BankID in Unmanned Retail: Secure Entry and Age Verification

BankID lets an unmanned store verify who you are before it unlocks the door, then ties that identity to payment and, where needed, an age check. In Sweden, 24-Sju grocery stores use BankID entry with self-scan checkout on StoreTech, the platform built by Things at Web, while Tanlux tanning salons use BankID age verification with Swish or card payment and remote door control.

Why identity is the hard problem in staff-free retail

A store with no staff still has to answer the same questions a cashier answers without thinking: who is this person, are they allowed inside, are they old enough to buy what they came for, and did they actually pay. Take the human out of the loop and each of those questions becomes a system you have to build and trust.

Most consumer authentication methods are too weak for this. A loyalty app login or an SMS code tells you a phone is present, not who is holding it. For an unmanned space that may be open around the clock, you need an identity that is hard to share, hard to fake, and legally meaningful. In Sweden, that is BankID: a national electronic identity issued through banks and used to log in and to sign transactions. Because it is already on most people's phones and already trusted for banking and government services, it removes the need for a store to invent and police its own identity scheme.

That is the core design choice behind unmanned retail in the Swedish market. Instead of building a proprietary credential, you delegate identity to BankID and build everything else on top of a known, verified person.

How BankID entry works at the door

The entry flow is short and happens before anyone is inside the premises.

1. The customer opens the store app or scans a QR code at the entrance.
2. The app starts a BankID session and the customer authenticates in the BankID app on their phone.
3. The store backend receives a verified identity for that session.
4. Business rules run: is this person allowed in right now, is the door zone free, are there any blocks on the account.
5. If the rules pass, the system sends an unlock command to the physical door controller and the customer walks in.

The important point is the order. Identity is established first, then the door opens. The lock is not a dumb timer or a shared code; it is driven by a backend decision tied to a named, verified individual. That is what makes a 24/7 unmanned location defensible, because every entry maps back to someone.

24-Sju: BankID entry plus self-scan checkout

24-Sju is described as Europe's largest unmanned grocery chain, with more than 130 stores in Sweden, and it runs on StoreTech, the unmanned-retail platform built by Things at Web. The customer experience splits cleanly into two verified moments.

Step	What the customer does	What the system verifies
Entry	Authenticates with BankID at the door	A real, identified person is entering
Shopping	Self-scans items with their phone	Each item is added to a basket tied to that identity
Checkout	Confirms and pays in-app	Payment is captured against the same verified session
Exit	Leaves through the controlled door	Entry, basket and payment all reconcile to one person

Because the same BankID-verified identity threads through entry, basket and payment, shrinkage and disputes have a clear audit trail. There is no anonymous "did they pay" gap to manage. The platform work behind this kind of chain is squarely IoT and connected-device territory: door controllers, sensors and point-of-sale all reporting into one backend, with the mobile app as the customer-facing layer. You can read more about the retail platform itself on the StoreTech product page.

Tanlux: when age is the gate, not just identity

Some unmanned spaces are not just access-controlled, they are age-restricted. Tanlux, a Things at Web product, runs unmanned tanning salons where the question is not only "who are you" but "are you old enough." BankID answers both at once, because the verified identity it returns is tied to a real personal record, so the system can age-gate entry without a staff member checking an ID card.

The Tanlux flow combines a few responsibilities:

• Age verification via BankID before access is granted, so under-age users are blocked at the door rather than after the fact.
• Payment through Swish or card, captured against the verified session.
• Remote door control, so the physical lock opens only after both the age check and payment rules pass.

Tanning salons in Sweden are an age-restricted environment, and an unmanned model has to enforce that age gate as reliably as a staffed reception would. Doing it with BankID means the age check is the same verified step as the login, rather than a separate, weaker self-declaration. Details of the product are on the Tanlux product page, and the customer-facing app that ties the BankID session, payment and door together is a mobile development problem as much as a hardware one.

What this means if you are building unmanned commerce

The pattern that emerges from both 24-Sju and Tanlux is consistent, and it is worth stating plainly for anyone designing a staff-free space:

• Establish a strong, verified identity first. In Sweden that means BankID, because it is national, bank-issued and already trusted.
• Make the physical lock a consequence of a backend decision, never a standalone code or timer.
• Bind payment to the same verified session so entry and payment reconcile to one person.
• Where the law restricts by age, use the same verified identity to enforce the age gate, not a separate self-declaration.
• Keep an audit trail per identity so disputes and shrinkage are traceable.

None of these steps is exotic on its own. The engineering challenge is making them work together reliably, at every store, at any hour, with hardware in the field. That integration of identity, payment and connected hardware is the actual product.

FAQ

What is BankID and why is it used for unmanned stores?

BankID is a Swedish electronic identity issued through banks and used to log in and sign transactions. Unmanned stores use it because it is national, hard to share or fake, and already on most people's phones. That lets a store verify exactly who is entering without inventing its own credential system.

How does BankID entry actually unlock the door?

The app starts a BankID session, the customer authenticates in the BankID app, and the store backend receives a verified identity. Business rules then run, and only if they pass does the backend send an unlock command to the physical door controller. The door is a consequence of a verified decision, not a shared code.

How does Tanlux verify age with BankID?

Tanlux uses BankID before granting access, so the same verified identity that logs the user in also confirms they meet the age requirement. Under-age users are blocked at the door rather than after entry, and access only opens once both the age check and payment via Swish or card pass.

Does the customer need a separate card or fob for 24-Sju?

No. 24-Sju uses BankID entry and self-scan checkout through the customer's phone on the StoreTech platform. The same verified identity threads through entry, the self-scanned basket and in-app payment, so there is no separate physical card or fob to issue, lose or share.

Can payment and identity be linked in one flow?

Yes, and that is the point. Both 24-Sju and Tanlux bind payment to the same BankID-verified session, so entry and payment reconcile to a single identified person. This removes the anonymous "did they pay" gap and gives every transaction a clear audit trail back to a verified individual.