On 25 September 2026, Ukraine's Ministry of Defence announced that the Reserve+ app for conscripts and reservists now offers a second way to log in: a "Log in through Diia" button, confirmed with Diia.Signature, the e-signature in the Diia app. Until then, Reserve+ had only one login method, a banking app via BankID. The new option is rolling out gradually, and BankID remains available. The same update fixed login errors and delays and stopped users from setting trivially weak PINs such as 1111 or 1234.
This looks like routine product maintenance. It is better read as a lesson in how a digital state should be built under pressure: with redundancy, with no single point of failure, and without forcing citizens into one private intermediary.
The strongest case for a single login path
It is worth stating the opposing view fairly. A single, bank-backed login is simple to secure and audit. Banks have already verified their customers under strict know-your-customer rules, so the state borrows that identity assurance instead of building its own. Every extra authentication route is more code, more attack surface and more support burden. A defence ministry running a registry of people who may be mobilised has good reason to be conservative about how identity is established.
Those are real arguments. They are also arguments for choosing identity methods carefully, not for choosing only one.
Why a second rail matters
Reserve+ is not a convenience app. It is where Ukrainians subject to military registration update their data, and where the state expects them to be able to do so. When the app is unavailable, that has legal and practical consequences for the person, not just irritation. In December 2024, 112.ua reported a large Reserve+ outage that the ministry attributed to a "technical failure", with users facing authorization problems. That outage was not caused by the BankID dependency as far as the published reporting shows, and we do not claim it was. But it illustrates the exposure: when an app is the only route for a legal obligation, its authentication layer is critical infrastructure, and a login system with one upstream dependency is only as available as that dependency.
Diia.Signature is a natural second rail. According to the Ministry of Defence's post, a user who lacks it can create one in about a minute in Diia with an ID card or a biometric foreign passport, and can then reuse it. The credential is issued by the state itself, so it does not depend on whether a given commercial bank's login service is working. Citizens who are not comfortable using a bank app, or who have limited banking relationships, gain a route. And because each credential comes from a different issuer, an outage or incident at one does not automatically lock people out of the other.
Scale makes Diia a credible option
A second login method only helps if people already hold the credential. On this point Diia has an unusual advantage. Minister of Digital Transformation Mykhailo Fedorov told parliament in January 2026 that 23 million Ukrainians use Diia, and that Diia is installed on 77 percent of all smartphones. Few governments anywhere can point to that level of adoption for a state-run identity and document app. The ministry's own Diia FAQ says digital documents in the app carry legal force, citing specific Cabinet of Ministers resolutions for the e-passport, the e-birth certificate, the internally-displaced-person certificate and the e-student card. That legal grounding is part of why other agencies can reasonably build on it.
There is a notable design choice here. The Ministry of Defence did not replace BankID with Diia. It added Diia and kept BankID. Reports on the rollout note that the button "may not be available immediately" after an update and that users should keep using BankID until it appears, according to LIGA.net. A gradual rollout with a working fallback is the right way to change authentication on a system that people cannot afford to be locked out of.
The PIN fix is the part regulators should copy
The least glamorous change may be the most transferable. Blocking PINs such as 1111 and 1234 costs the state almost nothing and removes the most guessable credentials. It is a targeted, proportionate security control: it addresses a demonstrated weakness without banning anything or adding a compliance regime. This is the kind of measure that makes more sense than sweeping rules on authentication, because it comes from the operator, takes effect with the next app update, and can be adjusted if it causes problems.
What to watch
The risk in adding Diia login is concentration. If Diia becomes the default route into every state service, then Diia itself becomes the single point of failure that BankID was. Two rails help only if they stay independent. Three things would show whether Ukraine is getting this right:
- Fallback stays real. BankID should remain a first-class option, not a legacy path left to decay.
- Clear data boundaries. Logging in with Diia.Signature should authenticate the user to Reserve+ without handing the Ministry of Defence more of the user's Diia data than the login requires. The published announcement does not specify this, and the ministry should say so plainly.
- Published reliability data. Authentication success rates and outage histories for both methods would let citizens and civil society judge whether redundancy is working, instead of taking it on trust.
The takeaway for other governments
Policymakers elsewhere debating digital identity often frame the choice as a state wallet versus private providers. Ukraine's Reserve+ change suggests a better framing: let people authenticate through any of several trustworthy issuers, public or private, and let the service owner fix the weak points in its own implementation. Pluralism in identity rails is pro-innovation because it lets banks and the state compete on reliability. It is also pro-citizen because one failure does not shut off access to a legal obligation. Ukraine, operating under wartime pressure, has arrived at that design through necessity. Others can arrive at it by choice.