How to send a passport or ID scan safely by email or WhatsApp

A visa agent wants your passport scan by WhatsApp. A landlord asks for ID and payslips by email. A new employer sends a link to "upload your documents here". You need the visa, the flat and the job, so you send them, and then wonder where they've ended up.

You can't control everything that happens after you hit send, but you can make a big difference to how exposed you are.

First, is the request real?

Most ID theft doesn't come from hacking. It comes from people handing documents to someone who asked convincingly. Before sending anything:

• Check the person or company exists, using contact details from their official website, not from the message itself.
• Be wary of urgency ("send it in the next hour or lose the flat") and of requests that come before any real step, like a viewing or an interview.
• Question anyone who wants documents they shouldn't need, such as a bank statement for a job application or a copy of your bank card.
• Watch for slightly odd email addresses and links that look almost like a real company's.

What happens to the file you send

Email between major providers is usually encrypted while it travels, but it's stored readable in both mailboxes, often for years, and in any device that syncs them. If either account is ever broken into, your passport scan goes with it.

WhatsApp messages are end-to-end encrypted, so nobody in between can read them. But the file is saved on the recipient's phone and often in their photo gallery, and chat backups to cloud storage are not end-to-end encrypted unless that option has been switched on.

Cloud links set to "anyone with the link" can be opened by anyone the link is forwarded to, and they keep working until someone remembers to turn them off.

Make the copy itself less useful

Whatever channel you use, the best protection is a copy that's only good for its purpose. Add a watermark with the recipient's name, the purpose and the date, and black out any numbers they don't need. A watermarked copy is much harder to reuse for opening an account somewhere else.

Lock the file, share the password separately

For anything more than a single document, or for anything going to more than one person, put the files in a password-protected package. Send the file by email or chat, and give the password another way: a phone call, a text message, or in person. Someone who gets into one channel doesn't get both halves.

Our encrypted document kit makes a single file that opens in any web browser once the password is entered, so the receiver doesn't need special software or an account. Use a long password made of several unrelated words; that matters more than anything else.

After you've sent it

• Delete the file from your own sent items and chat if you don't need it there.
• Ask the recipient how long they'll keep it, and to delete it once your application is done.
• Keep a short list of who has a copy of which document, and when you sent it.
• If a document is lost or you suspect misuse, report it at once so it can be cancelled, and keep the reference number.

None of this takes long. A few minutes of care each time you send a document is much easier than untangling an account opened in your name.