Digital Identity Shadowing: The Danger of Parallel Digital Identities

Digital Identity Shadowing: the insidious shadow of digital identity

The debate on digital identity security often focuses on credential theft: stolen passwords, phishing attacks, malware, unauthorized access. However, there is an even more insidious scenario: the creation of a parallel digital identity, formally valid but controlled by a subject other than the legitimate owner. This phenomenon, which we might call Digital Identity Shadowing, represents a subtle but powerful threat.

How Digital Identity Shadowing works

The critical point is not to demonize tools like SPID, which are fundamental for the Italian digital transformation, but rather to examine the overall governance of digital trust. A citizen can have multiple SPID identities with different providers, but the real criticality emerges when this multiplicity is not accompanied by adequate visibility for the citizen.

If a criminal manages to fraudulently bypass the recognition process with an identity provider, they could create a new digital identity in the victim's name using email addresses and phone numbers under their control. In this scenario, the citizen might receive no communication on their usual channels and not be notified of the SPID already in use. Moreover, they would not have an immediate and unique view of all active digital identities in their name.

Implications and concrete scenarios

The danger of this shadow identity emerges when it is inserted into a chain of legitimate processes. Imagine a concrete scenario: a parallel digital identity is used to access an online public service and file a report of a lost SIM. This documentation is then presented to a telephone operator to request a replacement SIM or eSIM.

Once control of the number is obtained, the attacker can intercept SMS OTPs, recovery codes, notifications, or reassociation procedures still used by banking services and digital platforms. The Public Administration trusts the digital identity, the telephone operator trusts the report, and the bank trusts the phone number. The criminal does not attack a single technical control but exploits the trust accumulated between different systems.

The need for a unique identity governance

Digital Identity Shadowing highlights a cultural rather than technological gap. We continue to design digital processes by domain, while attackers think in terms of chains. The PA sees authentication, the operator sees SIM replacement, the bank sees the device or number, but the attacker sees the entire path.

To address this threat, a unique national dashboard would be needed, clear and accessible, where every citizen can see which digital identities are active in their name, with which providers, when they were created, and when they were used. Moreover, the creation of a new digital identity on an already existing tax code should generate an independent alert to the citizen, using channels already known to the Public Administration: IO app, digital domicile, PEC, CIE ID, or other consolidated institutional tools.

Preventive measures and shared responsibilities

Telephone operators should treat SIM replacement, eSIM, and loss as high-risk events, especially when the request occurs shortly after the issuance of a new digital identity or via remote channels. Banks should correlate SIM change, new device, credential reset, new beneficiary, and device limit increases. If multiple anomalous signals occur within the same timeframe, the operation should not proceed normally.

Until this possibility is addressed with full visibility, independent notifications, coordinated anti-fraud checks, and clear responsibilities among the actors involved, we will continue to have a blind spot in the national digital identity. A digital identity should never have a shadow.