A photo of a passport lives in an alarming number of people’s phones.

It sits in the camera roll between lunch and a screenshot of a boarding pass. Someone needed identification for a hotel, rental, form or account, so taking a photo felt easier than finding a scanner.

Digital identity wallets are supposed to make that kind of improvised identity sharing less necessary.

Europe is pushing this idea into the mainstream with the EU Digital Identity Wallet framework, under which member states are expected to provide wallets by the end of 2026. Other governments and companies are exploring similar ideas around mobile IDs and verifiable credentials.

Putting an ID on a phone is the easy part. Deciding what it should prove, to whom, and how much information should leave is harder.

Most places ask for more information than they need

Suppose a website needs to confirm that you are over eighteen.

A traditional ID may reveal your full name, exact birth date, photograph, document number, nationality and address. The business gets a pile of information when the real question was yes or no.

A well-designed digital identity system can be more selective. It could confirm the required attribute without handing over everything else.

That idea is more important than the convenience of leaving a physical card at home.

Privacy often improves not because data is hidden better, but because unnecessary data is never shared.

If digital wallets simply turn the whole passport into a convenient QR code, we have missed a large part of the opportunity.

Convenience will drive adoption before philosophy does

People rarely change identity habits because of architecture.

They change because the new method saves time.

If a wallet lets someone prove identity to a bank without photographing documents, sign into a government service without creating another password, or show a driving credential without handing over a physical card, people will use it.

That convenience can create a useful security improvement. Fewer scans and photocopies means fewer copies of sensitive documents sitting in email inboxes and business databases.

But the experience has to be good.

If every verification requires five screens, a PIN, a biometric check and a mysterious government app update, users will return to sending photos over WhatsApp.

Security loses when the workaround is easier.

The phone becomes more important than ever

Once identity credentials live on a device, losing that device feels more serious.

This is where people sometimes jump to the wrong conclusion: if the phone is stolen, the thief now has your identity.

A properly designed wallet should protect credentials behind device security and cryptographic controls. The thief should not be able to open the wallet simply because they are holding the hardware.

Still, recovery becomes essential.

Can you revoke credentials? Restore them to a new device? What happens if you forget the phone and need to travel? Is there an offline alternative when the battery is dead?

The physical wallet had crude but understandable failure modes. Digital wallets need equally understandable recovery.

Nobody wants to discover the identity support process while standing at an airport counter.

Businesses should not collect data just because they can

Digital credentials may make verification easier for companies.

That should not become an excuse to verify everything.

A service that only needs proof of age should not request a full identity profile. A hotel that needs a legally required set of details should not keep additional attributes forever because the wallet made them easy to obtain.

The technology can support selective disclosure, but business processes must respect it. Companies still have a habit of collecting data “in case it is useful later.”

Later eventually becomes a breach notification.

Data minimisation is much easier when the system is built around asking for specific facts rather than copying entire documents.

One wallet should not become one giant login

The convenient future has a slightly unpleasant version.

Your identity wallet becomes the default way to access banking, travel, government services, social platforms and perhaps age-restricted websites. Suddenly one system sits in the middle of a large part of digital life.

That concentration needs safeguards.

Users should understand which organisation issued a credential, which service requested it and what information was shared. Consent should be specific. Transactions should be visible enough that unusual requests stand out.

I do not want a future where a bright green “Share” button becomes the identity equivalent of accepting every cookie banner.

Convenience without attention turns into automatic disclosure.

Offline proof is more important than it sounds

Identity checks do not only happen with perfect internet.

A police stop, ticket inspection, border queue or local service may have weak connectivity. Digital credentials need ways to work safely in those situations, depending on the use case.

This is one reason standards matter. The wallet cannot be only a screenshot of a card. It needs a way for another party to verify that a credential is genuine and still valid.

Screenshots are easy to copy and edit. A proper digital credential carries cryptographic proof.

The user should not need to understand that.

They should see what is being requested, approve the right information and move on.

The difficult engineering should stay behind the simple interaction.

Fraud will move rather than disappear

Digital identity can reduce certain kinds of document fraud.

It will create new targets too.

Scammers may try to steal access to wallets, trick users into approving credential requests or create fake apps that look official. Businesses may receive convincing-looking information through poorly implemented verification systems.

The answer is not to abandon digital identity. Paper documents are not fraud-proof either.

It means people will need a few new instincts: install wallet apps from trusted sources, protect the device account, read what information is being requested and treat unexpected identity prompts like unexpected payment prompts.

If a random website suddenly asks for your full identity, the correct reaction should remain suspicion.

The boring version is the one I want

I don’t want my digital identity wallet to feel futuristic.

I want it to work at a hotel desk, a government website and a bank without forcing me to photocopy the same document three times. I want it to reveal less information when less is enough. I want recovery to be clear when the phone disappears.

And I want the option to use another route when technology fails.

The success of digital identity will not be measured by how impressive the wallet looks.

It will be the day someone asks for proof of age and you share exactly that.

Nothing more.