Is it safe to send a selfie holding your ID?
Check who requested it, which channel collects it, and whether a still photo is really required.
Short answer
- Verify the requester independently. Open the service yourself instead of following a link in the message.
- Do not assume every official check is identical. Some use live capture; others may ask for still images or documents.
- Only redact where the recipient allows it. A regulated ID check may reject a covered document.
A verification selfie with an ID card may look like a routine check: your face, the document and sometimes a dated note in one picture. It also creates a file someone else can retain and reuse. The first step is to find out whether the organisation actually asked for it.
Why a face-and-document photo is sensitive
The photo combines your face with the document’s name, number, date of birth and possibly its machine-readable zone. That can help someone impersonate you or attempt another identity check, although a strong verifier should ask for more than a reusable still image. The risk is greatest when you do not know who controls the destination or how long the copy will be kept.
Spain’s cybersecurity institute INCIBE documented an SMS scam asking recipients to email front and back ID photos plus a selfie. The lesson is the collection channel: the message impersonated an organisation and directed people to send identity material outside a verified account.
How to tell whether the request is genuine
| Check | What to do |
|---|---|
| Origin | Open the organisation’s app or type its known address yourself. Look for the same task in your account. |
| Method | Compare the request with its official Help Center. A live camera session, secure upload and still-photo request are different methods. |
| Destination | Identify who receives the file. Ask why a personal email or chat is being used if an account portal exists. |
| Required fields | Ask which part of the ID must remain visible and whether a redacted copy is accepted. |
| Retention | Check the service’s explanation of storage and deletion before sending a face-and-document image. |
A regulated check may use a live camera and an unredacted document. Government identity proofing guidance explains why a verifier may require evidence captured during the process rather than a previously taken image. But methods vary; no single camera gesture or handwritten note proves a request is genuine.
If the request is informal but legitimate
First ask whether a face match can be done without retaining a document image. If the recipient accepts a copy, prepare it for that single purpose: cover unnecessary fields, watermark the ID copy, and use a plain background without mail, door numbers or other location clues. Review the export before sending. An original camera file may contain location metadata.
If the organisation’s own process requires an unredacted document, follow those instructions only after you have verified the destination. A covered MRZ or number can make the check fail. See when redacting an ID will not work.
If you already sent a suspicious request what it asked for, use the checklist for an exposed ID copy and report the requester through the platform where you met them.
Check a selfie-with-ID request
- Open the official service yourself. Sign in through its app or known website and look for the same request in your account. Ask support through that account if you cannot find it.
- Check the exact evidence requested. Find out whether the service needs a live selfie, a still photo, a document image or a selfie holding the document. Do not substitute one for another.
- Use the collection channel it provides. Use a verified in-app camera or secure upload where available. Avoid attaching a full document and face to a personal chat or email.
- Limit the frame and file. Remove address labels and other private details from the background. For an informal request that accepts redaction, cover fields the recipient does not need and watermark the copy for that recipient and purpose.
Frequently asked questions
Is sending a selfie with ID safe?
It depends on the requester and collection method. A picture of your face beside a readable ID contains more reusable information than either alone. Verify the requirement inside the organisation's own app or website and prefer its secure capture process.
Is a selfie holding an ID always a scam?
No. Still-photo identity checks exist, but an unsolicited request to send one through text, chat or a free email account is a strong warning sign. Confirm the request independently before taking a photo.
Can I hide fields on the ID in a verification selfie?
For an informal check, ask which fields are needed and whether a redacted, watermarked copy is accepted. Do not cover a document inside an official check that needs to read its number, MRZ or other fields; that can cause rejection.
Why did someone ask me to hold a note with today's date?
A dated note can be used to show that an image was made for a particular request. It is not proof that the requester is trustworthy. Check the requirement with the organisation directly and do not follow instructions that arrived only through an unsolicited chat.
What if I already sent a selfie with my ID?
Save the request and destination, report a suspicious account or message, change any passwords you entered through a related link, and follow the steps for an exposed ID copy. Monitor financial and online accounts for unfamiliar activity.