Digital ID wallets on phones are now routine in over 60 countries, and the single weakest link in the whole stack is not cryptography. It is the recovery process. A stolen or lost phone with a government ID in it is recoverable in minutes. A hijacked recovery channel, an old email address or a SIM-swapped number, is how people actually lose their digital identity. Here is what the recovery flow really checks, and where it fails.
What actually protects the ID on your phone
Mobile driving licences and national ID wallets store the credential in the device’s secure element or in hardware-backed keystore on iOS and Android. Apps cannot export the private key. Presentation is short-lived, often a rotating QR or an NFC tap, so screenshots are worthless, a property the deepfake-detection crowd keeps trying and failing to replicate for open-web images. That part is solid engineering and it works. The weakness sits one layer out: proving that you, and not someone else, are allowed to re-provision that credential on a new device.
The three recovery paths, ranked by risk
The weakest is SMS or email confirmation. SIM swapping still works in 2026 despite carrier port-out PINs, because the PIN itself is often recoverable through social engineering with a data-broke customer service desk. Email is barely better when the account was created a decade ago and still authenticates to an address you no longer control. The middle path is in-person re-issuance at a government office, which is safe but slow, taking days. The strongest path now deploying is liveness plus document check against the issuing register: you film your face, present the physical card, and the system matches against the original application photo. Estonia and several EU members already run this for their national schemes.
Two numbers that explain the losses
US FTC figures for identity theft have run well over a million reports a year for several years, and the recovery-time cost of a full account takeover averages tens of hours of paperwork. In a wallet world the stakes are higher: a successful re-provision of a government ID gives an attacker the strongest identity artefact you own, the one document everything else trusts. Banks that accept digital ID for onboarding inherit whatever the recovery process let through.
Hardening your own setup, concretely
First, move the recovery contact off SMS entirely: put a hardware security key or an authenticator app on every account tied to your ID wallet, the government portal login included. Second, audit the old email addresses still listed as recovery contacts on accounts you opened years before the wallet existed; that is the classic takeover path. Third, if your country offers a choice of re-issuance method, choose the in-person or liveness-check option over convenience codes. Fourth, keep the physical card valid even when the digital one works. Every deployed scheme can revoke a mobile credential remotely, and the plastic document remains the fallback that does not depend on any recovery flow at all.
Jurisdiction check: where you stand depends on where you live
The EU eIDAS 2.0 framework requires member states to offer an EU Digital Identity Wallet by 2026-2027, and its implementing acts specify authentication for remote issuance, which pushes providers away from pure SMS flows. India’s Aadhaar recovery runs through biometric re-enrolment at centres, painful but resistant to remote takeover. State mobile driving licences in the US follow the ISO 18013-5 standard, which is strong on presentation and largely silent on re-provisioning, leaving each state’s motor vehicle agency to invent its own recovery rules, and quality varies exactly as much as you would expect from fifty separate implementations. The UK is piloting a GOV.UK wallet with liveness checks on re-issuance. If you cannot find your scheme’s recovery documentation published anywhere, treat that as a finding in itself: the schemes that publish their revocation and re-issuance rules are the ones that had them reviewed.
The SIM-swap mechanics, briefly, because it still works
An attacker calls the carrier, or walks into a shop, with your name, address and date of birth, all bought for a few dollars from any breach corpus, and requests a SIM transfer to a new card. Port-out authorisation codes were meant to stop this. In practice, staff can override them for “customer service” reasons, and some carriers reset the PIN using information that is itself in the same breach corpus. Once the number transfers, every SMS code in the world belongs to the attacker until you notice your phone went quiet. The defence is boring and total: remove your phone number from every account that offers an alternative, and treat any sudden loss of signal as a five-alarm event, because the next message that arrives on the new SIM is your identity.
What issuers still get wrong
Several deployments still allow re-provisioning with only an emailed one-time code. Some verify possession of a phone number rather than the person. A handful do not rate-limit re-issuance attempts, allowing enumeration. These are known failure patterns from banking, replayed at government level, and they will be found by the same criminals. The schemes that treat the recovery flow as the real security boundary, with liveness checks and revocation of all prior devices on re-issue, are the ones worth trusting.
The lesson generalises beyond ID. Certificate authorities learned decades ago that the issuance path, not the maths, is where trust is lost, and the whole web-pki ecosystem hardened domain validation for exactly that reason. Digital identity is repeating that history, and the people who read the recovery documentation today keep the identity that the people who tap “continue” tomorrow lose.
