A letting agent wants a copy of your passport. A crypto exchange wants your driver’s licence held next to your face. A car rental, a phone contract, a new bank account — the request is routine, and refusing usually isn’t an option. But an identity document is the most valuable file you will ever upload: unlike a password, you cannot change your date of birth after a breach. September 2026 gave two uncomfortable illustrations of what that means in practice. Here’s what actually happens to an ID scan after you send it, which questions are worth asking, and how to hand over less without refusing the request.
What an ID scan actually contains
More than the printed details you can read. Most modern identity documents carry a machine-readable zone or barcode — the two lines of angle brackets at the bottom of a passport, the PDF417 barcode on the back of a North American driver’s licence. That strip holds the same personal data in structured, instantly parsable form: full name, date of birth, document number, expiry, sometimes address and physical description. A photograph of the back of a licence is not a picture of a card; it’s a database record waiting to be read.
If you photographed the document with a phone, the image file may also carry EXIF metadata: the camera model, the exact timestamp and, unless you’ve turned location off, the GPS coordinates of where you took it — usually your home. That data rides along invisibly.
And once the document reaches a verification service, processing creates more copies: extracted text from OCR, thumbnails, an index that maps your name to the document, job records and server logs. This matters more than it sounds, and it’s the part that almost no privacy policy addresses clearly.
What September 2026 demonstrated
Two incidents, a fortnight apart, showed both halves of the problem.
On 21 September the Privacy Commissioner of Canada opened an investigation into IDScan.net, an identity-verification provider, after an unauthorised third party reached customer information in its cloud environment — access the company dated to around 1 September. The investigation covers both the security safeguards in place and whether affected people were adequately notified, under Canada’s federal privacy law. Criminal marketplace listings subsequently advertised enormous quantities of identity documents; the widely repeated figure of 153 million driver’s licences comes from those sellers’ own listings and has not been confirmed as a victim count. Even discounted heavily, the shape of the incident is the point: the documents were retained, in one place, long after the verification they were collected for.
Five days earlier, the screenshot service Gyazo disclosed a breach in which attackers reached roughly 490 million image metadata records. Those records included OCR text extracted from users’ images, alongside upload addresses and location data. The pictures themselves were not the headline loss; the machine-readable transcripts of them were. If one of those images had been an ID, the transcript would contain every field printed on it.
Neither case means identity verification is illegitimate — it is often legally required. They mean the risk lives in retention, and in the copies that retention quietly multiplies.
Five questions worth asking before you upload
Most services answer only the first of these. That’s the signal.
- Is the full document image stored, or only the result? A verification that checks your details and keeps a yes/no answer is a very different risk from one that archives the picture.
- How long are the image, the extracted text and the parsed fields kept? Ask about all three. Deleting the image while keeping the text is not deletion in any sense that protects you.
- Can you actually have it deleted? Is there a real route — a setting, a request address, a stated deadline — or only a promise in a policy?
- Who else touches it? Verification is frequently subcontracted. The company you trust may not be the company holding your passport.
- Is there an option that doesn’t upload the document at all? In-person checks, a bank-based identity scheme or a national eID app all avoid the copy entirely.
Our broader guide to whether online tools are safe applies the same test to any service that processes your documents.
Hand over less, without refusing
You usually can’t decline to prove who you are. You can very often reduce what travels with the proof — and this is where a few minutes of preparation pays off.
Black out what isn’t needed — properly. A landlord confirming your identity rarely needs your document number; a gym membership doesn’t need your full address. Cover those fields with Redact PDF, which rasterises the affected pages so the data underneath is genuinely gone rather than hidden behind a rectangle. That distinction is not pedantic: it is exactly how “redacted” documents keep leaking, and our guide to redacting a PDF the right way shows what goes wrong otherwise. A useful side effect: because redaction re-renders the page, any EXIF data that came with the phone photo disappears with it.
Stamp the purpose across it. A visible line like “Copy for tenancy application, 29.09.2026” across the document makes a stolen copy far less useful for opening an account somewhere else, and costs nothing — Watermark PDF adds it in one step. Keep it diagonal and readable, but not over the photograph or the details being verified.
Encrypt before sending. If the file travels by email, password-protect it with AES-256 and share the password another way — a phone call, a message in a different app. An intercepted or misdelivered attachment is then just noise. Our guide on securing a PDF covers when this genuinely helps.
Clear the document metadata too. Remove Metadata strips the author name, software fingerprints and timestamps that PDFs collect. It works on the document’s own fields — for anything embedded inside an image, redaction is the reliable eraser. There’s more in our guide to removing hidden metadata.
What a recipient genuinely needs varies more than the blanket request suggests. It’s worth asking — and where the answer is narrower than “the whole document”, redacting the rest is reasonable:
| Why they’re asking | Usually needs | Often safe to black out |
|---|---|---|
| Confirming your name and photo (letting agent, club, delivery) | Photo, full name, expiry | Document number, address, place of birth |
| Proof of age | Photo, date of birth | Document number, address, full name in some cases |
| Proof of address | Name and address | Photo, document number, date of birth |
| Regulated identity check (bank, insurer, employer) | The complete document, usually by law | Nothing — stamp the purpose and date instead |
| A copy “for our records” | Worth questioning what for | Ask whether a check without a stored copy is possible |
Where the whole document is genuinely required, the purpose stamp does the work that redaction can’t.
Make the scan on your own device
If the choice is between photographing your passport into a stranger’s app or producing the PDF yourself, produce it yourself. Scan to PDF uses your device’s camera directly in the browser: the frames are captured, cropped and assembled into a PDF on your machine, and nothing is uploaded. You end up with a file you control, which you can then redact, watermark and encrypt before it goes anywhere. Our walkthrough on scanning documents with your phone covers lighting, angle and the settings that produce a legible result first time.
One thing to skip on an identity document: OCR. Making the text searchable is genuinely useful for contracts and receipts, but on an ID it creates precisely the plain-text copy that made the Gyazo breach so damaging. Leave the scan as an image unless something actually requires the text.
If your ID has already been exposed. You can’t reissue a date of birth, so the sensible response is monitoring rather than replacement: watch for credit applications you didn’t make, consider a credit freeze or fraud alert where your country offers one, and treat any call referencing your document details as unverified until you call the organisation back on a number you looked up yourself. A passport or licence can be replaced if it’s genuinely being misused — ask the issuing authority what they advise. This is general information, not legal advice.
Is it private, and is it free?
Scanning, redacting, watermarking and metadata removal all run entirely in your browser — an identity document processed with those tools is never uploaded to us or anyone else, because nothing is sent. Password protection uses real AES-256 encryption tooling, so it runs in our hardened server sandbox: the file travels over HTTPS, is processed in an isolated container with no network access, and is deleted the moment your download is ready. Nothing is stored or logged. It’s all free, with no account and no watermark of ours.
Frequently asked questions
Is it safe to send a photo of my passport by email? Email is stored in plain form on several servers along the way and in both mailboxes indefinitely. If you must, encrypt the file and send the password by a different channel — and delete the message from your sent folder afterwards.
Should I really black out parts of my ID? Where it doesn’t defeat the purpose, yes. Ask what the recipient actually needs to verify; fields beyond that are risk without benefit. Some organisations require a complete document — in that case, stamp the purpose and date across it instead.
Does putting a watermark on my ID make it invalid? A copy isn’t the document; it’s evidence of it. A discreet purpose stamp that leaves the photograph and the verified details legible is common practice, and some authorities explicitly recommend it. If a recipient rejects it, they’ll say so.
Can a photo of my ID reveal where I live? Beyond any printed address, yes — phone photos usually embed GPS coordinates in EXIF data. Turning off location for the camera, or redacting the page (which re-renders it), removes that.
What’s the risk in the barcode on the back of a licence? It holds your details in structured, instantly readable form, so a clear photo of it is machine-processable at scale. If only the front is required, send only the front.
Is a verification service safer than emailing a copy to a company? Often yes — a dedicated provider usually has better security than a small business’s inbox. The IDScan case shows the trade-off: concentration also makes them a richer target, and the retention question matters more than the encryption question.
Does “we delete your file” mean everything is gone? Not by itself. Processing creates extracted text, thumbnails, indexes and logs, each with its own retention. Ask specifically whether derived data is deleted too.
Can I refuse to hand over a copy of my ID? Sometimes. Many checks are legally mandated (banking, employment); others are convention rather than requirement, and asking which one applies is reasonable. Rules differ by country, so this is general information rather than legal advice.
