Digital identity for banking: eID vs video ident

When you open a bank account online, the bank has to check that you are who you claim to be. In the EU there are four common ways to do it: an eID card or app, a bank-issued ID, a video call with an agent or software, or a document check combined with a selfie. The first two are generally the strongest, video identification is widespread but has proven weaknesses, and from 10 July 2027 a new EU regulation sets harmonised rules for remote checks.

Why banks must identify you

Banks follow customer due diligence rules, often called KYC, to prevent money laundering and terrorist financing. The EU is replacing a patchwork of national rules with a single rulebook:

• AMLR (Regulation (EU) 2024/1624) applies directly in all Member States from 10 July 2027.
• AMLA, the new EU Anti-Money Laundering Authority, writes technical standards and will supervise selected high-risk institutions directly. It consulted on its draft standards for customer due diligence in spring 2026.

The AMLR allows non-face-to-face identification through electronic identification means with substantial or high assurance (see levels of assurance), through relevant qualified trust services, or through document-based verification that meets set standards. In practice that means a notified eID, a qualified signature or a certified remote verification procedure.

The common methods compared

Method	How it works	Strengths	Weaknesses
National eID (card or app)	You authenticate with an eID, often by tapping an ID card on your phone, and the bank receives verified data	High assurance, hard to forge, fast	Needs a compatible eID, and not all banks accept foreign schemes
Bank-issued ID (Nordic model)	A bank-issued app logs you in everywhere and can also be used to onboard at other banks	Very high adoption in the Nordics, quick	Tied to existing bank relationships, limited outside the region
Video identification	A live agent or software checks your ID document and face on a video call	Available to people without an eID, works across borders	Vulnerable to manipulated video, depends on provider quality, needs good light and camera
Document scan plus selfie	You photograph the document and a selfie, and software checks authenticity and liveness	Fast, no appointment	Deepfakes and forged documents are a growing risk, accuracy varies
Qualified electronic signature	You sign with a QES, which was issued after identity verification	Reusable, strong legal weight	Needs a QES to start with, see QES guide
In person or postal verification	Branch, post office or courier	Simple and robust	Slow

The video ident problem

Video ident became a standard in Germany and other countries because it let banks onboard customers without a branch. In 2022 the Chaos Computer Club demonstrated how a manipulated video stream could fool several providers, and gematik stopped video identification for health insurers’ electronic patient records, pointing to alternatives such as the online ID function, Postident and checking in person. The BSI had warned about such attacks earlier. Providers have since upgraded their checks, and regulators now push for standards, such as ETSI TS 119 461, for remote identity proofing. The lesson for customers: if your bank offers an eID option, prefer it.

What onboarding with an eID looks like

With a card-based eID such as the German online ID function, the flow is short. You choose the eID option in the bank’s app or website, check which data fields the bank requests and confirm them, hold the card against the back of your phone and enter your PIN. The bank receives verified name, birth date and address data, typically within minutes. Compared with a video call there is no appointment, no need for good lighting and less room for social engineering, because the chip does the checking.

Nordic bank IDs

In Sweden, Norway, Denmark and Finland, banks and their partners provide the digital identity that people use for almost everything. Swedish BankID is used by more than 98 percent of adults, according to published figures. Denmark’s MitID is a notified eID scheme under eIDAS, as is Swedish eID. This is a very successful model for convenience, and it has a clear trade-off: the infrastructure is tied to banks, and people without a bank relationship need other routes.

What the EUDI Wallet changes

Under eIDAS 2.0 (explained here), private relying parties that are legally required to use strong user authentication, including in banking and financial services, will have to accept the EUDI Wallet. The obligation starts some time after the wallet implementing rules came into force, so expect late 2027 rather than tomorrow. For onboarding, the wallet should let you hand over verified identity data, plus proof of address or other attestations where available, in one approval, and it can issue a qualified signature to complete the contract. The AMLR explicitly recognises qualified trust services and the wallet as routes.

Two realistic caveats:

• Banks still decide their own risk policies. A wallet identity does not oblige a bank to give you an account.
• Cross-border onboarding will remain harder in practice than the legal text suggests. Our page on cross-border eID explains today’s situation.

Staying safe

1. Start from the bank’s app or typed address. Fake support staff and phishing sites target onboarding and “identity verification” requests.
2. Never share one-time codes you did not request, and never read banking codes out on a call.
3. Use an eID if offered. It is more phishing-resistant than a video call.
4. Protect the account afterwards with phishing-resistant sign-in. See phishing-resistant MFA.
5. Check data retention. The bank will keep identification data for years by law. Check its privacy notice for how copies of your document are stored.