7

A company that I do business with (e.g. Uber, Google) has requested scans of identity documents. How should I respond? For example:

  • Should I provide the documents? What risks are associated with this? What steps (e.g. watermarking) can I take to reduce these risks?
  • Should I refuse? If so, what are good ways to persuade the company to continue doing business with me?

Context: People in real life sometimes ask me for advice when they encounter this. I generally just advise to provide the documents and move on, but it would be good to have a detailed answer that I could refer to.

  • What exactly are you talking about. What kind of scan? virus scan? scan to get info like metadata? I'm not sure to understand the question... why other companies request to you nothing about your documents? or they want you to scan their documents? – OscarAkaElvis Jan 22 '17 at 12:24
  • 3
    @OscarAkaElvis - I mean "use a scanner to generate an electronic image of the document" – paj28 Jan 22 '17 at 12:30
  • Ok, and can we know why are they asking you for scanned identity documents? I guess is employees id of the company where you work, aren't them? Anyway, you can add easily watermarks to your documents if they are images (jpgs, pngs) or even if you send pdfs which seems a little more formal format. There is software or online pages to do it like this but I don't recommend to you to use online pages because if you use them, you are going to upload sensible info to that pages. Regarding the question if you should refuse, not sure, it depends of business – OscarAkaElvis Jan 22 '17 at 13:10
  • @OscarAkaElvis - This is not for my employer, but a company I do business with (e.g. Uber) The requests typically include a vague reason like "ongoing security" or "for your protection". I presume this is a fraud prevention measure. – paj28 Jan 22 '17 at 13:14
  • hmmnn... maybe. Sorry, I'm not sure to be able to help you but maybe would be as simple as "give it to them if you trust them". If not, ask why and why and why until they give you a reasonable reason or if not, don't give to them the documents. – OscarAkaElvis Jan 22 '17 at 13:48
1

As per the same question that was directed on the meta: X company has requested a scan of my passport

Handling various security documents frequently, these are some of the pointers I give to people:

  • Most security features don't appear in a scanned image
  • Send the scan in black in white
  • Send a lower resolution, or compressed image (Medium/Low JPEG)
  • Attach only one side of the document if possible
  • Ask the company what their data retention policies are
  • Get a bank or other notary public to notarize the scanned copies
  • Do a search to see if there are any past data leaks at the company (e.g. Yahoo)
  • See if you can arrange for a physical presentation of the document.
  • Send the document with a link to a service that allows for retraction (Expiry)
  • Ask about sending the images by Fax
  • Ask if they require document numbers only (much more secure)
  • If you are still concerned, apply a physical/digital watermark

By not verifying an identity document in person can land companies in hot water, and is simply bad practice. There is no valid excuse why one would not verify the true holder of the document, or if there is in fact a true document at all. Companies are unfortunately lazy in this regard.

There are plenty of scans of common documents on the internet, which include US/Canadian/UK passports and drivers licences. Many come as Photoshop templates with instructions on how to paste your own image in, change a few other personal features (name/date of birth), and how to attempt to pass it off as a real scan.

Once you have sent an image (or series of images) off, there is very little you can do to protect yourself. There is a whole area of study related to Data Loss Prevention when it comes to company secrets. Most of these can not be applied to the "Average Joe", as it requires an elaborate setup.

By refusing to send a scan of a document makes it look as if you are hiding something, which may or may not be true. When applying for a job, refusing to send identity documents by email could result in the loss of an opportunity. So unfortunately, you are between a rock and a hard place when it comes to this.

  • I am unsure about sending it over fax. Either way it will end up on their systems so if they are compromised your data is out there, but at the very least at the transport level I would very much prefer HTTPS over unencrypted fax. – André Borie Jan 22 '17 at 22:02
  • Traditional fax systems will only result in a physical copy. That was the intention of providing it as a solution. If you are sending documents for something where the possibility of someone intercepting a phone line is of concern, then we should be talking about S/MIME and GPG. – dark_st3alth Jan 22 '17 at 22:11
  • Another option that works in certain situations is to submit a notarized identity verification. Basically you walk into a bank or other notary public, show them the requested documents (they do not keep a copy), and they sign and notarize a letter stating that you are who you say you are based on the identity documents you presented. – pseudon Jan 23 '17 at 1:59
  • 1
    @pseudon A good idea, however I am aware of at least where I live, such a service costs money. I'll add it to the list. – dark_st3alth Jan 23 '17 at 2:16
  • 1
    Great list of points, thanks for that. I think that not verifying in person is reasonable for situations like Uber checking your ID - the cost of in-person verification would be significant. DLP only works within your sphere of influence, it doesn't work for average Joe because you need to send these scans outside your sphere of influence. – paj28 Jan 23 '17 at 9:17
3

I suggest removing the parts (by taping them before scanning) that are not necessary to match your picture with your name, i.e. the password and serial numbers. Ask the party requesting the password scan about the purpose of this to figure out which parts are essential to them, why they would need them, how they would store the scan and when they would delete it from all their media. Maybe even the picture is not relevant to them or you can have a webcam session showing it to them.

In Germany, there is actually a law that forbids electronically scanning ID cards: the "Personalausweisgesetz" (§ 20 PAuswG). It is only allowed to use a copy machine (basically to "store it on paper"), but the company/person requesting a copy must inform you that you have the right to black out the serial numbers. The copy must be destroyed as soon as its purpose is fulfilled. Find all guidelines summarized here. But you have to know that Germany has the best data protection laws worldwide, so don't be surprised if other countries don't follow this example.

Note: first answered here, didn't look for this question. Thanks @paj28 for his remark.

2

It is not uncommon for organisations you do business with to ask for some level of identification using scanned documents.

You need to do a realistic assessment of the information you are presenting and to whom. It is impossible for us to make a fundamental judgement on whether it is reasonable or not because it depends on the business you are doing, the value, risk (both to you and them) and so on.

Bearing in mind that much of the information you are being asked to share may well not be that sensitive. For example, if I copy my credit card, even the back with its CVV and send it, it is likely that the organisation would get that data anyway. Perhaps they ask for a company bill or bank statement as proof of you being a legitimate and financially secure business - in that case, they will get little more than they already know but with some extra such as someone you paid money to and how much was recently in your company bank account. Is that a great risk to you when you pass it to someone you are about to do some valuable (presumably) business with?

If there is a document you think carries an unacceptable risk, try and get them to accept an alternative.

-2

I think it is critical to ask them either for their public PGP key and encrypt for them, or send them as encrypted zip, and in a separate email or better in a separate channel send them the password. Just imagine what those billion Yahoo hacked emails can contain. People send their CC via email in plaintext.

  • 4
    If the scanned document is so sensitive it must be encrypted to protect it from eavesdroppers, should I not be equally worried what the reciever (or anyone who hacks them) does with it? – Anders Jan 22 '17 at 20:59
  • 4
    Most organizations do not implement PGP/GPG, and requires key exchanges. This is impractical for most job applications. – dark_st3alth Jan 22 '17 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.