The identity gap in Dutch telecom

Think about all the data needed to run a telecom account: the ID used to open it, the bank details that pay for it, and the phone number that half the internet uses to check who you are. If someone gets access to that account, they get a lot more than your mobile plan.

Dutch consumers know this, and many of them learned it the hard way. In February 2026, a cyberattack on one of the country's biggest operators leaked the personal data of millions of customers. And this wasn't a one-off, either: telecom now accounts for a quarter of all incidents in Europe's digital infrastructure, more than any other sector.

The Identity Maturity Index

In April 2026, itsme asked NielsenIQ to find out how well providers handle identity, from the customer's side. More than 4,000 consumers in Belgium and the Netherlands took part, including 513 Dutch telecom customers. They looked at five moments where a provider has to know who you are, from signing up to logging in. For each one, consumers said how their provider handles it today and how important the identity touchpoint is to them. That results in two scores out of 100: maturity (what operators actually do) and importance (what customers expect). The distance between them is the gap.

Two moments with the widest gaps

Signing a new contract and confirming a new customer's identity score the lowest of all five touchpoints against a much higher importance score.

When asked what should be standard practice for proving identity at registration and again for signing a contract, customers are very clear. They prefer an external ID app first in both cases, ahead of every other manual alternative.

That preference is not the top request at every moment in the journey. At login, some consumers reach instead for a two-step code by SMS or email, a fair reflection of the strongest method most of them have ever actually been offered. But the message across all of it is consistent: whatever the moment, only a small minority name username and password as the right way in.

The method Dutch telecom customers think providers should use by default, per touchpoint. Source: Identity Maturity Index 2026.

What makes consumers walk away

There is a persistent worry inside product teams that sending customers to an external identity app will cost conversions. But the data actually points the other way: it is the manual, document-heavy methods that customers say would actually stop them from signing up with a new provider.

Share of consumers who say this requirement would stop them becoming a customer. Source: Identity Maturity Index 2026.

Belgian telecom scores 60 on identity maturity against Dutch telecom's 43. The useful question is not which country is performing better, but what accounts for a 17-point difference between two neighbouring markets serving comparable customers with comparable products. The answer is deployment.

Interestingly, Belgium is not uniformly ahead of the Dutch market: at contract signing it scores 31 against an importance of 77, lower than the Dutch score on that same touchpoint.

Belgian consumers also show a habituation effect the Dutch do not. At login they name username and password as their first preference, just ahead of an external ID app, because even though reusable identity has been available for years, some customers settle into whatever keeps them logged in.

The lesson applies regardless: what separates a mature identity stack from an immature one is not which methods an operator makes available, but whether the strongest of them is the only way in rather than an option sitting beside the old one.

Fixing one identity moment at a time won't solve much. An operator that adds a verification step at sign-up but still uses passwords for login, or makes login stronger but still sends contracts as emailed PDFs, can improve one score but keeps the same patchwork underneath. What actually improves the maturity score is one trusted identity layer that confirms who someone is, logs them in and lets them sign, at every point in the customer journey.

The timing works in the operators' favour. By the end of 2026, every EU country has to offer a digital identity wallet at eIDAS Level of Assurance High. Public services and banking have to adopt it first, but telecom will follow eventually. That gives Dutch operators a window where reusable identity is still their own choice, before regulation makes it a requirement.

itsme is now available to every Dutch operator. It covers identity checks at sign-up, passwordless login on web and app, qualified e-signatures for contracts and renewals, and transaction confirmation, all on the systems you already have. You can add it one touchpoint at a time, so there's no full rebuild and you set the pace.