Digital Driver's Licenses, Part One - The Road to Digitization
07 Dec, 2025
On October 1st of this year, the digital driver’s licenses previously delivered through so-called digital wallets were fully phased out, and new digital licenses were moved into the island.is app . In this three-part blog series, we’ll trace the story behind these licenses, reflect on the security implications of the transition, and dig deeper into the technical implementation of the original certificates.
The Beginning
On October 1st, 2019, Norway became the first European nation to issue digital driver's licenses . The idea behind the new licenses was to accommodate the rapidly growing group of people who forgot their physical license at home while driving and consequently couldn't present valid licenses during traffic stops. The Icelandic Transport Authority watched the Norwegian launch with great interest , and in early 2020, the Minister of Justice announced on Twitter that the issuance of digital driver's licenses in Iceland was on the horizon .
The Norwegian driver's licenses in a dedicated app that also includes a scanner.
On July 1st, 2020, the new digital driver's licenses were introduced at a press conference . This was a joint effort between two ministries, with Digital Iceland, a project management office within the Ministry of Finance, overseeing the technical implementation. The issuance of the digital licenses required a regulatory amendment , which was amended to ensure the licenses were equivalent to traditional plastic licenses domestically. Consequently, the digital driver's licenses could also be used as personal identification, a fact confirmed by a Minister at the press conference. The licenses enjoyed immediate popularity with around 25,000 digital licenses issued within the first 24 hours following the press conference , and nearly 100,000 by the beginning of 2021 .
The Icelandic driver's licenses in a digital wallet.
The Implementation
The so-called PKPass standard from Apple was chosen for the implementation of the Icelandic licenses. This standard, originally developed for Apple Wallet, is widely used for various types of passes intended for digital wallets, such as boarding passes, movie tickets, punch cards, etc. The digital driver's licenses were given a design similar to the traditional ones, featuring the characteristic pink background, displaying name, birth year, ID number (kennitala), photo, and driving privilege categories, as required by the regulation . At the bottom was a 2D barcode intended for scanning. However, no scanner was released alongside the digital license. Instead, simply showing the ID on the phone when asked was supposed to suffice .
The implementation of the Icelandic licenses therefore differed from the Norwegian one. The Norwegian licenses were issued via a dedicated app, which could also scan others' licenses to verify their authenticity. However, one of the biggest differences between these two licenses lies in the messaging that accompanied their release. In Norway, it was explicitly stated that these licenses were not equivalent to personal ID cards and were solely intended for the police to confirm drivers' rights during traffic stops . Conversely, in Iceland, the licenses were placed on equal footing with plastic licenses, and it was confirmed that they could be used at pharmacies, the state liquor store (Vínbúðin), and polling stations to prove one's identity.
It wasn't long before discussions arose regarding the security of the new licenses , particularly regarding their forgery. Methods such as screenshots and home-made PKPass files were pointed out on social media.
Forgeries
Forgery of identification documents is as old as the documents themselves. As long as someone stands to benefit from misrepresenting themselves or tweaking their information, such as age, the incentive for forgery will never disappear. Traditional plastic IDs are no exception, and indeed, news has surfaced in recent months that high-quality forgeries of Icelandic driver's licenses are being sold online .
Precisely for this reason, issuers of licenses and IDs, both domestically and abroad, have worked to improve security measures over time. This applies especially to licenses intended to be valid across borders. Examples of the evolution of such security measures can be seen in the Public Register of Authentic Travel and Identity Documents Online (PRADO), where the latest version of traditional Icelandic driver's licenses features, for instance, six built-in security features.
It must not be forgotten that the users of licenses (those accepting them), and especially licenses used as IDs, are people. The background of these people can vary immensely. At borders, people specially trained to spot discrepancies and forgeries accept IDs. Conversely, in pharmacies and nightclubs, we have regular people who generally have limited knowledge of forgeries. Yet, these people often possess a certain built-in skepticism towards IDs. Most of us understand how the forgery of traditional IDs can take place, and thus we are, even unconsciously, on guard. Those who handle licenses regularly might even notice small details like weight difference, texture, peculiar fonts, etc.
If we compare this to forgeries of licenses that appear on a screen, the method is by no means analogous to traditional IDs. Forging such IDs, assuming they are not scanned for verification, simply involves imitating the appearance of something displayed on a screen, i.e., an app in the case of a phone screen. With the PKPass route that was chosen, there were actually other simpler forgery methods available, comparable to editing text in a Word document, which made them exceptionally prone to forgery. We will go into more detail on that in the third part of this blog.
Fundamentally, this forgery, if one can call it that, revolves around recreating a certain interface and displaying it on a screen. The simplest way to do this is simply to show a photo or screenshot of an ID. Images can be manipulated to change the ID number, photo, or whatever else one fancies. That implementation doesn't withstand much "scrutiny" if the recipient of the license is allowed to interact with the phone displaying it, but this method has undoubtedly served many well.
But what if the recipient of the ID gets free access to the ID holder's phone and can open the hosting app themselves? The fact is, it is possible to simply recreate and mimic any app. One can build an exact replica of a wallet app containing a license with whatever information desired. With the advent of artificial intelligence, this method is accessible to even more people interested in such forgeries.
The most important thing to understand is that unlike plastic licenses, where one can have security features such as holograms, microprinting, UV printing, infrared printing, laser engraving, and color shifting, nothing of the sort can be placed on a screen. Pixels are just pixels!
We see, therefore, that one cannot equate the forgery of these two types of IDs. Setting up a facility to forge Icelandic plastic driver's licenses would entail massive costs involving specialized equipment, raw materials, and the like. The sale of certain devices and materials is monitored, making the process difficult and opening up the possibility of tracing. If the forgery is discovered and the equipment confiscated, the cost of starting over is equally high.
If we then compare this to the forgery of digital driver's licenses (without a scanner), there is virtually zero cost involved, as everything is done electronically. Let's say an app is created that clones a wallet app and displays an ID. Such an app can be distributed worldwide the moment its design is finished. Even if the original author is found and their version taken down, the app's source code could already be all over the world, making it impossible to "remove" it from the Internet.
We can therefore see that the impact of forging traditional licenses cannot be compared to that of digital ones.
The Fight Against Forgeries
Let's return to the history of the licenses. On February 2nd, 2021, five months after the implementation of the licenses, Digital Iceland issued guidelines on how to verify a digital driver's license . Among other things, it pointed out that the license should be refreshed to ensure it wasn't a screenshot. The guidelines also mention the possibility of setting up a license scanner or gaining access to a license registry, but to do so, one would need to contact Digital Iceland.
There was likely a reason these instructions appeared when they did. That summer, media outlets reported that nightclub doormen were repeatedly encountering fake digital licenses . Shortly thereafter, the deputy CEO of ÁTVR (The State Alcohol and Tobacco Company) was quoted saying that an increasing number of forged digital driver's licenses were being presented in liquor stores, and proving the licenses' validity had proven almost impossible . These events were revisited at Digital Iceland’s recent conference, Tengjum ríkið 2025.
As time went on, we saw growing forgery, and we needed some solution to scan the IDs just as we knew the police were doing.
Kristján Ólafsson - Managing Director of Sales and Services, ÁTVR
During this time, tips regarding various forgery methods could also be seen on social media .
On September 1st, 2021, the cybersecurity company Syndis published a blog that analyzed the technical implementation of the licenses and demonstrated how easy it was to forge IDs that passed every test in Digital Iceland's verification guidelines. At this time, Parliamentary elections were underway, and a discussion arose regarding the potential use of forged IDs for voter fraud. That discussion underscored the importance of ID integrity when it comes to national security.
A scanner was made available to polling station staff before the conclusion of the 2021 Parliamentary elections , and nearly a year later, the scanner was made available to everyone with access to the island.is app .
For the next three years, forgeries of digital driver's licenses seemed to persist, despite the arrival of the scanner . The reason appears to be that the scanner was not in use everywhere digital driver's licenses were accepted. In early 2024, the Ruling Committee for Environment and Natural Resources actually addressed one such case, where an employee of a snus shop failed to scan a forged ID from a minor during a sale. The committee's conclusion was that store was not responsible for the forgery of licenses and therefore did not need to verify their validity.
What is a License?
Here we run into what is possibly the biggest problem with the implementation of digital licenses, and that is simply the question: what is the license? If we are talking about traditional licenses, the answer is obvious: the license is the piece of plastic with the photo and the text. But when it comes to a digital license, the lines are blurred. In the eyes of the authorities, the license seems to be the visual representation that appears on the phone and the information displayed on it. But as we outlined before, one can never trust what appears on a digital screen . Unlike the security measures that can be applied when printing IDs, no such thing is available when images are displayed on a screen. You can make anything appear on a computer or phone screen. Information displayed on a phone is therefore completely unreliable unless it can be confirmed in a reliable manner.
From a security perspective, the answer to the question would therefore be: the trusted information that pops up when the license is scanned, not what is written on the screen of the license holder.
This is a classic example of a discrepancy between the real world and the digital world. Although we talk about wallets and cards in digital wallets, these phenomena are by no means comparable. Just because things share a name doesn't mean they are the same. This can be particularly dangerous when people have learned to treat an object in the real world a certain way and attempt to apply that same behavior to the digital counterpart. This will be the subject of the next part of the blog.