Catch All Activation Method — Physical Presence Verification

Quick overview of how the updated RA Officer identification works with verification codes.

SPI specification: BankID RA Service Provider Interface (SPI) for activation of BankID App

The idea

User needs to activate BankID App but can’t use biometric verification and neither have a code device. They visit the bank branch, an RA Officer checks their ID in person, and gives them a verification code. The user types that code into the app to prove they were actually there.

Flow

Catch All Activation User Journey

The two SPI endpoints

1. Get customer service info

POST /ra-officer/customer_service_info

Called early in the flow so we can show the user where to go and what to bring.

Request:

{
  "client_name": "vipps-bapp-client",
  "request_id": "e6dccaf0-...",
  "originator_id": "9980"
}

Response:

{
  "customer_service_info": {
    "phone_number": "+4712345678",
    "display_name": "Bank of Norway",
    "verification_method": "MANUAL_CODE",
    "code_length": 6,
    "instructions": "Please bring a valid passport or national ID card to your appointment.",
    "booking_url": "https://www.bankofnorway.no/book-appointment"
  }
}

First release scope: Only MANUAL_CODE is supported in the initial release. QR_CODE will be introduced in a future release (gated on app-side scanner work, not SPI changes).

Verification code format by method

MANUAL_CODE: The verification_code must be a 6-digit numeric code (digits only). The RA Officer provides the code and the user types it in.

QR_CODE (not supported in first release): RA system generates a QR code which user will scan in BankID App. BankID system will send the code as a string (up to 1024 characters) to RA system for verification.

2. Check user identity verification

POST /ra-officer/check_user_identity_verification

Called when the user submits the code. The bank validates it and marks it as consumed (single-use, can't reuse).

Request:

{
  "client_name": "vipps-bapp-client",
  "request_id": "e6dccaf0-...",
  "originator_id": "9980",
  "nnin": "11111111016",
  "activation_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "verification_code": "123456"
}

Response (success):

{
  "verified": true
}

Response (failure):

{
  "verified": false,
  "error": "INVALID"
}

Error can be INVALID, EXPIRED, or CONSUMED.

5 attempts limit

The user is given 5 attempts to validate the code submitted. After 5 failed attempts the session is blocked and the user must wait until the session times out (1 hours and 30 minutes) before trying again.

The session is tied to the device, and so another workaround can be to reset or re-install the app on device.

Audit Trail Requirements

This activation method involves in-person identity verification at a bank branch. The following audit trail requirements apply.

What the bank receives from the SPI

The following fields are sent by BankID during the SPI calls and must be stored by the bank to allow correlation with the activation:

From POST /ra-officer/customer_service_info:

client_name
request_id
originator_id

From POST /ra-officer/check_user_identity_verification:

client_name
request_id
originator_id
nnin
activation_id
verification_code

What the bank must capture during the branch visit

In addition to the SPI fields, the bank's RA system must record the details of the physical identity verification performed at the branch:

The identity check must leave auditable evidence. At minimum:
- Timestamp of when the process was performed
- Who performed the process (RA Officer identity / employee ID)
- Which routine was followed for the identity check
- If ID document was checked: type of ID, document number, and issuer code e-g: NOR, SWE etc
- If additional checks were performed: which check and its result
- Both successful and rejected checks must be logged
The identity check must follow a defined routine to ensure quality.
The identity check must perform one of the following:
- Verification of passport or national ID card, OR
- Verification of other valid ID (or expired passport/ID card) combined with additional checks against the bank's customer history
For passport or ID card verification: the document's chip must be validated, or the police guidelines for manual inspection of passports and ID cards must be followed.
Requirements for additional checks (when using alternative ID instead of passport or national ID card):
- Prior identity verification logs including photos must be part of the checkpoints. Name and gender must be unchanged.
- Name, gender (and date of birth if present) on the presented ID must match the latest extract from the population register (Folkeregisteret).

Retention

Records must be retained in accordance with applicable regulations and be available for review by internal compliance, external auditors, and regulatory authorities upon request.