: Certified digital IDs could make impersonation harder by letting businesses verify interactions with the real owner of identity details, according to Yoti, while also citing a €950,000 AEPD fine over alleged GDPR breaches tied to its Spain-only app use. The bigger identity lesson is that trust, consent and choice now sit alongside fraud controls, not after them.
NHIMG editorial — based on content published by Yoti: digital IDs, fraud protection and the AEPD fine
By the numbers:
- Yoti says over 23 million individuals around the world have downloaded its Digital ID app.
- In around 3 years time, when more than 20 million UK citizens own a certified digital ID, it will become much harder for fraudsters to use real ID details to impersonate an intended victim.
Questions worth separating out
Q: How should organisations reduce fraud risk in digital identity programmes?
A: Organisations should treat fraud resistance as part of identity assurance, not as a separate afterthought.
Q: Why do digital IDs raise more than fraud-prevention questions?
A: Because a digital ID programme combines authentication, biometric processing, consent, accessibility and regulatory accountability in one flow.
Q: What do security teams get wrong about digital identity interoperability?
A: They often assume interoperability is only a technical integration problem.
Practitioner guidance
- Define confirmation-based fraud workflows Identify which transactions should trigger an identity owner confirmation step instead of relying only on background fraud scoring.
- Review biometric consent and retention controls Map where biometric data enters your identity verification journey, who can access it, how long it is retained and what user consent text supports the processing.
- Build multi-path identity assurance Offer alternative verification routes for users who do not want or cannot use a digital ID wallet.
What's in the full article
Yoti's full article covers the policy and opinion detail this post intentionally leaves for the source:
- Robin Tombs' full commentary on why certified digital IDs may make fraud harder for impersonators.
- The article's discussion of the AEPD fine, appeal process and Yoti's view of the regulator's handling of notice.
- The broader policy case for coexistence between government and private digital ID wallets.
- The author's perspective on choice, inclusion and the future of UK digital ID adoption.
👉 Read Yoti's analysis of digital IDs, fraud protection and regulator action →
Digital IDs and fraud prevention: what should IAM teams watch now?
Explore further
01/08/2026 10:57 pm
Digital ID only works as fraud infrastructure if the challenge reaches the real identity holder. The article’s core premise is that impersonation becomes harder when businesses can verify with the genuine owner of the identity details, not just score the submission silently. That is a meaningful shift in human identity assurance because it moves the control point from backend inference to active confirmation. The practical conclusion is that relying parties need explicit challenge design, not just better fraud analytics.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own digital identity assurance in the enterprise?
A: Digital identity assurance should sit jointly with IAM, fraud, and security governance teams, because it affects authentication, lifecycle controls, and fraud exposure at the same time. If ownership stays fragmented, no one owns the full trust model. The result is inconsistent policy and weak accountability.
👉 Read our full editorial: Digital IDs, fraud protection and the limits of regulator trust
