There are more and more advanced security threats in the digital arena. Secure start verifies that its the same person using your services who is identifying themselves with BankID. This is one of many means to help prevent i.e. telephone fraud.
Increase security with secure start
Help us increase security with secure start
To enhance protection for both users and e-services, all organizations that use BankID in their e-services need to update to the latest version of our RP-API. Please update as soon as possible, and by May 1, 2024 at the latest.
Important changes
Secure start means that you need to update to the latest version of our RP-API. Doing so means that you need to:
1. Use autostart for BankID on the same device
See technical guide
2. Use animated QR code for BankID on another device
As an animated QR code changes its appearance, it's more difficult to use in scams compared to a static one that can be photographed and sent onwards.
See technical guide
3. Remove start with personal identity numbers
It’s no longer possible to start an identification or signing by having the user type their personal identity number in i.e. an online service. Please use autostart and/or animated QR code instead. Companies using BankID in telephone calls will find support for this in the latest version of the RP-API.
See our technical guide
Parameter changes in the latest API update
personalNumber - removed
endUserUa - removed
autostartTokenRequired - removed
tokenStartRequired - removed
issuerCn - removed
cert - removed
notBefore - removed
notAfter - removed
uhi - new
stepUp - new
mrtd - new
bankIdIssueDate - new
allowFingerprint renamed to pinCode with new defaults
mrtdRequired renamed to mrtd
personalNumber - new
Get updates
This page is updated with new information over time. We also communicate through our Technical newsletter.
FAQs about secure start
Here you find ansers to the most common questions related to secure start of BankID.
The animated QR code is used when the customer visits your online services on a computer, but use a different device for the BankID identification. An animated QR code prevents scammers from using an image of the code to fool your customers.
How it works:
The customer selects "BankID on another device" in the online service.
The customer scans a QR code on the computer screen, using the BankID app.
The customer give their approval in the BankID app.
In our technical guide you can find more information about the animated QR code and instructions on how to implement it.
Secure start means that you need to update to the latest version of our RP-API. Doing so means that you need to:
Use autostart for BankID on the same device.
Use animated QR code for BankID on another device.
Remove start initiated by personal identity numbers.
In the latest version of the RP-API, support for start initiated by the personal identity number is fully removed. This is an important security measure that lowers the risk of fraud and enhances security further. The update is mandatory. However, an exception is made for companies using BankID for signing of card payments. Support for this is under development and these companies must wait to make the update. Therefore, the set date of May 1st 2024 is not valid for these companies.
Technical guide
Follow the instructions in our technical integration guide to update to the latest version, version 6, of our RP-API.
Yes. In the latest version, the support for start with personal identity numbers is completely removed. It is an important security measure that will reduce the risk for fraud. All companies, organisations and authorities who use BankID in their services are required to upgrade to the new version.
Companies using BankID for signing of card payments must wait to make the update until support for this is available.
You can find instructions and information about how to update to the latest version, version 6, of the RP API and how to implement animated QR-code, in our technical guide.
The personal identity numbers are public and easy to get hold of. If an identification or signing is started by the user typing in their personal identity number, the flow can be started from another location which can be used by scammers. Using secure start means that the device holding the BankID must be in the same place as the device used for visiting the service.
It depends on if you will use BankID in phone calls and/or for card payments. If not, its limited to a minor upgrade with a URL change and changing names of a few parameters.
Use of BankID in phone calls and/or for card payments will require implementation of new interfaces for these functions. Support for BankID in phone calls is available in the latest version of the RP-API, and support for card payments is currently under development.
More information and instructions can be found in our technical guide.
Autostart is used when the customer visits your online services on the same device as they keep their Mobile BankID on. From your service, the BankID app is started without any middle steps. This makes the identification faster and gives a better user experience. Further, it enhances security by eliminating other steps that could be used by scammers.
How autostart works:
The customer selects "BankID on same device" in your service.
The BankID app is opened automatically.
The customer give their approval in the BankID app.
