Romania becomes EU identity wallet test case as December deadline nears

Romania is now issuing chip-based national ID cards nationwide as the EU pushes every member state to offer a digital identity wallet by Dec. 6, 2026. The shift is forcing banks and other regulated firms to solve a harder problem: verifying both the document and the person presenting it.

Why it matters: - Romania is one of the EU's earliest live tests for eIDAS 2.0 and the digital identity wallet rollout. - Banks, insurers and other regulated firms now have to verify two generations of identity documents inside the same onboarding flow. - The security focus is shifting from document forgery to proving that the presenter is the real holder.

What happened: - Romania's chip-based national identity card is now being issued nationwide after an initial pilot in Cluj county. - More than EUR 150 million in European funds is financing the first batches in 2026. - The chip includes biometric data in a secured zone, qualified electronic signature capability and the national health card function. - Under Regulation (EU) 2024/1183, every EU member state must make at least one European Digital Identity Wallet available by 6 December 2026. - Documents issued earlier remain valid until their printed expiry date. - Chipless identity cards stop being valid by 3 August 2031 at the latest under Regulation (EU) 2019/1157.

The details: - For regulated institutions, the transition means verifying both older documents and chip-based cards in the same flow for years. - Qoobiss says the key operational questions are how to verify a state-signed identity credential remotely at scale and how to confirm the presenter is the credential's holder. - Alexandru Bora, Product Owner at Qoobiss, said traditional document verification relies on probabilistic checks such as microtext, holograms and fonts, while chip verification is cryptographic and confirms the state signed the credential. - Bora said the chip closes one attack surface but leaves open the question of who is holding the document. - Teodor Rogojina, chief executive officer of Qoobiss, said generative AI has shifted the threat model from presentation attacks to injection attacks. - A presentation attack shows a camera a mask, photo or screen and is typically countered by liveness detection. - An injection attack bypasses the camera and feeds fabricated video directly into the application. - ONTRACE uses layered checks: document validation across more than 15,000 document types from over 250 countries and territories, face matching with liveness detection, and channel verification to detect emulators or virtual devices. - Qoobiss cites industry figures showing deepfake fraud attempts up 2,137% over three years and injection attacks up 741% year over year. - Qoobiss also cites global identity fraud losses of more than USD 50 billion. - A study presented in July 2026 under ING's SAFE Talks programme found that 42% of frauds reported in Romania in the first half of 2026 were voice-phishing calls. - The same study said phishing accounted for 14% and SMS-based fraud for 13%. - More than 60% of Romanians over 50 had experienced at least one form of online crime, according to the study. - Qoobiss has been accredited as a remote identity verification provider with Romania's Authority for Digitalisation since December 2022. - Qoobiss says it became the first e-KYC provider in Romania to validate the new chip-based ID cards remotely by video in March 2024. - ONTRACE is undergoing independent evaluation for Presentation Attack Detection and Injection Attack Detection under ETSI TS 119 461 and CEN/TS 18099. - The product is targeting Extended Level with injection detection at Level High. - Results from the evaluation will be published after the process concludes. - Under eIDAS 2.0, providers aiming for that level must submit their detection mechanisms for independent testing before the end of 2026. - Private-sector relying parties that are legally required to use strong user authentication, including banks, must accept the wallet by 6 December 2027. - Rogojina said independent testing is the only proof that can travel across borders and supervisors.

Between the lines: - Romania is not only a policy early mover; it is also a practical stress test for how digital identity infrastructure will work in regulated onboarding. - The article frames biometric verification as the remaining weak point even after cryptographic document validation becomes standard. - Much of the technology verifying Romanian citizens' identities is being built in Romania, raising data sovereignty questions as biometric data moves through vendor systems.

What's next: - EU member states must make a wallet available by 6 December 2026. - Detection mechanisms targeting the relevant assurance level must be independently tested before the end of 2026. - Banks and other relying parties required to use strong authentication must accept the wallet by 6 December 2027. - Verification workflows will shift from document authenticity checks to credential validity, revocation status and biometric holder verification.

The bottom line: - The EU wallet rollout is turning identity verification into a two-part problem: cryptographic proof of the document and biometric proof of the person.