Is it safe to send a scan of your passport or driving licence, and how to send one that is less useful to a thief

Send a copy, not the photograph off your phone. Black out the fields the recipient does not need (for most purposes that is the machine-readable zone along the bottom, the document number and your signature), stamp it with who it is for, what it is for and the date, and flatten it so the marks cannot be lifted off. BASTION does all four in one pass and the image never leaves the tab. That last part is not fussiness: a service that collects ID scans for redaction is the single most valuable pile of files on the internet to steal.

What the image is actually worth

A clear photograph of a passport or a driving licence is not a document. It is a credential, and it is enough on its own for a surprising amount:

• Opening accounts in your name. Most remote identity checks are a document photograph plus a selfie. One of the two is the hard part and it is not the document.
• Taking over the accounts you have. "Send a photo of your ID to verify" is how account recovery works almost everywhere, mobile networks included, which is the first step of a SIM swap, and from there the second factor on your bank is theirs.
• Credit in your name, which you discover months later.
• Training a face model, or being sold on, if the recipient is not who you think.

The machine-readable zone, the two lines of angle brackets at the bottom of a passport, deserves particular care. It encodes the document number, your date of birth, nationality, expiry and check digits in a form designed to be read by machines, which means it is the part that automates fraud rather than merely enabling it.

What to black out, by purpose

The principle is duller than it sounds: black out what the recipient will not use. If they come back and ask, you send another copy, and you have lost nothing. If you send everything and their supplier is breached, you cannot get it back.

A letting agent in England, and the right to rent

The commonest request of all is a letting agent's email asking for a passport scan before a viewing. In England a landlord or agent does have to check your right to rent, and has to keep a copy of what they checked for the whole tenancy and at least a year after it. But the check the law describes is not an emailed scan. It is one of three things:

• A manual check: they look at your original document with you present, and copy the relevant pages themselves. A British passport, current or expired, will do.
• An identity service provider, for British and Irish citizens with a valid passport: you use the provider's app, which reads the passport and usually takes a selfie, and the agent keeps the provider's result.
• A Home Office share code, for anyone whose status is digital, such as an eVisa or settled status: you generate the code, the agent checks it online, and no document is sent at all.

So a scan asked for before anyone has shown you the property is not the right to rent check, and it is fair to ask what it is for, who else will see it, how long it will be kept, and whether you can show the original at the viewing instead. It is often a referencing company's identity check, which belongs in that company's own portal. A listing that wants a passport and a deposit before a viewing is the shape rental fraud takes. The scheme applies in England only; Scotland, Wales and Northern Ireland do not have it.

A request for a photo of you holding the passport beside your face deserves a firmer no. A document and a live face together are what remote identity checks use to open accounts; an identity provider collects that inside its own app, and an agent collecting it by email keeps it in an ordinary mailbox.

If you do send a copy at the application stage, the rest of this page applies unchanged, and a stamped copy costs the agent nothing they are entitled to: the copy the law asks them to keep is the one they make from your original. We ran BASTION on a specimen passport image made for the purpose, a JPEG carrying a camera make, model and GPS position. Its copy had the MRZ, the passport number and the signature as solid black, a stamp reading PROVIDED TO NORTHGATE LETTINGS ONLY with the purpose and date repeated across the whole image, and no EXIF data at all.

The watermark is the part people skip

Stamping a copy with "For [company] only, for [purpose], [date]", written across the document rather than in a corner, does two things. It makes the copy much harder to reuse anywhere else, because the stamp has to be removed convincingly and it sits over the face and the text. And if it does turn up somewhere it should not, the stamp says who you gave it to, which is the whole point, and why banks and solicitors have done exactly this with paper copies for decades.

Write it across the middle, over the photograph, at an angle. A neat stamp in white space is a crop away from gone.

Flatten it

A black rectangle drawn in a PDF viewer, or a layer in an image editor, is a thing sitting on top of the document. Somebody can move it. If it is in a PDF, the text is often still underneath and still selectable. This is the failure that has exposed redacted court filings, repeatedly, for twenty years. What you send has to be pixels: one flat image where the blacked-out parts contain no information. BASTION saves a flattened copy; for a PDF, SEAL removes the text rather than covering it.

The metadata question

A photograph of your passport taken on your phone carries the GPS coordinates where you took it, which is, for most people, their home. It also carries the device, the time, and often a thumbnail of the image before you edited it. EXIF shows what is in yours; CLOAK strips it. The copy BASTION writes is drawn fresh from pixels, so none of it comes along, but it is worth seeing what was in the original once.

How to send it

Email is a postcard that gets stored on at least four machines. If the recipient offers a portal, use it. If they insist on email, a locked archive with the passphrase sent by text is better than an attachment: STRONGBOX writes one, and CAPSULE makes a single encrypted file that opens in a browser with nothing installed. And when it is done, delete the copy from Sent, from the phone's camera roll, and from Downloads. It is the copies you forget that leak.

Why not just use a free redaction site

Think about the position that site is in. It receives, by design, a continuous stream of unredacted passport and licence scans from people who were being careful. Every one arrives with its metadata. Whatever the operator's intentions, that is the highest-value target on the open internet per gigabyte, and the breach notification would be catastrophic for the people in it and survivable for the company.

You do not have to evaluate any of that. A page that does the work in your own browser never receives the file. You can load it, turn the network off, and watch it still work, which is a check you can run, not a promise you have to weigh.

The short version