In one of the questions on this site, it was suggested the use of Dropbox to save a backup copy of your passport, in case you need to proof who you are if your original document is lost.

I like the idea, but what if someone gets access to your Dropbox folders and is able to acquire the copy of your passport. The same goes for when you leave a copy of your passport at a hotel receptions desk. Once someone has the info printed on that copy, would that make it easier to steal your identity?

  • Mostly identity theft, but not too major these days in the age of social media.
    – nolim1t
    Nov 28, 2013 at 5:12
  • 1
    This question is answered more comprehensively on security.SE. Mar 17, 2019 at 2:45

4 Answers 4


Yes - it does increase the risk of identity theft, however for most successful identity thefts, the attacker would need various other bits of information as well.

The best way to think of it is that every piece of information about you an attacker has, the less effort he has to expend to impersonate you.

Once an attacker can impersonate you they could steal your money (this happens a lot with online banking), your house, your credit rating, your reputation, and generally cause you major problems.

General recommendation is to not place anything in Dropbox unencrypted, if it is at all sensitive.

We have a range of questions on this topic over on Security SE and more than happy to discuss in the DMZ - the Sec.SE chat room.


A passport copy can often contain sensitive information such as date of birth which can be used to access other sensitive information such as bank accounts. However, most transactions where you need to get in touch with customer care to get access will also require additional details such as secret passphrases, PINs, address information, or account numbers - none of which are available on your passport, hence the passport alone will usually not help anyone steal your identity. Additionally, if trying to steal your identity in person as opposed to online or the phone, they'd need to look similar to you and/or back it up with some form of secondary ID such as a national ID or a driver's license, and obtaining BOTH your passport copy and your secondary ID can be hard for a casual counterfeiter.

Dropbox isn't the only way to store copies of your passport; some people do this by saving a scanned copy in their email account. Whatever way you choose, if you are concerned protecting data then you should look into enabling two-factor authentication on such accounts where in addition to your password you also need to enter a one-time password generated either by an app or sent to you by text message to access the account. Since receiving text messages is free in most countries even when roaming (or is reasonably cheap), this can be a good way of boosting security on your account while travelling.

  • 2
    Needed to say, with Dropbox, i.e. collaborative file-sharing system, having an SMS double-check is a bit of a non-sense :-/ However I agree, Dropbox is not the best place in the world to store sensitive data.
    – yo'
    Jan 29, 2014 at 10:50
  • 1
    I'd be suspicious of emailing sensitive things to your email too, especially gmail, I don't think it's beyond Google tech to scan binary image formats for ad purposes
    – blackbird
    Jan 30, 2014 at 16:30
  • @blackbird57 You don't necessarily need to send the email, you can attach a file and save it as a draft.
    – kiradotee
    Apr 27, 2016 at 22:54
  • This answer was written in 2013. Nowadays, using 2FA with SMS is a very bad idea. Using an app like Google Authenticator is recommended instead. Mar 12, 2019 at 9:26

Another thing an attacker can do is to take over your social network account (Facebook, for example) or Gmail, by calling the support, pretending to be you who "lost a phone" and "got locked out of email", and sending them the scan of your passport to "prove" he is you. This has happened in past (see for example "Aaron Thompson lost control of his Facebook account after an attacker used social engineering and a fake passport").

  • 1
    In an ideal world, this would not succeed. But we don't live in an ideal world. I have seen many cashiers flip over my credit card, glance at the clearly printed "PHOTO ID REQUIRED" instead of a signature, and continue on saying nothing. I purchased groceries for my blind friend with her card and her not present and the cashier thought nothing of a male using a card labeled "Elizabeth."
    – WGroleau
    Feb 17, 2018 at 1:35
  • @WGroleau: my ex (female) has routinely bought things with my credit card without problem. This happened as recently as 2018, and in Silicon Valley, where you'd think awareness of security practices would be a little higher than elsewhere. Mar 12, 2019 at 9:28
  • In the linked example, a fake passport picture was used with fake data, other than their name. Someone's name is usually easy to obtain in various public mediums. So it's actually worse for a real one having an actual copy of real data so deeper checks wouldn't fail.
    – James
    Aug 18, 2021 at 14:52

There is an app that integrates with Dropbox that encrypts your data, so that you get the convenience of having it everywhere but much more difficult to steal. It's called BoxCryptor, check it out. I have my passport and some insurance stuff on there as a backup.

  • 4
    Except you don't get it everywhere. You need a copy of this software installed to access it, which isn't going to work well when you're being held by immigration due to having lost your passport...
    – Doc
    Jan 28, 2014 at 22:54
  • 3
    Yeah you can have it on your phone, with Dropbox you can set favourites so they're available to view offline on your phone. Worst case, if they ask to see something, you can request some 3G/wifi to download before unlocking the encrypted docs
    – blackbird
    Jan 30, 2014 at 16:28
  • I've used Boxcryptor and it's a solid choice if you only have one computer and one mobile device; beyond that you need to pay for it (or deal with their local-only install). Another similar option would be to use VeraCrypt (formerly TrueCrypt) to create a container on your computer, put the scans there, and then use Disk Decipher on your phone to access the archive. Yet another option is to use some tool other than Dropbox that has zero-knowledge encryption, e.g., Sync.com, TresorIt, SpiderOak, pCloud, or iDrive.
    – corvec
    Mar 19, 2018 at 16:01
  • IOS has one or more apps that look like a ordinary calculator but "open the safe" if you put in a code number.
    – WGroleau
    Sep 5, 2022 at 0:25

You must log in to answer this question.