Proving who you are, without handing over your life.

The problem, stated plainly

In the physical world, proving something about yourself is routine. You show a driver licence to a police officer, a passport at a border, a card at a bar. The document is hard to forge, it is obviously yours, and the person checking it can satisfy themselves in a second or two.

Online, none of that works. Every transaction is remote, and there is no remote equivalent of handing someone a document. So instead we invented accounts: you prove you are you by remembering a secret you agreed with the organisation earlier. That has three consequences, and together they are the reason security budgets keep rising without security improving.

The secret is the weak point. Stolen and misused credentials are involved in the large majority of breaches, year after year, across every published industry survey. Attackers do not need to break the locks when they can log in.

The databases are the prize. To check your identity, an organisation must first collect it. Multiply that by every organisation you deal with and the result is thousands of copies of your personal information, each one a target. Optus and Medibank in Australia showed what a single failure of that model costs.

The user decides, and picks convenience. Stronger security has always meant more friction, so people route around it. Any control that depends on users behaving well eventually loses. This is not a training problem, and more awareness training will not fix it.

Three ways to build an identity system

There are only really three. The first two are what we have; the third is what is arriving. Each is a response to the failure of the one before it.

One — centralised, or siloed

One organisation issues you an account and vouches for you, but only to itself. You carry the burden of every separate login, nothing you prove in one place is reusable anywhere else, and each organisation accumulates its own database of you. Leave the organisation and the identity evaporates.

Two — federated, via an identity provider

“Sign in with…” — a middleman vouches for you to many organisations at once. It genuinely reduces the login burden, but it does not remove the problem, it concentrates it. The provider must settle on security and privacy policies that suit everyone, which means the lowest common denominator; it becomes a far larger target than any single organisation was; and you still cannot use it to prove the things that actually matter — a passport, a qualification, a right to work.

Three — decentralised

No account and no middleman. You hold your own credentials, in something like a wallet on your phone, and present cryptographic proof of them directly to whoever needs it. The relationship is between you and them, with no provider sitting in between owning it. This is much closer to how identity has always worked in the physical world — which is why it feels immediately familiar to people who find the current arrangement baffling.

How it actually works

Three roles, and everything else is detail. An issuer makes a statement about you — the transport agency says you may drive. A holder — you — keeps that statement in a wallet. A verifier checks it.

What makes this different from a photograph of your licence is that the issuer signs the statement cryptographically, so the verifier can confirm it is genuine and unaltered without contacting the issuer at all. No phone call, no lookup, and no record of the check finding its way back to the government.

The same credential, two very different disclosures

Stopped by a police officer. They need to know the licence is real, that it is yours, and what it permits. You disclose essentially all of it — exactly as you would today.

Buying a bottle of wine. The shop needs to know one thing: that you are over eighteen. Today you hand over a document carrying your full name, date of birth and home address to answer a yes/no question. With a verifiable credential you can answer only that question — a true or false, proved against the same signed licence, disclosing nothing else. The technique is called a zero-knowledge proof, and it is the part with the largest practical consequences: an organisation that never receives your address cannot lose it.

The same machinery scales up rather than down. Bank onboarding and anti-money-laundering checks, a contractor’s qualifications and right to work, a parent’s consent for a school trip, proof that a person may act for a company — all of them are a signed statement by someone entitled to make it, presented by the person it concerns, checkable by anyone. And identity here is not only about people: the things we own, control and are responsible for need it at least as much.

Why this is a business question, not a technology one

Trust currently costs time. Verifying a new supplier, onboarding a contractor, opening an account, satisfying an auditor — each is days or weeks of gathering documents and calling people, and the higher the assurance required, the longer it takes. That delay is the price of the assurance.

The whole proposition of digital identity is that the delay and the assurance can be separated: the highest level of trust, obtained in seconds, at effectively no cost. Everything downstream changes when that becomes true.

The European large-scale pilots put numbers on the user side of this: a clear majority of participants preferred the wallet to the methods it replaced, most found checkout faster, and reported fraud fell dramatically. The lesson worth taking is not the specific figures — it is that this is one of the rare security measures people actually prefer, which is why it stands a chance of being adopted at all.

Where this is up to

New Zealand

The Digital Identity Services Trust Framework Act 2023 is the law that makes this possible here, with its Rules following in 2024 and the Trust Framework Authority sitting within the Department of Internal Affairs. Accreditation is opt-in: a provider must demonstrate that it meets privacy, security and information-management standards to be trusted within the framework. Work on digital driver licences, a government wallet and a verification app has been running alongside it. In November 2025 Wellington hosted the twelfth international interoperability test event, with dozens of standards-compliant implementations from eight countries — held here, which says something about where New Zealand sits in this conversation.

Europe

The revised eIDAS regulation obliges every EU member state to offer its citizens a digital identity wallet, free of charge, and — a year or so later — obliges regulated industries to accept it. This is the most ambitious programme anywhere, it is cross-border by design, and it is generating the legal and liability answers that everyone else will end up borrowing.

Everywhere else

Australia has passed its national digital identity legislation and several states already issue digital licences; about half the North American jurisdictions have mobile driver licence programmes under way; Apple and Google have both shipped the browser and wallet plumbing that lets a website request a credential the same way it requests a payment. The standards underneath — ISO/IEC 18013 for mobile driver licences, the W3C verifiable-credentials model — are settled enough that the remaining questions are about governance and liability rather than cryptography.

What we would say to a board

Nothing here demands action this quarter. But two things are worth deciding deliberately rather than by default.

Every identity document you hold is a liability, not an asset. Copies of licences and passports collected for verification and then retained sit on file at almost every organisation we look at. In the model that is arriving you will not need them — and the ones you are holding now are the ones that will be in the breach notification. Knowing where they are is a reasonable thing to ask for today.

Passwords are a decision you are still making. Passkeys are available, supported across every major platform, and phishing-resistant by design rather than by user diligence. They are the first step of this same journey and the one that pays for itself immediately.