The future evolution of digital identity

In an era of mobile driving licences and digital passports, the concept of “digital identity” has expanded significantly. What was once a mere technical element of information systems has now become a vital asset for individuals, businesses, and governments, requiring protection with the highest security standards.

This article examines the evolution of digital identity, its current applications, the key threats it faces, and its future trajectory.

### Understanding Digital Identity

A [digital identity](https://regulaforensics.com/blog/what-is-digital-identity/) is essentially a collection of attributes in a digital environment that represent a specific entity—be it a person, device, application, endpoint, or an entire organisation. These identifiers distinguish entities from one another. For machines, an IP address might suffice, while for individuals, an email address and password could be used.

Digital identity differs from a user, which is a broader concept tied to access hierarchies. Users with higher authorisation can access more system resources. For instance, in a marketplace, an admin can manage the entire platform, whereas a regular user may only log in, shop, or edit their profile.

Importantly, non-human actors like servers or software can also possess digital identities. However, this article focuses on human identities.

### Types of Identifiers

Digital identities and their identifiers are managed within identity and access management (IAM) systems, which rely on two main processes: authentication, confirming someone is who they claim to be, and authorisation, determining what they can access.

Identifiers generally fall into three categories:

1. **Inherent**: Permanent traits like biometrics (fingerprint, facial scan, iris pattern).
2. **Assigned**: Identifiers granted by third parties (passport number, SSN, mobile number, username, email).
3. **Accumulated**: Behavioural data collected over time (login history, IP addresses, purchase behaviour, profile edits).

Systems often combine these identifiers. A simple login might use just a username and password, while a banking app may add SMS codes or biometrics for enhanced security. Traditional password-only access is now considered weak. Stronger methods include two-factor authentication (2FA), which pairs a password with a one-time code, and biometric checks, such as facial scans or fingerprint recognition, often with liveness detection to prevent spoofing.

### Levels of Digital Identity

With over 5.5 billion internet users worldwide, each maintaining multiple accounts, digital identities are vast. They can be grouped into three levels:

1. **Personal identities**: Created voluntarily for communication or entertainment (e.g., social media, dating apps), they may be anonymous or closely linked to a real individual.
2. **Commercial identities**: Required for services like online banking, e-commerce, or telecoms, they typically involve stronger identifiers and are often regulated under KYC/AML frameworks.
3. **Governmental identities**: Mandated by public institutions for tax filing, benefits, or healthcare, requiring comprehensive personal data and often including biometric elements.

Across these levels, a trade-off exists: the more secure an identity, the less anonymous it becomes.

#### Personal Digital Identities

Users control how much they reveal, from pseudonyms to full personal details. Unfortunately, many rely on weak identifiers like simple passwords, making personal accounts frequent targets for breaches, with over 16 billion credentials exposed recently.

#### Commercial Digital Identities

Businesses such as banks enforce stricter requirements. A mobile banking app, for instance, may require a password, identity document, and a selfie check, with customer behaviour monitored as an additional safeguard. Protection levels vary by industry and geography. Some countries, like the UAE, are moving towards unified KYC platforms, while others maintain sector-specific rules. Emerging models like verifiable credentials (cryptographically signed attributes) and reusable identities (wallet-based profiles) are reshaping commercial identity management.

#### Governmental Digital Identities

Governments maintain fully deanonymised digital identities linked to official registries for public services, tax, or healthcare. Security frameworks differ by country. In Australia, the myID platform offers three tiers of identity strength. In China, users receive a unique internet ID number after registering with physical documents, linking digital and real identities. The EU’s eIDAS framework is creating digital identity wallets for cross-border data control, with full rollout expected by 2026. The latest development is replacing physical documents with digital IDs for both online and in-person verification.

### Threats Facing Digital Identities

Despite their benefits, digital identities are vulnerable across all levels. Key risks include:

1. **Identity fraud**: From phishing and account takeovers to deepfake-based impersonation, synthetic