24

It is not uncommon for travel or holiday accommodation companies to ask for a scan of your passport by email. Sometimes local laws require them to keep a record of the passport numbers of all visitors. I'm happy to provide that information but you usually have to send it in an unsecured email, which may have consequences as discussed in another question.

Could these companies be more responsible, and provide a public cryptographic key at least?

Are there other steps you should take to protect yourself, if you do send by unsecured email?

  • I think implementing a crypto key would be too confusing for non-techies but I suppose providing this as an option would be good. Personally, I prefer being secure. Do those places make you send your scan over https or http? – verve Nov 26 '14 at 15:15
  • 1
    Encryption, however effective for the actual transmission, does not prevent secondary abuse, and there's no 'globally applicable' answer to the question. If the agent is in the UK and your email is pursuant to a financial transaction, then yes, there's a sovereign regulator that imposes standards on the agent. But that only covers a single country! – Gayot Fow Nov 26 '14 at 15:58
  • They usually just ask to have the passport scan emailed to them. – user2800708 Nov 26 '14 at 16:03
  • 1
    Secondary abuse of the id cannot be ruled out, but assuming I trust the travel company enough, I'm still worried about the email transmission. It just seems irresponsible to even ask for this, but we live in a world where most people are ignorant of security concerns such as this. I had to send a copy of my passport once, to a highly reputable and advanced computer software company, and they too just asked for a plain email. At least they were able to provide a public key when I asked for it. – user2800708 Nov 26 '14 at 16:05
  • 3
    @user2800708 As long as the information is readable, it may be abused. The resolution of the copy is completely irrelevant. – Tor-Einar Jarnbjo Nov 26 '14 at 16:08
30

If a travel agent or someone in an allied industry needs a copy of your passport, you can always send an image with redacted information. This is an example from the Home Office site...

Redacted information

As can be seen, information which is exempt is blotted out (blue rectangles). It shows, yes, you are a British citizen; yes, you have a current passport, and yes, it was issued in the UK. That's all that should be required. Secondary abuse by personnel handling your image at the travel agency is eliminated.

In some jurisdictions, redaction is a legal requirement. Consider this extract from Texas, US which lists the information that should be redacted...

Unless the Court orders otherwise, an e-filed document must not contain a social security number; a birth date; a home address; the name of any person who was a minor when underlying suit was filed; a driver’s license number, passport number, tax identification number, or similar government-issued personal identification number; or a bank account number, credit card number, or other financial account number. The e-filer must redact all of this information in accordance with the redaction guidelines posted by the Court’s Clerk on the Court’s website; however, the e-filed document may contain a reference to this information as long as the reference does not include any part of the actual information (e.g., “passport number”). For good cause, the Court may order redaction of additional information

https://www.casefilexpress.com/Supreme%20Court%20eFiling%20Mandate%2011915200.pdf

In the case of Mass, US, they indicate that the last four digits of the passport number be excluded from redaction...

in the case of a social security number, taxpayer identification number, credit card or other financial account number, driver’s license number, state-issued identification card number, or passport number, only the last four digits; and

http://www.mass.gov/courts/programs/pilot-programs/interim-pid-guidelines.pdf

The rules for redaction are different depending upon jurisdiction. In the UK, bank statements submitted for visa evidence can have the account numbers redacted.

If a travel agent objects to redaction, especially if the courts in their jurisdiction allow it (i.e., they are over and above their own government), then you should consider if the staff do not understand the requirements, or finally that the agent should not be trusted. In all events, if you really NEED to send exempt information, you can send it via separate cover.

Airlines and other entities that have a LEGITIMATE need for your passport number and DOB invariably use secure channels anyway.

NOTE: for purposes of this answer, I included the right hand side of the portrait page only. There is nothing on the left hand side that needs redaction unless the passport holder is a minor.

  • 2
    Thanks; Great answer. I'm reading it as, "yes, but take the necessary precautions to make the image incomplete before sending" – user2800708 Nov 26 '14 at 21:25
  • @user2800708, yes, redact it. And if they object, they can take a hike :) – Gayot Fow Nov 27 '14 at 0:09
  • 1
    HAve you redacted the passport number? This is the one piece of information most such organizations demand. (I was once asked for passport number when signing up for a balloon ride; I have no idea why and provided (from memory) a string of characters that was close to my passport number but was not correct.) – Kate Gregory Nov 27 '14 at 16:49
  • 3
    The redaction example actually misses out the big, glaring passport number on the right hand side; it's the dotted vertical text (actually punched out holes in the actual passport document), if you flip the image vertically (or if you can decipher the numbers by eye), you'll see the number! – Steven Maude Jun 29 '15 at 17:11
  • 1
    @StevenMaude, yikes! Well spotted mate, fixed. – Gayot Fow Jun 29 '15 at 17:30
9

When asked to send any sensitive information electronically, when the recipient is not going to be willing or able to engage in complicated security measures, I typically put the file in a secure location that I control, like Dropbox, and send a link to that file. When the recipient has confirmed receipt, I remove the contents.

Anyone who intercepts the email can still access the document, but it reduces the window of opportunity from forever down to a minute or two. Someone who needs time to process a vast stream of email or someone who hacks into the email account at a later date will have only an expired and worthless link.

1

I would think twice about sending a scan of my passport to anyone. But if I was convinced, I would scan it, import the scan into Microsoft Word, and then protect the Microsoft Word document with a password. Then I would share the password with the recipient by telephone. Finally I would attach the Microsoft Word document to an email.

The same can be done with Adobe Acrobat, if you have it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.