What attacks target MitID?

How MitID Attacks Typically Work

MitID is usually attacked through a mix of user-facing deception and endpoint compromise. The attacker’s goal is often not to break MitID itself, but to get the user to approve a login or payment they did not intend, or to capture enough session, device, or recovery data to reuse access later. That makes the human approval step part of the attack surface.

Phishing remains effective because it can steer users to fake login flows, harvest recovery details, or trigger fraudulent approval requests at the right moment. Social engineering adds pressure, urgency, or authority to make the prompt feel routine. Device compromise changes the game further, because malware or browser interference can observe, redirect, or supplement what the user sees before they approve an action.

Signals That Point to MitID Abuse

The strongest warning signs are behavioural rather than purely technical. Repeated login failures, new device enrolment, unusual approval timing, and unexpected changes to recovery data can all indicate that someone is testing credentials or trying to take over the account. Approval patterns that cluster outside normal working hours or come in bursts should be treated as suspicious, especially if they do not match the user’s usual device or location pattern.

A second signal is transaction or login behaviour that looks “approved” but does not match the user’s intent. In practice, that can mean a valid approval being used under pressure, a malicious prompt presented during an unrelated activity, or a compromise that bypasses normal user attention. The key point is that successful approval does not always mean legitimate intent.

Controls That Reduce the Attack Surface

MitID defenders should make the approval event harder to trick and easier to verify. Step-up authentication for sensitive actions is important because it raises the bar when risk is higher, such as payment changes, recovery updates, or device binding. Monitoring should focus on anomalies around approval frequency, enrolment changes, and repeated failures, because those are often the earliest signs that an attacker is probing the account rather than using it normally.

It also helps to reduce exposure around the device itself. If the endpoint is compromised, an attacker can turn a legitimate approval channel into a malicious one, so organisations need to treat browser security, endpoint protection, and user awareness as part of the MitID control set rather than as separate concerns. For background on how credential theft and service abuse are used in real attack chains, see The State of NHI & AI Agent Breach Report 2026 and the broader attack patterns described in CISA cyber threat advisories.

Risk and Threat Considerations

MitID attacks are risky because the attacker can convert ordinary user trust into a valid-looking approval path. When phishing, malicious prompts, or recovery-data abuse succeeds, the compromise may look like a normal login or payment from the outside, which delays detection and increases the chance of secondary fraud.

Failure mechanism: An attacker either persuades the user to approve an action they did not initiate, or compromises the device or recovery path so the approval appears legitimate while the attacker controls the session or transaction flow.

Impact: This can lead to account takeover, fraudulent payments, unauthorized access to linked services, and loss of confidence in the identity process itself, especially when repeated approvals or recovery changes go unnoticed.

Practitioner Guidance

What to verify: Treat abnormal approvals as an investigation trigger, not just an authentication event. Check whether the prompt, device, and timing align with the user’s expected behaviour before assuming the login was benign.

Decision rule: If the event involves a new device, a recovery-data change, or repeated failed attempts followed by success, escalate it as a possible compromise and review adjacent activity for fraud or lateral access.

What practitioners underestimate: The most dangerous MitID abuse often succeeds without technical “break-in” indicators. If users can be pressured into confirming an action, the control boundary is no longer just authentication, it is also the quality of the approval decision itself.

Practitioner takeaway: The best defence is not only stronger authentication, but stronger suspicion management around approvals, device changes, and recovery flows, because that is where attackers most often turn legitimacy into compromise.

Related resources from NHI Mgmt Group

• Guide: Digital Identity, eID and Identity Wallets Guide
• Who should own identity risk when attacks target both people and third-party access?
• How should security teams handle vishing attacks that target SaaS support workflows?
• Why do supply-chain attacks increasingly target secrets instead of just code integrity?
• Why do supply chain attacks target package publishing and lockfiles so often?