Notifications
Clear all
Topic starter
11/07/2026 8:34 pm
TL;DR: The EUDI Wallet rollout will force banks, telecoms, platforms, and governments to defend against presentation and injection attacks while meeting Level of Assurance High expectations, according to Oz Forensics. The real issue is not just compliance timing but whether biometric onboarding can prove the claimant is genuine when synthetic identity fraud scales faster than manual review.
NHIMG editorial — based on content published by Oz Forensics: The EUDI Wallet is Coming: Strategies for Biometric Security
By the numbers:
- Deepfake attacks occurred every five minutes in 2024, according to the source article.
Questions worth separating out
Q: How should organisations prepare to accept the EUDI Wallet in onboarding flows?
A: Start by identifying every onboarding journey that will depend on wallet acceptance, then map the assurance threshold each journey actually needs.
Q: Why do deepfakes and injection attacks change biometric risk so much?
A: They break the assumption that the image seen by the system came from a real person and a real sensor.
Q: What do security teams get wrong about passive liveness?
A: They often treat low-friction verification as if it were automatically safer or more mature.
Practitioner guidance
- Map the new relying-party decision points Identify where your organisation will have to accept the EUDI Wallet, and align those checkpoints with fraud, onboarding, and IAM ownership before 2027.
- Test for injection as well as spoofing Run onboarding scenarios that emulate virtual camera bypasses, emulator paths, and synthetic video streams, not only photo or mask presentation attacks.
- Require assurance evidence from biometric suppliers Ask for certification, test scope, and device-path coverage that demonstrates resistance to both presentation attacks and injected inputs.
What's in the full article
Oz Forensics's full article covers the operational detail this post intentionally leaves for the source:
- CEN/TS 18099 testing considerations for detecting injection attacks in onboarding flows
- The role of NFC chip reading alongside facial biometrics for higher assurance
- How passive liveness changes accessibility and friction trade-offs in real deployments
- Practical preparation steps for banks, telecoms, and other relying parties ahead of 2027
👉 Read Oz Forensics's analysis of EUDI Wallet biometric security strategies →
Eudi Wallet biometrics: are identity controls ready for 2027?
Explore further
11/07/2026 9:04 pm
Biometric onboarding has become an identity assurance boundary, not a UX choice. The EUDI Wallet shifts verification from isolated customer onboarding into a cross-border identity trust model where failure is systemic, not local. That means wallet issuers and relying parties are now governing the integrity of the proofing event itself, not just the account created afterwards. The implication is that onboarding controls have to be judged as part of identity assurance architecture, not front-end convenience.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing that remediation windows often outlast the initial exposure event.
A question worth separating out:
Q: Who is accountable when wallet acceptance fails a fraud or identity test?
A: Accountability sits with both the wallet acceptor and the issuer, because each controls a different part of the trust chain. The issuer vouches for the credential, but the relying party decides whether the presented evidence meets its own risk threshold. Governance must define that split before incidents test it.
👉 Read our full editorial: Eudi Wallet biometric security and the new trust boundary
