BankID with Biometrics

Which provider is used in the solution?

BankID with biometrics uses built-in biometrics in a phone or computer, also called WebAuthn. BankID never has access to biometric data but receives a signed confirmation from Apple or Google that the user has identified themselves with biometrics.
When is it recommended to use BankID High for a transaction instead of BankID with biometrics?

BankID with biometrics corresponds to the assurance level of Substantial. Certain companies may require the use of High level, such as processing of health information. High level of assurance is recommended for transactions involving high value, such as confirming agreements or paying large amounts.
Can BankID with biometrics be used to digitally sign a document?

If you need to electronically sign a document, you cannot use BankID with biometrics.

If you have chosen signing to display information such as the amount and recipient of a payment, but require a Substantial level of assurance, BankID with biometrics is a good choice.
When can the general public log in to various places using BankID with biometrics?

This will be rolled out to the public in the spring of 2023, depending on when the end-user's bank enables biometrics for its customers.

Various companies that use BankID on their customer platforms will already be ready today.
What does a business/user site that currently uses BankID need to do to start using BankID with biometrics?

Contact the dealer from whom you purchase BankID or contact us via the contact form.
What do end-users need to be able to use BankID with biometrics?

End-users need a regular BankID with a password and have accepted the terms to use their biometrics through their BankID app. For banks that do not offer the BankID app, users must activate BankID with biometrics through the bank's own app.
How secure is BankID with biometrics?

BankID with biometrics is approved for payment and meets the requirements for secure customer identification (SCA) according to PSD2 and 3Dsecure. The service is at the Substantial level of assurance according to the eIDAS standard. This means that the service can be used for most things.
What is the price for a BankID with biometrics transaction vs. "regular" BankID with a password?

The price of BankID authentication is 1.20 NOK, and BankID with biometrics will be from 0.85 NOK and downwards (volume discount). Note that these are prices between BankID BankAxept AS and our partners. The price will therefore be higher for companies that purchase BankID through a BankID partner.

The price for BankID with biometrics will be charged regardless of whether the end-user has activated biometrics or not. If the end-user has not activated biometrics, it will be a regular BankID login but at the same price as a biometric login.
Where can I find technical information about BankID with biometrics?

You can find technical documentation for BankID with biometrics here.
When will banks roll out BankID with biometrics to their customers?

Rollout starts the first half of 2023, at first to a group of randomly selected beta users. After a period of testing and adjustments based on feedback from the beta users, BankID with biometrics will be availiable for all during the spring of 2023.
When should a customer choose BankID with the highest security level (High) and not BankID with biometrics (Substantial level)
BankID with biometrics is at a Substantial level of trust (in Norwegian, "Betydelig"). Some businesses may require the use of a High level of trust, such as when accessing sensitive personal information like health data. A High level of trust is recommended for transactions involving high-value transfers, such as confirming agreements or paying large amounts. High must also be used for BankID signing.

In addition, our recommendation is:
- High is used when changing important personal information (such as registered address, etc.)
- High is used in transactions that involve unusually high risk for the user or the site (e.g. when transferring unusually large amounts)
- Biometrics isused in all other logins and "normal" payment situations.
What should be considered when a customer/site uses iFrame?

BankID with biometrics does not support being displayed in an iFrame. The reason for this is that it is harder to guarantee security inside an iFrame, and the biometrics service we use does not support iFrames in many cases for security reasons. BankID OIDC is also phasing out iFrame support. We recommend opening us via redirects or opening a new window.
What is the assurance level for BankID with biometrics?

BankID with biometrics is simpler and faster than regular BankID. It also has a slightly lower security level (Substantial). Sites should use traditional BankID for services that involve large money transfers, access to highly sensitive information, or require assurance level "High" (according to the eidas regulations). For almost everything else, you can use BankID with biometrics.
Who can use BankID with biometrics?

End-users who can use BankID with biometrics (face, finger, or PIN) have activated this option within the app. Currently, only end-users with the BankID app can use BankID with biometrics.
Why should a business customer switch from the current BankID (High) to BankID with biometrics?

Biometrics are a fast and secure eID with a trust level suitable for daily tasks. High also has a password and is self-declared at the highest assurance level.
How do I, as a merchant, proceed to use BankID with biometrics?

You can order via this contact form.
Can a merchant also obtain a national identification number when using BankID with biometrics?

Yes, the guidelines are the same as for BankID High.
What is the customer experience like for customers who have not activated BankID with biometrics?

They can use BankID with a password or BankID on mobile as before. BankID on mobile is gradually being phased out, and no new customers can now get BankID on mobile.
Where do I go to learn more about BankID with biometrics (product info and UX/user experience)?

Go to BankID.no/private. More information will be available there soon. See the landing page for beta users.
Technically, what is happening?

The new BankID is based on the open technology called WebAuthn (The Web Authentication API) developed by FIDO and W3C, with participants from several of the world's largest tech companies. The password becomes redundant and is replaced by "something you are" along with "something you have," the phone or tablet.

WebAuthn is a secure technology that protects users well without sharing unnecessary data. BankID (and WebAuthn) with biometrics/PIN consists of a "key pair" (credentials) consisting of a private key securely stored on your phone and a public key together with a randomly generated key ID used at the site where you want to log in. Your biometrics or PIN never leave the phone, and the technology is well protected.