Is It Safe to Email Your Passport? | How to Do It Securely

If you have tried booking a hotel room abroad, you probably experienced getting an email asking you to provide a scan of your passport. However, an Experian survey shows that close to three in four consumers are worried about identity theft. So you might wonder, “Is it safe to email your passport?”

It is safe to email your passport. However, you should take steps to secure all your information by blocking out unnecessary data, using end-to-end encryption, protecting the files with a password, or using a file hosting service. You should also be sure that you send them to the correct person.

There are some things that you should know when you send your passport via email, including the remote possibility of falling victim to social engineering, malware, or identity theft. This article will inform you of these threats, as well as of the things a criminal can and cannot do with a scanned image of your passport.

Email Is Not Secure, Plus Other Cyber Attacks That Can Happen

Sending a scanned copy of your passport over email may not be the most dangerous thing that you can do, but you need to be careful nonetheless. If you’re trying to book a hotel, you might not even think twice about complying with this passport requirement. But you should be wary about sending a copy of your passport through email for a variety of reasons.

Digital Trends writes that email is not secure because it was developed and designed so that everything is readable by anyone who can see network traffic. Even passwords to email accounts were not encrypted at the start. Anybody who wants to read your emails will be able to do so using your own device, while it is being transmitted over different networks, on the email servers, and your recipients’ devices.

Malware, or malicious software, on your phone or on the recipient’s device can easily read your emails and download attachments. Man-in-the-middle attacks, where a hacker can eavesdrop on your emails while it’s being sent from one network to another, can also happen. Simply put, email is not designed for security and privacy.

What’s more, because email communications are done behind a screen, there are times when you could fall victim to phishing scams. Phishing scams involve legitimate-looking emails that supposedly came from credible contacts like your bank or travel agent asking you to send a scan of your passport. These emails ask you to reply with your bank details or perhaps to click on a certain link, which will download malware onto your device.

What you won’t realize is that the email is spoofed, and instead of being sent by the sender it claims to be, it came from a hacker. By complying with the request to send a scanned copy of your passport, provide bank account numbers, or simply click on a link, you’ve effectively given the hacker the personal information they need and/or access into your system.

Related Is It Safe to Give Someone Your Bank Account Number?

What Sensitive Information Is Contained in a Passport?

What exactly are you sending over? A scan of your passport can easily reveal several pieces of sensitive information that criminals can use:

• Photograph
• Type of document
• Code of the issuing country
• Passport Number
• Full name
• Nationality
• Date and place of birth
• Sex
• Date of Issue
• Date of Expiration
• Authority
• Endorsements
• Scan bar at the bottom

What Can Criminals Do With Your Passport Information?

Hackers can sell your passport information on the dark web. According to this CNBC report:

• A professionally done fake passport sells for up to $5,000
• Scanned passports can fetch anywhere from $5 to $65
• Passport templates go for anywhere from $29 to $89

But if you’re worried about some criminal going around the world masquerading as you, don’t. In 2018, the State Department assured the public after the very high-profile data breach at Marriott that that is not likely to happen. Criminals having your passport number alone will not simply be able to travel to other countries using your identification. 

They will need to present their physical passport book or passport card when they arrive or depart from one country to another. What’s more, Americans own one of the most secure passports in the world with several security features that can prevent counterfeiting. And it takes a lot of technologies and hours of labor to get a fake passport that can pass for the real thing, which is why it’s so expensive to get one.

Identity Theft

Even if your passport number is not that useful for a thief wanting to travel the world like you, you will still have to be wary of identity theft when you do send that scan via email. Using the information they get from passport scans, they can still impersonate you online. Identity theft can take so many forms, so it’s better to learn more about it.

A bigger concern is that hackers and criminals will be able to obtain more information about you by social engineering. Using the information they get from your passport scan, they will be able to trick other people into thinking that they’re you. 

For example, they may create a Facebook account using your name, find you on the platform, and then add your friends. When they know your birthday, they can pretend to be you and ask for birthday gifts or money from friends and family.

Or it could be far worse. A former Scotland Yard fraud officer, Tom Craig, told the BBC that passports could be used to open bank accounts, obtain mortgages, and even do illegal stuff. Craig also explains that it’s highly possible for somebody posing as you to commit a crime that you can be arrested for. What’s more, according to this VOA News article, fake passports can also be used to open bank accounts for money laundering.

Privacy Rights Clearinghouse chief analyst for consumer education and advocacy, Paul Stephens, told CNBC that criminals would be able to use just your passport details along with other data that they may obtain from you to open a secondary account under your name or even access your current accounts.

While some people are still debating about whether it’s inherently dangerous for a cybercriminal to know the information on your passport, some experts say that there is not much anybody who knows your passport number can do. However, Canada’s Competition Bureau advises you to be suspicious if you’re being asked for copies of your passport, as this can be used for identity thefts.

Basically, just like people could steal your identity through your trash or junk mail, you have to be extra careful with online “mail.”

Related Is It Safe to Throw Away Credit Card Offers, Junk Mail, and Receipts?

How Can You Securely Send Your Passport?

With all these dangers, how do you ensure that your passport information is secure? Here are some suggestions.

Block Out the Information That Is Not Needed

If you are trying to book a hotel room or activities for your vacation, some providers will ask you for a scan of your passport. Australian insurer Southern Cross Travel Insurance recommends that before doing so, ask the following questions:

• Is it a requirement for booking? There are places where hotels and service providers are required by law to keep a record of their guests’ passport numbers, whether they’re still booking a room or when they check in.

• What information is necessary? Get a list of what information is needed to complete your booking. Before you send over a scan of your passport, you should redact everything that is not needed.

Use End-to-End Encryption

If you are going to send a scan of your passport, then you can choose to use end-to-end encryption, which basically prevents anybody from peering into your emails from both your end and the recipient. Remember that emails are transmitted over networks in plain text. E2EE will encrypt the contents of your email so that hackers won’t be able to read it even if they monitor the networks where it is transmitted.

Use a Password to Protect Your Files

If E2EE is not an option for you, you can password-protect the scanned image before sending it. It will be wise to send over the password in a separate email. However, there is no way for you to directly put a password on an image file, but here are some workarounds that you can do:

• Download a free file archiver, such as 7-Zip, and create a compressed archive of the scanned passport images and password-protect the resulting archive.

• Embed the images in a Word document and encrypt it with a password.

• Print the scanned images as PDFs. Downloading a program such as Win2PDF will not only allow you to turn your image file into a portable document, but you will have the option to encrypt it with a password.

Consider Using a File Hosting Service

Another alternative is to use file hosting services such as Dropbox, Google Drive, Sync.com, and pCloud. You can upload images of your passport onto these sites and get a share link. The trick is to just give whoever is asking for your passport the link, and once you confirm that they have seen the scans of your passport, you can then delete the file you’ve uploaded to these services.

This way, even if a hacker opens the email at a later date and clicks on that link, the image is already gone.

It’s Never a Bad Idea to Be Safer With Your Personal Information

In summary, in this day and age, it’s entirely possible that a traveler will be asked to send a scan of his or her passport via email for a variety of reasons. It’s safe to send the scans of your passports online, but there are several quick and easy ways to make it safer. Be sure that you can protect yourself from hackers and cybercriminals as you threshold out your travel itineraries online.

Thanks for reading!

For more, check out What to Do With Old Drivers License | Keep or Destroy?