Many governments around the world (including the European Union, United Kingdom, and select U.S. states) are currently transitioning away from physical identification documents like driver’s licenses and passports in favor of mobile ID wallets. “Going paperless” offers greater convenience for both government agencies and individuals. It also helps reduce risks of stolen or damaged physical documents (lost devices can have IDs automatically removed via remote access). There are also positive use cases for better protection against forgery and the ability to enforce regional access policies, like age-based controls.
While basic digital ID systems have already been successfully launched in several countries (e.g., Sweden, Estonia, Singapore, India), the current generation of mobile ID wallets often incorporates multiple functionalities – such as access to government services and banking transactions. As such, they may contain sensitive personal information such as a government ID number, place and date of birth, biometric data, and citizenship status.
Beyond the technical design challenges and adhering to applicable regulatory requirements, mobile ID wallets present some unique security risks for development teams. A compromised wallet could enable a wide range of potential abuse – from identity theft via cloned digital credentials, to fraudulent access to sensitive government or financial services, to espionage.
On their own, the default protections offered by mobile OS- and device-level controls are insufficient for securing these high-value, high-risk applications. Developers need best-of-breed protection at the application level to repel persistent attacks, detect abuse, and prevent misuse.
Fake-ID wallets and digital pickpockets
Like any other mobile application that contains sensitive information or that connects users to valuable services, mobile ID wallets will be an attractive target for malicious actors. Once a developer releases an ID wallet to the general public, it will remain exposed to all the same common threats faced by any other mobile app. These include things like reverse engineering and tampering with application code, phishing-delivered malware that can steal credentials (via overlay attacks) or take over the user’s account (via accessibility services abuse), runtime attacks (hooking and injection), and attacks against mobile APIs that connect the ID wallet to sensitive backend systems.
Privacy and security are essential table stakes for the effective transition to a mobile ID wallet system. Types of threats include:
- Cloned “fake ID” wallets (reverse engineering, modifying, repackaging)
- Malware-tampered ID wallets
- Man-in-the-Middle (MitM) attacks
- Injection attacks and AI-assisted “deep fakes” (KYC/authentication fraud)
- Emulators and virtual cameras
- Overlay attacks
- API abuse
Successful exploitation of a mobile ID wallet carries significant risks for issuing government bodies. These may include basic problems like system downtime or interoperability issues, as well as negative press and loss of public trust (uninstalls, poor adoption, project redesigns, spiraling costs). In more extreme cases, an insecure mobile ID wallet could potentially facilitate espionage or nation-state attacks (physical security incidents resulting from mobile app security failures).
New regulations bring compliance risks
In addition to existing regional laws that may apply to mobile apps in general, specific security regulations for ID wallets are also a factor in many places, which adds another layer of responsibility for developers. US states must design their mobile ID wallets based on National Institute of Standards and Technology (NIST) digital identity guidelines, which have defined security qualifiers for anti-fraud measures, threat prevention, and privacy.
In Europe, Regulation (EU) 2024/1183 details cybersecurity guidance for European Union Digital Identity (EUDI) mobile wallets, which are required of each member nation starting at the end of this year. By law, these wallets must be:
- Secure by design: developers must embed robust and proactive security controls throughout the app’s lifecycle.
- Based on open-source code: wallet apps must be open-source licensed for transparency, enabling national and EU-wide peer reviews.
- Cybersecurity certified: wallets must undergo approved cybersecurity certification, including rigorous testing and reassessment to ensure resilience against evolving threats. EU cybersecurity agency ENISA is in charge of formalizing that certification scheme.
Instances of non-compliance typically include direct risks (financial penalties), but may also have indirect impacts such as reputational harm and collateral litigation costs.
Preventing an identity crisis
As mobile identity becomes critical infrastructure, secure-by-design development will determine whether users can trust it. Developers therefore need to treat application-level security as part of the software development lifecycle rather than as a final compliance exercise. Development and security teams can build effective safeguards into release processes without undermining usability, interoperability, or delivery speed.
Continuous mobile application security testing
Security testing often happens late in the development cycle via after-the-fact penetration testing. By leaving testing to the last minute before release, developers have to pick their poison: remediation delays or releasing an app with exploitable security issues.
Tools for continuous integration (CI) help mobile ID wallet developers build software every day and ensure it works. Security should be part of CI through automated mobile application security testing (MAST) in the design, development, and testing phases, as well as during ongoing maintenance. Continuous testing helps development teams eliminate security issues early in the software development lifecycle (SDLC), when it’s easier, faster, and cheaper to fix code issues in the context of when it’s written or assembled.
A combination of static and dynamic scanning helps surface common vulnerabilities, insecure coding patterns, exposed secrets, weak encryption practices, and misconfigured permissions. Alignment with OWASP MAS verification standards and guidelines ensures best-of-breed testing that’s specific to risks associated with mobile applications.
Multi-layered and polymorphic protection
To be ready for release, a mobile ID wallet also needs to be protected against sophisticated attacks. Effective protection starts with different forms of code hardening to block static analysis of a reverse engineering attack or attempts by a threat actor seeking to extract secrets or sensitive information related to authentication, transactions, and in-app purchases. Highly targeted apps (like mobile ID wallets) need layered code hardening protections that combine multiple techniques, such as name obfuscation, control flow obfuscation, code virtualization, and data encryption.
To defend mobile ID wallets from dynamic attacks (like injection or hooking), runtime application self-protection (RASP) security checks should be built into the application code itself in order to monitor the app’s behavior during operation and provide automated defensive responses. These might include anti-debugging capabilities that respond to an attack by terminating the app or restricting its functionality. RASP can take action against tampered system libraries, emulators, virtual environments, and root privileges. It can also help a mobile ID wallet protect itself against sophisticated malware techniques like overlay attacks or accessibility services abuse.
Another key factor is polymorphism. A compiler-based solution alters the protection mechanisms with each app iteration. This helps to ensure that any knowledge an attacker gains about the code logic and security defenses of a mobile ID wallet becomes obsolete upon the next release. Polymorphism effectively “resets the clock” on persistent attempts to reverse engineer a mobile application–which becomes increasingly important as threat actors use AI-based tools to accelerate and automate their attacks.
Advanced mobile API security
Mobile ID wallets connect to resources like sensitive data and services on backend servers via APIs. This makes mobile APIs a popular target for attacks by cloned wallets (those that have been reverse-engineered and modified) as well as malicious bots, scripts, and AI agents. Mobile API security is frequently overlooked, and that security gap is being actively exploited: 44% of advanced bot activity now specifically targets APIs. While 82% of mobile app publishers say exposure to backend/API abuse is increasing, only 48% monitor API activity.
Effective mobile API protection is best achieved with dedicated app attestation capabilities. App attestation verifies that a mobile ID wallet is authentic, unmodified, and running on a secure device before it can connect to anything on the server side. This helps to enforce dynamic security policies that automatically block bots and non-genuine apps from gaining access to backend resources. While Google and Apple offer OS-based app attestation services that can reliably detect tampering with the app package on clean devices, they fall short against more sophisticated real-time attacks.
Real-time threat monitoring
Backend fraud detection systems monitor transactions, logins, and behavioral anomalies. But they typically see only what reaches the server – not what happens inside the mobile runtime before a request is made. Sending telemetry into SIEM or SOC pipelines can help, but it often requires heavy customization and constant maintenance to correlate device-level signals. While these approaches are useful, they have inherent blind spots.
The missing piece is continuous, contextual visibility at the mobile layer itself. Real-time threat monitoring shifts the model from static defense to ongoing awareness. Monitoring helps organizations spot suspicious behavior from mobile ID wallet users and devices. This real-world threat telemetry can then directly inform protection adjustments during maintenance. Mobile-layer threat data can also be integrated into broader fraud protection or SIEM/SOC systems to detect coordinated threat patterns and multi-vector attacks with greater speed and precision.
Security that goes beyond borders
For most of us, mobile ID wallets will soon become a normal part of international travel, operating a motor vehicle, accessing government services, managing financial transactions, and more. Preventing fraud and misuse of these critical mobile apps will depend on comprehensive application-level security. Mobile ID wallet developers have a tremendous responsibility to protect not only their code, but also the citizens and societies they serve.
