Governments are asking millions of people to put their identity documents on their phones, and scammers will follow with fake wallet apps, fake verification requests and "your wallet is suspended" messages. A well designed government ID wallet can be safer than a plastic card: it shares only what is needed, keeps a log of who asked, and can be revoked if the phone is lost. Those protections only work if people install the genuine app, protect the phone, read what they are being asked to share and know what to do when something goes wrong. This guide explains how to use a government digital identity wallet safely, using the EU Digital Identity Wallet rules as the most detailed reference, and is written for citizens and for the councils, banks, help desks and digital inclusion teams who support them. The technical side is covered in the Digital Identity Wallets Guide.
Key takeaways
- Get the wallet only from the official source. Install it from your phone's official app store via a link on the government's own website, never from a link in a text, email or advert.
- You decide what is shared. Under the EU rules, Article 5a(4)(a) of the amended eIDAS Regulation gives you selective disclosure, so a service checking your age should be able to see "over 18" without your date of birth.
- Check the dashboard. Article 5a(4)(d) requires a dashboard listing who you shared data with, from which you can ask a service to erase your data or report it to a data protection authority.
- A lost phone is recoverable. EU rules let a wallet be revoked at your request (Article 5a(9)), and the reference framework requires providers to support revocation through an account that does not depend on the lost device.
- Using a wallet is your choice. Article 5a(15) makes EU wallet use voluntary, and people who do not use one must not be disadvantaged; Article 5a(13) makes issuance, use and revocation free for individuals.
What a government ID wallet is and where they stand
A digital identity wallet is an app that holds a verified copy of your identity (in the EU called Person Identification Data, PID) and other credentials such as a driving licence, diploma or prescription, and lets you present them to services in person or online. The phone's security features protect access, and the data is stored locally in the app rather than in a central database the service can browse.
| Scheme | Status (checked 27 October 2026) | What to know |
|---|---|---|
| EU Digital Identity Wallet | Regulation (EU) 2024/1183 adopted 20 May 2024; each Member State must provide at least one wallet within 24 months of the implementing acts entering into force (Art. 5a(1)); the Commission's site describes launch at the end of 2026 | Free for individuals, voluntary, certified; strong legal rights over sharing |
| US mobile driver's licences and digital IDs at airports | TSA accepts digital IDs at participating checkpoints | You scan a QR code or tap a reader; your phone asks for consent; TSA says all passengers must still carry a physical ID |
| Other national schemes | Varies by country | Check the government's own site for which app is official. See the National Digital ID Schemes Map. |
What a service sees: when you present a credential, the service receives only the attributes you approve, signed by the issuer so it can check they are genuine. It does not get access to the rest of your wallet. Your wallet keeps its own log of what was shared, which is the record you use if you later need to ask for erasure or make a complaint. Because the log is on your phone, export it (Article 5a(4)(f)) before you change devices if you want to keep it.
The scams to expect
| Scam | What it looks like | How to stay safe |
|---|---|---|
| Fake wallet app | Look-alike app in a store or a download link from a website or advert | Follow the link from the official government website; check the publisher name |
| Onboarding phishing | "Activate your digital ID before the deadline" text with a link asking for passport scans, bank details or a selfie | Government wallets are set up inside the official app; never send ID scans through a link |
| Suspension or verification scam | "Your wallet has been suspended, verify now" email or call | Open the app yourself; real revocation notices also come through official channels |
| Over-sharing request | A website or shop asks for your full identity when it only needs your age | Decline; in the EU the wallet should warn you when a service asks for more than it registered |
| Remote "help" scam | Caller offers to help set up the wallet and asks you to install screen sharing or read out a code | Never share a wallet PIN or one-time code; hang up and call the official helpline |
| QR code swap | A sticker over a genuine QR code at a desk or poster | Check the service name shown in the wallet before approving |
For the wider pattern see the Impersonation Scam Awareness Guide and, for organisations, the Digital Identity Wallet Fraud Risks Guide.
Setting up your wallet safely
- Update your phone to the latest operating system version and set a strong screen lock (a six-digit or longer PIN, plus fingerprint or face unlock if you like).
- Find the official app from your government's website, not a search advert, and install it from the official app store.
- Create the wallet PIN the app asks for and do not reuse your phone or bank PIN.
- Add your identity using the method the app offers (for example, scanning your passport chip or logging in with an existing national eID). This is where the genuine app proves you are you; you should not need to email documents to anyone.
- Set up the recovery account the provider offers. The EU reference framework requires providers to explain that this account lets you request revocation of the wallet if the phone is lost or stolen, using sign-in methods that are independent of the wallet and the device.
- Write down the official helpline and how to report a lost wallet somewhere other than the phone.
- Keep your physical documents. Some services, such as US airport checkpoints, still require a physical ID.
Sharing only what is needed
The EU rules give users specific rights each time a service asks for data. Under Article 5b, every relying party must register, stating its identity, contact details and intended use including the data it will request, and Article 5b(3) bars it from asking for more. The reference framework's relying party registration topic says the wallet authenticates services with access certificates, can show the registered name, and, under the draft implementing rules, must inform you when a service requests more than it registered so you can refuse and report it.
- Read the service name: the wallet shows who is asking. If it does not match the shop, website or office you are dealing with, stop.
- Read the list of data: an age check needs an age attribute, not your address. Untick or decline anything unnecessary where the app allows it.
- Use pseudonyms where offered: Article 5a(4)(b) provides for locally generated pseudonyms for services that do not need your real identity.
- In person: present by QR code or tap; you should not need to hand over an unlocked phone. TSA, for example, describes scanning a QR code or tapping a reader, with your device asking for consent first.
- Signatures: EU wallets must offer free qualified electronic signatures for individuals (Article 5a(5)(g)). Treat a signature request like a paper contract: read what you are signing.
Protecting the phone the wallet lives on
The wallet relies on the phone's own security to keep other people out. A few habits matter more than any wallet setting.
| Habit | Why it matters | Small or large risk |
|---|---|---|
| Install system updates promptly | Updates fix flaws that malware uses to read app data or fake screen taps | Large |
| Use a screen lock PIN of six digits or more | Short or pattern locks are easy to watch over a shoulder | Large |
| Do not root, jailbreak or install apps from outside official stores | These remove protections the wallet depends on, and a wallet may refuse to run on a modified phone | Large |
| Turn on find-my-device and remote wipe | Lets you lock or erase a lost phone as well as revoking the wallet | Medium |
| Review apps with accessibility or screen-reading permissions | These permissions are a common route for banking and remote access malware | Medium |
| Keep lock screen notifications private | Codes and wallet alerts visible on a locked screen can be read by a thief | Medium |
Do not rely on a phone backup to carry your identity to a new device. Well designed wallets bind keys to the phone's secure hardware, so the expected path is to set the wallet up again on the new phone and let the old one be revoked or wiped.
Family, older relatives and shared phones
- One person, one wallet: a wallet holds one person's identity. Do not set up a relative's identity on your phone, or yours on a shared family tablet.
- Helping is not holding: you can sit with an older relative while they set up their own wallet and recovery account, but they should choose and keep their own PIN.
- Acting for someone else: if you manage another adult's affairs, use the legal route the service offers (such as a registered power of attorney), not their wallet and PIN.
- Children: follow the age rules of your national scheme; where children can hold credentials, a parent should check the dashboard with them.
- Warning signs for carers: a relative who has been told to "move their ID to a new app", or who is on the phone to someone while opening the wallet, may be in the middle of a scam.
If your phone is lost, stolen or compromised
| Situation | What to do | Rule behind it (EU) |
|---|---|---|
| Phone lost or stolen | Use the recovery account or official helpline to revoke the wallet, then lock or wipe the phone through its find-my-device service | Art. 5a(9) revocation on request; ARF WIAM_06 recovery account |
| Suspected misuse | Check the dashboard for unknown transactions, request erasure and report the service | Art. 5a(4)(d) |
| Provider revokes your wallet | Expect a notice with reasons within 24 hours, also by a channel independent of the wallet; contact the provider through the official route | ARF WURevocation_14 and _16 |
| Wallet scheme breached | The state must suspend the wallet without undue delay; follow official instructions | Art. 5e(1), withdrawal if not remedied within three months (Art. 5e(2)) |
| Technical problem | Use the in-app support route | Art. 5a(10) easy technical support and problem reporting |
| Changing phones | Set up the wallet on the new phone, then uninstall from the old; the wallet should destroy key material on uninstall | ARF WIAM_13 |
The reference framework also requires providers to revoke a wallet unit attestation within 24 hours of identifying a security risk, so a compromised wallet stops being accepted quickly.
Where identity fits
The wallet is only as safe as the phone and the accounts behind it. The phone screen lock, the app store account and the email or phone number used for the recovery account are now part of your identity. Protect the email account with a strong unique password and multi-factor authentication, and ask your mobile provider about a port-out or SIM swap PIN. See the SIM Swap Fraud Guide.
For organisations supporting citizens
- Help desks and councils: never ask for a wallet PIN, recovery code or screen sharing. Publish this rule so scam callers who do ask stand out.
- Relying parties: request the minimum attributes, register an accurate intended use and display name, and keep a non-wallet route open; under Article 5a(15) people without a wallet must not be disadvantaged. See the Relying Party Integration with Digital Identity Wallets Guide.
- Digital inclusion teams: help people set up the recovery account and write down the helpline during onboarding sessions; that step is the one most often skipped.
- Communications: link only to the official app store listing from your own site and never put set-up links in texts.
Measures for programmes: share of users with a recovery account set up; reported fake apps and phishing domains taken down and time to takedown; lost-wallet revocations completed within the provider's target; help desk calls about suspected scams; complaints about over-sharing requests reported through the dashboard.
How the protections map to the rules
| Protection | eIDAS (as amended by 2024/1183) | ARF reference |
|---|---|---|
| Selective disclosure | Art. 5a(4)(a) | n/a |
| Pseudonyms | Art. 5a(4)(b) | n/a |
| Dashboard, erasure, reporting | Art. 5a(4)(d)(i) to (iii) | Topics H and L+M; TS7, TS8 |
| Data export and portability | Art. 5a(4)(f) and (g) | TS10 |
| Relying party registration and limits | Art. 5b(1) to (3) | Topic X; TS5, TS6 |
| Revocation and breach response | Art. 5a(9), Art. 5e | Topic T, WURevocation requirements |
| Free and voluntary | Art. 5a(13), Art. 5a(15) | n/a |
Common failure patterns
- Installing from a link in a message instead of from the government site, the most likely route to a fake app.
- Skipping the recovery account, which leaves no way to revoke the wallet after losing the phone.
- Approving without reading the service name and data list, which defeats selective disclosure.
- Sharing the PIN with a "helper", family member or caller, which makes every other control irrelevant.
- Never opening the dashboard, so misuse goes unnoticed and unreported.
- Organisations demanding the wallet and offering no alternative, pushing vulnerable people towards unofficial "help".
Practitioner checklist
- Install the wallet only via the official government website and app store listing.
- Use a strong phone screen lock and a separate wallet PIN.
- Set up the recovery account and record the helpline away from the phone.
- Check the requesting service's name and the data list before every share.
- Decline requests for more data than the purpose needs, and report them.
- Review the dashboard monthly and after any suspicious contact.
- Revoke the wallet straight away if the phone is lost or stolen.
- Never share the wallet PIN, codes or screen with anyone.
- Keep physical ID for services that still require it.
Standards and references
- EUR-Lex: Regulation (EU) 2024/1183 establishing the European Digital Identity Framework
- European Commission: EUDI Wallet Architecture and Reference Framework
- European Commission: ARF Topic T, support and maintenance by the Wallet Provider
- European Commission: ARF Topic X, relying party registration
- European Commission: EU Digital Identity Wallet Home
- TSA: Digital ID
Related NHI Mgmt Group resources: Digital Identity Wallets Guide · eIDAS 2.0 and the European Digital Identity Framework Guide · EUDI Wallet Architecture and Reference Framework Guide · Digital Identity Wallet Fraud Risks Guide