BankID

BankID is a Norwegian electronic identity service used for secure authentication and legally significant digital signing. It is provided through banks and is designed to let individuals identify themselves when accessing online banking, public-sector services, and other digital services. The service is associated with Norway rather than with the similarly named Swedish BankID system. The underlying technology is based on public-key infrastructure (PKI). In practical terms, BankID uses digital certificates and cryptographic keys to connect an authenticated user with an electronic identity. This supports two principal functions: confirming that a person is the holder of a BankID credential and enabling that person to sign documents or transactions electronically. The infrastructure has historically been operated centrally by Nets, formerly known as Bankenes BetalingsSentral, while the service has been distributed through participating Norwegian banks. BankID originated in cooperation between the Norwegian Financial Services Association and the Norwegian Savings Banks Association. That cooperation, known as BankID Samarbeidet, provided a banking-sector basis for a shared national identity solution. The first service, commonly called BankID on file, was launched in 2003. In that early model, a digital certificate and secret cryptographic key were stored on the user's computer. This made the service available through a conventional personal-computer environment but also concentrated sensitive credentials on the local device. BankID on card followed in 2005. In that version, the private key was stored in the chip of a smart card. The card could be issued as a dedicated BankID card or integrated with a payment card, and some variants included a photograph. Because use generally required physical possession of the card, the card-based model was presented as a more secure alternative to a credential stored on a computer. A mobile version arrived in 2010, with the private key stored on the subscriber identity module, or SIM card, in the user's mobile telephone. The system also evolved toward a bank-stored or net-centric model. Security research in 2007 demonstrated that identities could be stolen in the then-existing solution, contributing to a change in how keys were stored. The bank-stored version subsequently became the most widely used form described in the available reference material. BankID has been used beyond commercial banking, including for access to Norwegian public services and the ID-Porten public authentication gateway. It is described as meeting the highest Norwegian electronic-identification security level, level 4, and as being used by more than 4.2 million Norwegians in the referenced material. Together with MinID, it is one of Norway's most widespread electronic identity solutions. The product architecture has continued to change as consumer devices and authentication practices have developed. In 2022, BankID announced that its mobile-SIM service would gradually be retired in favor of the BankID app. According to the supplied reference material, BankID on Mobile had been completely phased out by 2025. The current direction therefore emphasizes app-based authentication while retaining BankID's broader role as a shared identity and signing service delivered through Norway's banking ecosystem.

BankID developed from a collaboration among Norway's banking organizations. The initiative was organized through BankID Samarbeidet, bringing together the Norwegian Financial Services Association and the Norwegian Savings Banks Association. The collaboration created a shared basis for electronic identification across participating banks rather than requiring each bank to operate an entirely separate identity system. Those industry organizations were later partly consolidated under Finans Norge. The first BankID service was introduced in 2003. Known as BankID on file, it used a digital certificate and secret cryptographic key stored on the user's computer. This approach enabled electronic authentication and signing through a personal-computer environment, but it also made the local computer an important repository of the user's security credentials. In 2005, BankID on card extended the service to smart cards. The private key was stored in the card chip, and the card could be issued either as a dedicated BankID card or in connection with a credit card. Some cards included a photograph and could serve an identification-related function in addition to their cryptographic role. Physical possession of the card generally provided an additional security factor compared with a file-based credential. The service was also adapted for mobile use. In 2010, BankID on Mobile was launched with the private key stored on the SIM card in the user's telephone. Alongside these client formats, the system included a bank-stored or net-centric version in which the key was held within the banking infrastructure. The bank-stored approach became the most widespread version identified in the available reference material. BankID's development was influenced by security research. In 2007, Kjell Jørgen Hole, a professor of information security at the University of Bergen, and doctoral students demonstrated that identity theft was possible in the solution as it then operated. Following this issue, the key-storage model was changed so that the key was held at the bank. This illustrates the service's evolution from locally stored credentials toward more centrally managed security controls. BankID became an important authentication layer for more than banking. It was used for Norwegian public services and for ID-Porten, the public-sector gateway for accessing digital services. The system is based on PKI and supports both authentication and electronic signing. The supplied reference material describes BankID certificates as qualified certificates self-declared to the Norwegian Communications Authority, alongside other Norwegian electronic identity solutions such as Buypass ID and Commfides. It also describes BankID as meeting security level 4, the highest level in the relevant Norwegian framework. More than 4.2 million Norwegians were reported as using BankID in the referenced material. Together with MinID, it became one of the country's most widely used electronic identity systems. Its infrastructure was operated centrally by Nets, formerly Bankenes BetalingsSentral, while Norwegian banks remained the service providers to customers. The next major transition concerned mobile authentication. In 2022, BankID announced that BankID on Mobile would be gradually retired in favor of the BankID app. The shift reflected a move away from SIM-based credentials toward app-based authentication on smartphones. The supplied reference material states that the legacy BankID on Mobile service had been fully phased out by 2025. BankID therefore remains an active Norwegian digital identity brand, but its client technology has progressed from computer files and smart cards to bank-stored credentials and app-based mobile use.

1. 2025BankID on Mobile is fully phased out

   The supplied reference material states that the legacy BankID on Mobile service has been completely discontinued.

   Source
2. 2022Transition to the BankID app is announced

   BankID announces the gradual retirement of its SIM-based mobile service in favor of the BankID app.

   Source
3. 2010BankID on Mobile launches

   A mobile version is introduced with the private key stored on the user's SIM card.

   Source
4. 2007Identity-theft vulnerability is demonstrated

   University of Bergen security researchers demonstrate that identities could be stolen in the existing solution, prompting a move toward bank-stored keys.

   Source
5. 2005BankID on card launches

   A smart-card version is introduced, placing the private key in the card chip and generally requiring physical possession of the card.

   Source
6. 2003BankID on file launches

   The first BankID service is launched, storing the user's digital certificate and secret cryptographic key on a computer.

   Source

A trusted, bank-backed national electronic identity and signing infrastructure for secure access to financial, commercial, and public digital services.

• Bank-stored BankIDElectronic identification

  The bank-stored, or net-centric, version keeps the relevant private key within the banking infrastructure rather than on the user's computer. It became the most widespread BankID version described in the available reference material and supports both authentication and electronic signing.

• BankID on cardSmart-card authentication2005

  Introduced in 2005, BankID on card stores the private cryptographic key in a smart-card chip. The card could be dedicated to BankID or associated with a credit card, and some variants included a photograph. The format was designed to add a physical possession requirement to electronic identification.

• BankID on MobileSIM-based mobile authentication2010

  Launched in 2010, BankID on Mobile stored the private key on the user's mobile SIM card. It provided mobile authentication through participating Norwegian mobile operators, but was later scheduled for retirement as BankID moved toward app-based authentication.

• BankID appMobile electronic identification

  The BankID app is the successor direction for mobile BankID use. It replaces the SIM-based mobile service and provides an app-based channel for authentication and, where supported, electronic signing.

• 2022Retire BankID on Mobile in favor of the BankID appGeneration change

  BankID's SIM-based mobile service was an older client format, while smartphone app authentication offered a new delivery model.

  What changed. BankID announced a gradual phase-out of BankID on Mobile and a transition to the BankID app.

  Aftermath. The supplied reference material states that BankID on Mobile was fully phased out by 2025.

  Source
• 2007Move toward bank-stored cryptographic keysStrategy

  Security researchers demonstrated that identities could be stolen in the then-current BankID solution.

  What changed. The key-storage approach was changed so that the key was held at the bank, rather than relying solely on local storage.

  Aftermath. The bank-stored version became the most widely used form described in the available reference material.

  Source

• 2025BankID on Mobile is phased out

  The supplied reference material states that the legacy BankID on Mobile service had been fully phased out by 2025.

  Product generation
  Source
• 2022BankID announces transition from BankID on Mobile to the BankID app

  BankID announced that its SIM-based mobile service would be gradually discontinued and replaced by the BankID app.

  Product generation
  Source
• 2007Security researchers demonstrate identity-theft risk in the BankID solution

  Kjell Jørgen Hole and doctoral students at the University of Bergen demonstrated that identities could be stolen in the then-current solution. The event contributed to a change toward storing the key at the bank.

  Other
  Source

1. BankID (Norway)
2. BankID official website