mobiilID

MobiilID is Estonia’s mobile-based digital identity solution that enables strong authentication and digital signing using a SIM card. The private keys and digital certificates used for authentication and signing are stored on the SIM and are issued by a certification authority in cooperation with Estonian mobile operators. The system is a core component of Estonia’s e-government and online service ecosystem, providing a credential that can be used across government portals, banks, and other digital services.

How it works:

A user registers for MobiilID with a participating service provider and obtains a personal certificate loaded on the SIM. To log in or sign a document, the user enters PIN1 to unlock the private key and PIN2 to authorize the action. The cryptographic operation is performed on the SIM itself, and the resulting authentication data or digital signature is transmitted to the service over the mobile network. The process relies on public key infrastructure and trusted certificates to verify identity.

Usage:

MobiilID is widely used for online banking, tax filing, access to government e-services, and document signing. It is one of several means of digital identity in Estonia, alongside ID cards and Smart-ID, and is integral to many secure online transactions in the country.

Security and limitations:

The system provides two-factor authentication with something the user has (the SIM) and something the user knows (the PINs). The private key never leaves the SIM, and certificates can be revoked if a device is lost or compromised. Potential risks include SIM card replacement abuse or SIM swap requests, as with other mobile-based identity solutions. Availability depends on operator support and network access.