Experts Share: How To Stay Protected From Cybersecurity Risks Of Digital ID

The Prime Minister’s Office announced that a free digital ID will be rolled out to all UK citizens and legal residents. It will become mandatory for Right to Work checks by the end of this Parliament.

The government says the system will make it easier for people to prove their identity for services such as driving licences, childcare and welfare. It will also be used in the private sector for things like opening a bank account or proving age. The digital ID will sit on people’s phones in the same way the NHS App or contactless payments already do.

Officials describe the scheme as a way to save time, cut paperwork and reduce the use of physical documents. Employers will be required to check the ID before someone starts a job, which the Prime Minister’s Office said is to stop illegal migrants from finding work.

 

How Will The System Work?

 

So, the digital ID will be stored securely on one’s device. It will contain a person’s name, date of birth, nationality or residency status and a photo for biometric security. A public consultation will decide whether extra details such as address should be added.

The ID can be revoked and reissued if a phone is lost or stolen. Officials said it will use the same encryption and authentication technology already applied in banking apps. Police will not be able to demand to see a digital ID, as current rules prevent this.

The Department for Science, Innovation and Technology said the system will help people prove who they are instantly, removing the need for multiple checks across departments and businesses.

 

Who Will It Help?

 

Government reports show that 10% of UK citizens have never had a passport, while 93% of adults own a smartphone. For many people, this makes it difficult to prove their eligibility for services such as opening a bank account. Ministers say digital ID will give free and secure verification to those without traditional papers.

The scheme is also being designed with accessibility in mind. Assistive technologies like screen readers, voice commands and biometric authentication will be integrated. For those without smartphones or who need extra support, alternatives such as physical options and in person help will be available.

The government said it will consult charities and community groups to make sure groups such as older people and the homeless are not excluded. An outreach programme will support citizens through the rollout.

Prime Minister Keir Starmer said: “I know working people are worried about the level of illegal migration into this country. A secure border and controlled migration are reasonable demands, and this government is listening and delivering.

“Digital ID is an enormous opportunity for the UK. It will make it tougher to work illegally in this country, making our borders more secure. And it will also offer ordinary citizens countless benefits, like being able to prove your identity to access key services swiftly – rather than hunting around for an old utility bill.

We are doing the hard graft to deliver a fairer Britain for those who want to see change, not division. That is at the heart of our Plan for Change, which is focused on delivering for those who want to see their communities thrive again.”

But people aren’t exactly sure…

 

What Are The Risks Of Digital ID?

 

A little while ago we got into the risks of older ID systems failing and leaving people stuck without access to services. That experience hangs over the new scheme and shapes how people see it today.

The biggest worry is security…

Previous government projects struggled with weak checks and overloaded systems. If that happened again, the stakes would be higher because this time the wallet is set to hold tax details, driving records and welfare data all in one place.

 

How To Stay Protected From Risks

 

Experts have shared tips on how to stay protected from the cybersecurity risks that come with this new rollout…

 

Our Experts:

 

• Slava Demchuk, CEO, AMLBot
• Peter Horadan, CEO, Vouched
• Moti Gamburd, CEO, CARE Homecare
• Trevor Horwitz, CISO and Founder, TrustNet
• Dray Agha, Senior Manager Of Security Operations, Huntress
• Sarah Bone, Co-Founder, YEO Messaging
• ÁsgeirÓskarsson, Managing Director, BSV Association
• Xavier Sheikrojan, Director, Risk, Signifyd

 

Slava Demchuk, CEO, AMLBot

 

 

“The concept of a digital ID in the UK seems quite attractive at first glance. Indeed, it is convenient: a single means of identification, accelerated access to government services. The main advantage is the reduction of bureaucratic procedures. All this is true, but all it takes is a teenager with a computer to access all the information about your life.

“However, cybersecurity threats remain extremely serious. A centralized database of personal information about people becomes an attractive target for hackers. One successful intrusion could lead to disclosure of private information about millions of people.

“Statistics already show what we may face. This year, more than 165 million people have been affected by data breaches. In approximately 20% of cases, the cause was theft of personal information. Incidentally, 68% of incidents are caused by human factors — phishing attacks, user errors, or carelessness. What would happen if a government official were to exhibit this carelessness? Imagine if your documentation, medical records, or banking information were to become freely accessible. The scope of potential fraud is simply scary.

“As electronic identifiers are likely to become a reality, it is essential to adhere to several important principles.

“Firstly, protect your gadgets: Regular software updates, complex passwords, biometric protection, and removal of unnecessary programs are the basic level of protection. Secondly, make sure to always enable two-step verification… and, don’t limit yourself to just a password or SMS code. It’s better to have backup confirmation codes or physical security keys.

“Furthermore, don’t try to combine all services…although it seems convenient, it is better to use proven platforms that are really necessary.
And lastly, be vigilant about phishing attacks, fraudsters always exploit people’s trust. Carefully check the addresses of websites and applications, avoid questionable links.

“However, the most critical level of protection is the responsibility of the state. We require a transparent infrastructure system, independent security checks, and clear mechanisms for regulating access and responsibility for data leaks. Indeed, it should be a mandatory requirement for governments.”

 

Peter Horadan, CEO, Vouched

 

 

“The great thing about Digital IDs is they erase nearly all cybersecurity risks. For example, the Digital ID can only be used with your finger print or face .. so the risk of losing your phone and someone stealing your ID is gone. In another example – using a Digital ID to prove your identity is far more secure than sending a 6-digit OTP to your phone or asking you what street you lived on in the past. So threats like Phishing and other cyber threats will be greatly reduced.

“Digital IDs have been well designed and there are no steps consumers need to take to secure themselves. Once Digital IDs are in widespread use, many cyber threats will be entirely eliminated.”

 

Moti Gamburd, CEO, CARE Homecare

 

 

“Use a passkey or strong password, and enable two factors for your ID app. Share only the minimum necessary data as needed. Check all permissions every time. Keep a separate email just for ID and banking. Store scans in an encrypted folder and lock your phone with a long PIN. To be sure you don’t fall victim to phishing, make sure you type the address into the browser yourself. If anything looks suspicious, stop, and verify with your provider. And turn on alerts for credit pulls, and consider a freeze.

“We have instituted a digital aspect for ID check on staff onboarding, and required passkeys, the use of all device locks, as well as a one-time short training class to spot fake verification links. The phishing efforts on our staff dropped significantly and we have had a single incident of ID related fraud since, either on our clients or staff.”

 

Trevor Horwitz, CISO and Founder, TrustNet

 

 

“Protecting yourself from cybersecurity risks of digital identity starts with understanding that your digital ID is more than a login. It connects to your financial accounts, health records, work systems, and personal life. If compromised, it can lead to identity theft, fraud, and unauthorised access to your most sensitive data. Like any critical asset, it needs to be protected with care.

“Use multi-factor authentication whenever possible. A password by itself is no longer enough. Strengthen your accounts with added verification steps and avoid reusing the same credentials across different services. Keep your personal and work identities separate. Use different email addresses and avoid linking unnecessary data between systems.

“Be selective about where you share your digital ID. Many websites and apps request access to information they don’t need. Only provide what’s essential. When you’re working remotely or traveling, avoid using unsecured public Wi-Fi. If you must connect, use a VPN. For international travel, it’s best to carry devices that hold only the minimum data necessary. No one hopes for the worse case scenario, but best be cautious than too carefree.

“Lastly, pay attention to unusual activity on your accounts. Monitor for signs of unauthoriSed access and know how to respond if your credentials are compromised. Be careful with unexpected messages or requests for personal information. Phishing attacks often use urgency to trick users into clicking without thinking. Always verify requests through known, trusted communication channels.

“Staying safe online doesn’t require perfection, but it does require consistency. Build habits that reduce your exposure and strengthen your digital identity over time. The goal is to build trust in how you manage your information and to maintain control over who has access to it.”

 

Dray Agha, Senior Manager Of Security Operations, Huntress

 

 

“The Digital ID will be a prime target, demanding a security-first foundation. Centralising the identities of the entire adult population creates an incredibly valuable target for cybercriminals. The government’s consultation must prioritise how this system will be resilient against sophisticated attacks from its inception. This requires going beyond basic compliance, incorporating principles like zero-trust architecture and ensuring the highest standards of encryption and access control to prevent a single breach from compromising national data.

“Success hinges on public trust, which requires transparency and proven security. With public concern over data security already high, the government must build confidence by being transparent about its security protocols and demonstrating a clear plan for inclusion. The scheme must also securely accommodate those without smartphones to avoid excluding vulnerable groups, turning a potential weakness into a demonstration of thoughtful, secure design.”

 

Sarah Bone, Co-Founder, YEO Messaging

 

 

“Digital ID systems are only as strong as the privacy and security frameworks underpinning them — and right now, public awareness is lagging behind the technology. To stay protected, individuals must treat digital ID credentials with the same care as their most sensitive data.

“That means using strong, unique passwords for any platform that stores or accesses your digital ID, enabling multi-factor authentication wherever possible, using platforms that use continuous authentication and staying alert to phishing attempts that may target identity credentials. Most importantly, users should be asking whether the services they trust with their digital ID follow principles of data minimisation and zero trust — if they’re not, your identity is at risk.”

 

ÁsgeirÓskarsson, Managing Director, BSV Association

 

 

“The UK Government’s proposed digital ID system raises important questions about privacy, security, and user control. Traditional approaches require individuals to submit sensitive data such as passports, residency information, and biometric scans to central databases, creating significant risks around data breaches, surveillance, and identity theft. Large centralised systems are attractive targets for hackers, and once personal data is leaked, it cannot be recovered, leaving users exposed to permanent risks.

“Blockchain-based digital identity offers a privacy preserving alternative. By enabling cryptographic, user-controlled credentials, it allows individuals to verify their right to work and live in the UK without exposing sensitive information in a central database. This approach balances regulatory compliance with digital rights, providing a secure, scalable and user empowering solution. It also encourages innovation by aligning safety, privacy and compliance without forcing trade-offs between them.

“In the context of the UK scheme, a blockchain-enabled system could achieve the government’s goals of verification and fraud prevention while protecting users’ privacy and trust in the platform.”

 

Xavier Sheikrojan, Director, Risk, Signifyd

 

 

“The government’s current proposals for a Digital ID in the UK are focused on immigration and work checks, but this is part of a wider trend. The EU is already developing its own Digital ID framework, and similar systems exist in countries such as India and Estonia.

“From a fraud perspective, a Digital ID could make it harder for criminals to use stolen or synthetic identities. That would be a positive step, but it is not a solution on its own. Centralised systems are attractive targets, and we have seen government data in the UK and elsewhere exposed or disrupted in the past. There are also challenges around adoption. If the system is not accessible to everyone, or if businesses rely on it too heavily, criminals will find ways to exploit the gaps.

“A Digital ID has potential to improve trust online, but it should be treated as one layer in a wider set of protections that includes behavioural and transactional checks. The focus should be on making the system secure, interoperable and inclusive if it is to deliver long-term value.”