A mobile network or utility wants a copy of your ID

A mobile operator asks for a passport scan before it will activate a SIM. An energy supplier asks for the same before it will put the meter in your name. The two requests look identical, and in law they are almost never the same thing — which is why the honest answer here starts with a question about your country rather than a technique.

Is a copy of your ID actually required to get a SIM?

In some places the operator genuinely has no choice about identifying you.

• Spain. The single additional provision of Ley 25/2007 obliges mobile operators selling prepaid cards to keep a register of buyers. Identification is made “mediante documento acreditativo de la personalidad”, and the register records your name, surnames, nationality, the type of document and its number.
• Germany. § 172 of the Telekommunikationsgesetz requires providers of prepaid mobile services to verify the subscriber’s details against an identity document before activation, using a procedure the Bundesnetzagentur has approved.
• Austria. Anonymous SIMs have not been available since 2019, and the duty covers contract lines as well as prepaid.
• Switzerland goes furthest of the four. Article 20a of the VÜPF, in force since January 2024, requires the provider or its reseller to make a good, legible electronic copy of the original document — a passport, an identity card or a residence permit.
• The UK has no general SIM registration requirement. Neither do a number of other EU states. An operator there asking for a passport scan is doing it for its own credit and fraud policy — which is a real reason, but a negotiable one.

The test is the same one that sorts every other request on this site: is a law telling them to capture the document, or is someone asking because it is convenient? Where registration is compulsory, a black bar over the document number is a failed check, not a privacy setting — the same mechanics as a bank’s KYC check, and the boundary set out in when redacting your ID won’t work.

Two different checks arrive as one form

This is the part most people never separate, and it is worth being blunt about.

A contract SIM, a broadband line and an energy account all involve a credit check. That check runs on your name, address and date of birth. It does not need an image of your document. It never has.

The identity check is a different thing: confirming that the person giving those details is you. Sometimes that has a legal basis, as above. Often it is satisfied by someone looking at the document rather than photographing it — and under Article 5(1)(c) of the GDPR, data has to be limited to what is necessary for the purpose. A stored scan is convenient evidence that a check happened. That is not the same as being necessary for it.

So when the form asks for “ID”, answer the two parts separately: here are the details for the credit check; now, what exactly is the image for?

In store and online are not the same request

In a shop, an assistant looks at your document, types the number into a form and hands it back. Nothing persists but the recorded fields. That is a genuinely lighter footprint than the online version, where the image itself becomes a file — and files get copied, backed up and, eventually, breached.

If the flow is online, three questions are fair, and they are the ones from can a company legally keep a copy of your ID:

1. Is the image kept after activation, or only the details read from it?
2. If it is kept, for how long, and under what legal basis?
3. Is the check outsourced to a third-party identity provider? If so, a second company now holds your document, with its own retention policy and its own breach history.

Why a telecom is a bad place for a full-resolution scan

Here is the reason this guide exists rather than being a footnote to the bank one.

SIM swapping is the attack where someone persuades your operator to move your number onto their SIM — a support call, a shop visit, an online port-out. It is social engineering, and it succeeds when the attacker can recite enough personal detail to sound like the account holder. A sharp copy of your passport or ID card hands over most of that detail in one file: full name as registered, date of birth, document number, nationality, and often your address.

The payoff for the attacker is not the phone number. It is that SMS two-factor codes follow the number — your bank, your email, and then everything your email can reset. That makes an operator one of the worst possible places for a complete image of your document to sit, even in countries where handing one over is entirely lawful.

Three defences, in order of usefulness:

1. Put a port-out PIN or account password on the line. Most operators offer one and almost nobody asks. It converts “convince an agent” into “know a secret”.
2. Move two-factor off SMS, at least for your email and your bank. An authenticator app or a passkey does not travel with the number.
3. Ask what happens to the image, and ask for deletion once activation is complete. And treat a sudden, unexplained loss of signal as an incident rather than a network glitch — that is what a swap looks like from your side.

If a copy is already out there, work through you already sent an unredacted ID copy; watching for accounts opened in your name is the step that matters most.

Utilities are the easy case

Electricity, gas, water and fixed broadband have no registration regime behind them anywhere in Europe. What a supplier genuinely needs is your name, your address, your date of birth for the credit check, the supply point or meter reference, and a payment mandate. None of that requires an image of your document.

This is therefore the clean redaction case: cover the document number, the machine-readable zone and your signature, leave your name and photo legible, give the date of birth as a form field, and watermark the copy for that supplier and that date.

Who is asking, and what to send

The last row matters more than it looks. As with banks, the largest single source of stolen ID copies in this category is not the real registration step but a convincing imitation of it.

When you are on the utility side of that table — or dealing with an operator in a country that never required the image in the first place — Anonymize my ID covers the fields and adds the watermark on your phone in about a minute, with nothing uploaded anywhere. The field-by-field method is in how to redact a passport or ID card.

Four questions to ask before you send an operator a copy of your ID

1. Is this identification, or is it the credit check? They arrive on the same form and they are not the same ask. The credit check runs on your name, address and date of birth. Give those as form fields and treat the request for a document image as a separate question that has to justify itself.
2. Does a law require the image, or only the details? Ask which rule the operator is relying on. In a SIM-registration country it must see the document and record the number, but no law tells it to keep a picture of the whole page. A utility has no registration duty at all.
3. Who ends up holding the copy, and for how long? Ask whether the image is deleted after activation and whether the check is outsourced to a third-party identity provider. If it is, a second company now holds your document, with its own retention period and its own breach history.
4. Lock the number before you hand anything over. Set a port-out PIN or account password with the operator, and move two-factor authentication for your bank and your email off SMS onto an authenticator app. Do this first, so a leaked copy cannot be turned into a takeover.

Frequently asked questions