You already sent an unredacted ID copy. What now?

Almost everyone has done it at least once: a request came in, it looked routine, and a full photo of a passport or ID card went out before there was time to think about it. If you are reading this shortly afterwards, the useful thing to know is that this is a manageable situation with a clear order of operations — and that the worst response is either panic or doing nothing.

First: work out what was actually visible

Not every leaked copy is equally serious, and this determines everything else. Look at what you sent and check which of these were legible:

• The document number and the machine-readable zone — the two together are the serious ones. They are compact, machine-readable and reused by verification systems.
• Your date of birth, which is what most identity checks pair with a name.
• Your signature, which matters for documents rather than accounts.

A blurry photo showing your name and face is a very different situation from a sharp scan of the full data page. Be honest about which one you sent — it decides how much of the rest is worth doing.

Second: get the copy deleted where you can

If it went to a business, ask them to delete it now that the check is done, and ask for written confirmation. In the EU and UK this is a formal right, not a favour — see can a company legally keep a copy of your ID for how to word it and where to complain if they refuse.

If it went over chat or email, delete it from the thread on your side too. That does not remove the recipient’s copy, but it removes yours from a backup that will otherwise outlive the conversation by years — the mechanism described in is it safe to send your ID over WhatsApp or email.

Third: watch the right things

This is where people usually look in the wrong direction. The realistic risk is not that your passport stops working — it is that your details are used to open something in your name. So watch for:

• Credit or loan applications you did not make.
• Bank accounts, SIM contracts or subscriptions appearing in your name.
• Letters or emails confirming services you never signed up for.

Depending on your country, a credit freeze or fraud alert with the credit reference agencies is the single highest-leverage step here, because it blocks the most common downstream use rather than merely alerting you to it.

When to replace the document itself

Replacing a passport is disruptive and usually unnecessary. It becomes worth considering when the document number is circulating somewhere you know is fraudulent, or when a police report or your embassy advises it. A copy sitting in a hotel’s files is a privacy problem; a copy in the hands of someone actively running a scam is a different question, and your passport authority is the right place to take it.

If it went to a scammer rather than a business

Then treat it as fraud from the start: stop replying, do not send a second document or any “release fee” — that escalation is the actual point of many of these approaches — report it to the police, and contact your embassy or passport authority if you think the document is compromised. For what someone can realistically do with the image, see can someone steal your identity from an ID photo.

And from the next request onwards

You cannot recall what has already been sent. You can make sure it is the last unredacted copy you ever send: cover the number, machine-readable zone, date of birth and signature, keep your name and photo, and watermark it for whoever is asking. Anonymize my ID does that on your phone in about a minute, offline — the mechanics are in how to redact a passport or ID card.

Frequently asked questions