Setting Up and Using Belgian Digital Identity

Separate the identifier, card and login key. Your National Register number identifies a record in the population/foreigners register; a BIS number identifies a social-security record for someone not in the National Register. Neither number by itself is a login. A Belgian eID or electronic foreigner's card can carry authentication and signature certificates, but a paper annex or residence decision normally cannot. itsme, MyGov.be and CSAM security-code methods are separate keys linked to the official record.

Choose a usable route

• eID/eligible electronic residence card + PIN + USB/NFC reader: highest CSAM assurance, broad public-service access and qualified electronic signature where the site/document supports it. Needs activated certificates and a Windows, macOS or supported Linux computer; federal eID middleware is not available for mobile operating systems.
• itsme: smartphone app used to identify, log in, confirm and sometimes sign. Activation through BNPPF, Belfius, KBC/CBC, ING, Hello Bank or Fintro is available to eligible customers, or use an eligible Belgian eID/residence card, PIN, computer and reader. itsme now supports identity documents and phone coverage beyond Belgium, so a Belgian +32 number is not a universal requirement; the number must receive the verification SMS and the selected country/document route must be supported.
• CSAM username/password plus code by email, SMS or authenticator app: useful backup, but lower-assurance keys do not unlock every portal/function. Online activation normally begins by authenticating with eID, itsme or another accepted high-level key. An SMS number may be Belgian or foreign.
• Local registration office: for border workers, residents/non-residents and others without usable eID/itsme. Attend personally with passport/identity and a personal email. Staff verifies the record/BIS identity, gives a paper activation code and sends an email link; combine both to activate, usually starting with the email-code key.
• eIDAS/foreign electronic ID: choose the European identification option on a participating portal and the issuing country shown. Recognition is service- and country-specific; it does not create a Belgian card or guarantee every downstream function.

Before setup, confirm your official name, birth date and register/BIS number. A bank record or phone subscription cannot repair the National Register. Check that the card type actually has active certificates and that you know the PIN. Keep one independent backup - reader/eID or a CSAM code - before relying solely on a phone.

Costs belong to the card, not CSAM login. Example 2026 municipal rates vary: City of Brussels lists normal Belgian eID EUR 30, urgent EUR 150 and super-urgent EUR 170; its A-card page lists EUR 30 for over-12s and EUR 12 under 12. Etterbeek lists EUR 31 for eID and several electronic foreigner cards and EUR 10 to reissue PIN/PUK. Confirm your own municipality/card category; a commercial card reader is separate and price varies by retailer.

Collect and activate the card at the municipality with the PIN letter/instructions. Check that identity data, address and card validity are correct and ask whether authentication and signature certificates are active. Cards requested from 25 April 2026 use the newer PIN-only process; older cards may still have a PUK. Do not repeatedly guess: blocked or forgotten PIN handling depends on card generation and municipality.

Install and test on the actual device

1. Use a standard Windows, macOS or supported Linux computer. Download only from the federal eID software site. It currently lists Windows 10/11, macOS 14.6+ and distribution-specific Linux packages; mobile operating systems are not supported.
2. Install middleware before connecting the reader where instructed. Use a compatible reader, insert the card and check it in eID Viewer. Viewer shows card data but is not required just to log in.
3. Open the official Test login on that site, choose CSAM, select the authentication certificate and enter the card PIN. Chrome, Edge and Safari are supported; Firefox needs the Belgian eID add-on. On macOS, a “keychain password” prompt in this flow expects the eID PIN. A reader with keypad may show the prompt on the reader rather than Edge.
4. Test a second official service, then test a signature separately. Authentication proves who logs in; signing a PDF/form uses the signature certificate and PIN and may require different software. Verify the finished signature instead of assuming a successful login signed anything.

Diagnose in order: can Viewer read the card; is the right certificate selected; is the browser/add-on supported; does the federal test work; does only one portal fail? Reinsert/restart, try a different USB port or supported browser and update middleware from the official source. Do not install a search-advertisement driver or let remote “support” control the computer.

If the PIN letter never arrived, request replacement through FPS Home Affairs/municipality and collect/reset as instructed. Brussels says a new PIN can be requested online and collected at Brucity; its 2026 page notes PUK no longer exists for the new cards. Ghent says cards requested before 25 April 2026 still have a PUK. Costs differ: Etterbeek lists EUR 10 for code reissue, Brasschaat EUR 2.40, while some municipalities are free. Confirm price and whether personal attendance/card is required.

Never keep PIN with the card or disclose it to municipal staff, bank, itsme, police or helpdesk. Export/download needed documents and activate a second CSAM key while the card works. Card expiry, replacement or certificate block may require re-linking apps and testing again even if your National Register number stays unchanged.

Activate alternatives while your strongest key still works. In CSAM My digital keys, authenticate with eID, itsme or another accepted high-level key, review contact details, then enable only the backup methods you can secure. Email, SMS and authenticator-app codes combine with a CSAM username/password; they are safer than password alone but may not be offered for high-assurance functions.

For an email code, use a private mailbox with its own two-factor authentication and recovery you control. For SMS, CSAM accepts a Belgian or foreign mobile number capable of receiving the verification code. For a mobile authenticator, store recovery details safely before changing phones. Test each key in a private browser window and remove old numbers/devices from CSAM rather than leaving an unused route active. If no eID/itsme route exists, book a local registration office: bring passport/ID and personal email, then combine the paper activation code with the emailed link.

Set up itsme without assumptions

Download the official itsme app from Apple App Store or Google Play. Eligible Belgian bank customers can activate through BNPPF, Belfius, KBC, CBC, ING, Hello Bank or Fintro. Otherwise use the current eID flow: start in app, enter phone/email and choose eID; continue on computer with displayed code, Connective extension/plugin where requested, reader, card and PIN; scan the QR code, verify the phone by SMS and set a private five-digit itsme code. Supported countries/documents are listed on itsme Coverage; do not repeat the outdated claim that every account needs a Belgian number.

Read every itsme request before approving: requesting organisation, action and data. A login is not a payment, and a signature/confirmation is not harmless merely because the app opened. itsme says it never sends emails asking you to log in, update data or reactivate. Decline unexpected actions and contact the organisation through its official site.

Changing phone number in an active app is under My details and verified by SMS. If inactive, itsme's web route can confirm the new number with eID/reader. A new phone, forgotten five-digit code or blocked account requires reactivation; deleting/reinstalling alone does not preserve an active identity session. Keep eID/reader or another CSAM key functional first.

MyGov.be and recognised eIDAS/Smart-ID options may appear on particular portals, but availability is not universal. Choose the strongest offered method and verify the task still appears before relying on it. Never share one person's key: for a child, relative, client or company use the portal's legal representation or mandate mechanism.

First identify the transaction. Authenticate means prove who you are; submit/confirm sends a form or decision; sign binds a document with an electronic signature; consent allows a defined data use; mandate lets another person/entity act in a specified public service. Logging in never means all later actions occurred.

Common destinations

• MyMinfin: tax file, assessments, payments, property documents and Tax-on-web. It currently offers eID, itsme, MyGov.be and Smart-ID; some non-residents can use eIDAS, registration-office keys or ForReg. Filing a return requires the final submit/sign step, not merely saving. A fiscal mandate can let family or an accountant act.
• MyHealth: reports, prescriptions, vaccination/medication and health-data links, with eID, itsme or MyGov.be and role/mandate rules. Viewing data is not consent to health-data exchange; manage consent/representation in the stated service.
• my eBox: official electronic mailbox. Activation means authorities can deliver there; enable a safe notification address but enter through the official portal, not an email link. Revoke an eBox provider authorization in eBox/CSAM when no longer wanted.
• MyCareer: employment-career record; inspect incorrect periods and contact the institution that supplied them. Student@work: remaining student hours, jobs and downloadable certificate; employer access is a specific consent that can be withdrawn in “Access to my data.”
• Regional portals such as Mijn Burgerprofiel, IRISbox and Mon Espace use offered keys but hold region-specific records. A successful CSAM login does not prove the regional file is complete.

For a digital signature, open the final document, verify parties, amount, language, attachments and hash/verification outcome; choose signature rather than authentication certificate when software asks. Save the signed original and validation evidence. itsme can sign only when the requesting service offers a signature transaction; approving a normal login is not a signature.

Use CSAM mandate management for supported services. Select the exact mandate type (for example resident income tax/MyMinfin), parties and validity. The proxy becomes usable only after the required parties accept it. Test by switching to the represented capacity, then revoke/discontinue it when the task ends. Company access may additionally require an access manager/user right; do not share director credentials.

Maintain an action receipt: portal URL, capacity used, submission/signing date, acknowledgement/reference, downloaded PDF and any mandate expiry. Reopen the service later to confirm status. If the portal offers only a weaker key that cannot complete a sensitive step, switch to eID/itsme rather than assuming a technical error erased the obligation.

Locate the layer that is wrong. A portal display may come from the National Register, BIS register, tax/social-security source, municipality, bank or the portal's own contact profile. Changing CSAM email does not change civil status or official address; changing a bank profile does not fix the National Register. Screenshot the error without exposing credentials and note portal, date, identifier and expected source.

For name, birth, nationality, household or main-address errors in a population/foreigners record, contact the municipality that manages the record with civil-status/address evidence. For BIS data, ask the institution that created/uses the BIS record - often employer, social-security body, health fund or registration office - to identify the authoritative correction route. Avoid creating a second identity because spelling differs; request deduplication/linkage where suspected.

If the record is correct but the card is wrong or certificates fail, take the card and evidence to the municipality. Ask whether it needs data correction, certificate update, PIN reset or replacement, and what temporary proof remains valid. Card cost is municipal: City of Brussels publishes EUR 30 normal over-12 residence cards/eID examples and EUR 150 urgent; Etterbeek publishes EUR 31 for listed eID/foreigner cards. Obtain the exact category and receipt.

Without a Belgian certificate card, use the suitable access route:

• On a participating service, choose European electronic identification (eIDAS) and then the issuing country. If the country/key or required assurance is absent, save the message; a foreign card reader alone cannot force compatibility.
• If already recorded under National Register/BIS, attend a BOSA/local registration office with passport/ID and personal email to obtain paper code plus activation email for a CSAM alternative key.
• MyMinfin offers ForReg for people without Belgian/eIDAS means who cannot travel to Belgium, but FPS Finance can reject it when an existing recognised key is available. Follow that service's identity interview/evidence path.

Check identity matching: full legal names/order, date/place of birth, nationality, National Register/BIS number and address. itsme/bank activation can fail when bank and register data differ; correct the authoritative source, allow synchronisation, then retry rather than making repeated accounts. An electronic residence card may lack active certificates depending on type/status; a paper annex is not converted into eID by installing middleware.

Escalate with evidence: first portal helpdesk for a service-only error; municipality/BIS source for authoritative data; BOSA digital-government support for CSAM/registration-office activation; eID helpdesk for middleware after the federal test fails. Keep case number and requested deadline. If a legal filing is due, ask the responsible administration for its accepted non-digital submission or appointment and preserve proof that access failed - technical trouble does not automatically extend a tax, benefit or residence deadline.

Act by what was compromised. A lost identity/residence card threatens card certificates and physical identification; a lost phone threatens itsme, bank and CSAM apps; stolen bank credentials require the bank/Card Stop route too. Blocking one does not automatically block the others.

Immediate sequence

1. For a lost/stolen Belgian identity card, call DOC STOP 00800 2123 2123; if that free number fails or from networks abroad, use +32 2 518 2123. It is 24/7. Report to municipality/police as required - foreign residents generally need the police loss/theft declaration for replacement. Ask what temporary document is issued and whether it permits travel; do not assume it does.
2. For a lost phone, suspicious prompt or exposed itsme code, use itsme Block in the app or official website, entering the phone number and all first names. Confirmation arrives by SMS. Reactivate on a new device afterward using the supported bank/eID process. Three wrong itsme codes also block the account; forgotten code requires blocking/reactivation or reinstall/reactivation.
3. If cards/payment apps or banking access may be exposed, call Card Stop 078 170 170 (abroad +32 78 170 170) and the bank's verified fraud line. Card Stop, itsme and banks do not ask for PIN, itsme code or transfer to a “safe” account.
4. Change the email password, revoke stolen-device sessions/SIM with the telecom provider, and remove/deactivate affected CSAM keys through My digital keys using a clean backup key. Revoke active mandates or eBox provider authorisations if misuse is possible.
5. Preserve messages, URLs, timestamps and transaction IDs. Report financial/identity crime to police and suspicious messages through Safeonweb ([email protected]); report consumer fraud through ConsumerConnect. Do not forward secret codes.

Review MyMinfin, eBox, MyHealth, MyCareer/Student@work, regional portals and mandate lists for unfamiliar submissions, address/contact changes, documents or access grants. Contact each service through its official site to reverse unauthorised action; merely replacing the card does not undo a submitted tax return or mandate.

For replacement, book the municipality and bring passport/available identity, police certificate and photo/payment required. City of Brussels 2026 example: normal eID EUR 30, urgent EUR 150, super-urgent EUR 170, with additional EUR 60 for second loss/theft and EUR 150 for third; residence-card categories differ. After collection, activate PIN/certificates, reinstall/test middleware, reactivate itsme and rebuild only necessary CSAM backups.

Finally change passwords that were reused, enable alerts, retain blocking references and check credit/bank/public records. Treat unexpected “reactivate now” email/SMS as phishing: navigate manually to the official service. Recovery is complete only when the lost credentials are blocked, replacement works, affected transactions are disputed and official records/mandates show no unauthorized changes.