Most telecom providers treat identity as account access: a login screen, a password, a phone number on file. But customers see something else. Their telecom account holds the identity documents they need to open it, the bank details that pay for it, and the phone number much of the internet accepts as proof of who they are. Whoever controls that account controls a great deal more than a mere mobile subscription.
The Identity Maturity Index 2026 measures how far apart those two views are: not the strength of one login screen, but whether a customer’s verified identity can be used across registration, login and signing, or needs to be rebuilt at every step.
NIQ surveyed Dutch and Belgian consumers on how their providers handle identity. For each identity moment, respondents said two things: which method their provider uses today and what they would prefer to use as a customer. The first became the maturity score and the second the importance score, both scored on a scale from 0 to 100. The distance between them is the demand that telecom operators are not meeting.
Here are the main findings for Dutch telecom:
The fieldwork for this report was conducted in the two weeks after a cyberattack on one of the country’s largest operators put the personal data of millions of Dutch telecom customers into circulation. So we need to keep in mind that the answers consumers provided also came as the market watched one of the largest data breaches in Dutch history unfold in the national press.
That explains an otherwise counterintuitive result. Telecom has none of the obvious stakes of a mortgage or a claim so, on paper, it should rank below both. Yet Dutch consumers expect more from their operator’s identity moments than from their bank’s or insurer’s.
It is not a one-off to wait out either. Data breach notifications to the Dutch data protection authority rose from 37,839 in 2024 to 44,374 in 2025 and ENISA’s 2025 threat landscape found telecommunications is the most affected sub-sector within digital infrastructure and services, at 25.1% of incidents.
Acquiring a telecom customer in the Benelux costs roughly €280 to €315, and that sum is written off every time a registration is abandoned at the verification step. Every password reset costs $70. Leaked identity data gets used fast: in March 2026 the Dutch traffic-fine agency received 5,200 verification calls in a single week about fraudulent fine notices, against a normal baseline of a few dozen. The global average data breach now costs $4.44 million.
But none of these costs appear on a line labelled “identity.” They show up in conversion rates, call centre volumes, fraud provisions and churn instead.
Every EU member state must make a digital identity wallet available by the end of 2026. The first regulatory wave is directed at public services and banking, with telecom following behind, which gives Dutch operators a window where reusable identity is still a competitive decision rather than a compliance obligation. A wallet on its own will not close the gap, though. An operator can accept it as one more login option and stay exactly where it is.
Around 8 million people in Belgium already use itsme to prove who they are to their bank, insurer, telecom and energy provider, and government. itsme launched in the Netherlands in June 2026 at eIDAS Level of Assurance High, covering identity verification at registration, passwordless login, qualified electronic signature and transaction confirmation. No Dutch operator has moved yet, so whoever goes first sets the benchmark.