Quickly hold the ID card in front of the mobile phone camera: the video identification process was often the most convenient form of identification
Photo: Andrea Warnecke/TMN
The digitization service provider of the German healthcare industry, Gematik, is pulling the emergency brake and has prohibited health insurance companies from using so-called video identification procedures with immediate effect.
According to sources familiar with the process, the background is said to be a security gap that the Chaos Computer Club reported to Gematik.
With the video identification process, users can identify themselves by capturing their ID papers with their mobile phone camera and showing their face at the same time.
The details are then verified either by support staff or algorithms, allowing end customers to prove their identity before logging into an online platform.
As Gematik confirmed to SPIEGEL, several health insurance companies apparently also allowed identification using a smartphone camera.
There have always been difficulties with the video identification process in the past.
For example, fraudsters had taken advantage of the procedure to register bank accounts under someone else's identity.
A few days ago, it was shown that the video identification function for the digital driver's license from the provider Verimi also accepted completely invented ID data.
Health insurance customers who want to register for online services now have to resort to less convenient methods of identifying themselves - such as authentication via Postident or in the office of a health insurance company.
The official online ID should also work if health insurance companies have integrated it into their platforms.
It is not yet known which security gap is the basis of today's move by Gematik.
The service provider intends to only allow the function again when the affected health insurance companies can demonstrate effective countermeasures - if these are even possible.
The DAK confirmed to the “Handelsblatt” that they were working on switching off the function.