24

It is not uncommon for travel or holiday accommodation companies to ask for a scan of your passport by email. Sometimes local laws require them to keep a record of the passport numbers of all visitors. I'm happy to provide that information but you usually have to send it in an unsecured email, which may have consequences as discussed in another question.

Could these companies be more responsible, and provide a public cryptographic key at least?

Are there other steps you should take to protect yourself, if you do send by unsecured email?

Improve this question
8
  • I think implementing a crypto key would be too confusing for non-techies but I suppose providing this as an option would be good. Personally, I prefer being secure. Do those places make you send your scan over https or http?
    – verve
    Nov 26, 2014 at 15:15
  • 1
    Encryption, however effective for the actual transmission, does not prevent secondary abuse, and there's no 'globally applicable' answer to the question. If the agent is in the UK and your email is pursuant to a financial transaction, then yes, there's a sovereign regulator that imposes standards on the agent. But that only covers a single country!
    – Gayot Fow
    Nov 26, 2014 at 15:58
  • They usually just ask to have the passport scan emailed to them.
    – user2800708
    Nov 26, 2014 at 16:03
  • 1
    Secondary abuse of the id cannot be ruled out, but assuming I trust the travel company enough, I'm still worried about the email transmission. It just seems irresponsible to even ask for this, but we live in a world where most people are ignorant of security concerns such as this. I had to send a copy of my passport once, to a highly reputable and advanced computer software company, and they too just asked for a plain email. At least they were able to provide a public key when I asked for it.
    – user2800708
    Nov 26, 2014 at 16:05
  • 3
    @user2800708 As long as the information is readable, it may be abused. The resolution of the copy is completely irrelevant.
    – Tor-Einar Jarnbjo
    Nov 26, 2014 at 16:08

3 Answers 3

Reset to default
31

If a travel agent or someone in an allied industry needs a copy of your passport, you can always send an image with redacted information. This is an example from the Home Office site...

Redacted information

As can be seen, information which is exempt is blotted out (blue rectangles). It shows, yes, you are a British citizen; yes, you have a current passport, and yes, it was issued in the UK. That's all that should be required. Secondary abuse by personnel handling your image at the travel agency is eliminated.

In some jurisdictions, redaction is a legal requirement. Consider this extract from Texas, US which lists the information that should be redacted...

Unless the Court orders otherwise, an e-filed document must not contain a social security number; a birth date; a home address; the name of any person who was a minor when underlying suit was filed; a driver’s license number, passport number, tax identification number, or similar government-issued personal identification number; or a bank account number, credit card number, or other financial account number. The e-filer must redact all of this information in accordance with the redaction guidelines posted by the Court’s Clerk on the Court’s website; however, the e-filed document may contain a reference to this information as long as the reference does not include any part of the actual information (e.g., “passport number”). For good cause, the Court may order redaction of additional information

https://www.casefilexpress.com/Supreme%20Court%20eFiling%20Mandate%2011915200.pdf

In the case of Mass, US, they indicate that the last four digits of the passport number be excluded from redaction...

in the case of a social security number, taxpayer identification number, credit card or other financial account number, driver’s license number, state-issued identification card number, or passport number, only the last four digits; and

http://www.mass.gov/courts/programs/pilot-programs/interim-pid-guidelines.pdf

The rules for redaction are different depending upon jurisdiction. In the UK, bank statements submitted for visa evidence can have the account numbers redacted.

If a travel agent objects to redaction, especially if the courts in their jurisdiction allow it (i.e., they are over and above their own government), then you should consider if the staff do not understand the requirements, or finally that the agent should not be trusted. In all events, if you really NEED to send exempt information, you can send it via separate cover.

Airlines and other entities that have a LEGITIMATE need for your passport number and DOB invariably use secure channels anyway.

NOTE: for purposes of this answer, I included the right hand side of the portrait page only. There is nothing on the left hand side that needs redaction unless the passport holder is a minor.

Improve this answer
8
  • 2
    Thanks; Great answer. I'm reading it as, "yes, but take the necessary precautions to make the image incomplete before sending"
    – user2800708
    Nov 26, 2014 at 21:25
  • @user2800708, yes, redact it. And if they object, they can take a hike :)
    – Gayot Fow
    Nov 27, 2014 at 0:09
  • 1
    HAve you redacted the passport number? This is the one piece of information most such organizations demand. (I was once asked for passport number when signing up for a balloon ride; I have no idea why and provided (from memory) a string of characters that was close to my passport number but was not correct.)
    – Kate Gregory
    Nov 27, 2014 at 16:49
  • 4
    The redaction example actually misses out the big, glaring passport number on the right hand side; it's the dotted vertical text (actually punched out holes in the actual passport document), if you flip the image vertically (or if you can decipher the numbers by eye), you'll see the number!
    – Steven Maude
    Jun 29, 2015 at 17:11
  • 2
    @StevenMaude, yikes! Well spotted mate, fixed.
    – Gayot Fow
    Jun 29, 2015 at 17:30
12

When asked to send any sensitive information electronically, when the recipient is not going to be willing or able to engage in complicated security measures, I typically put the file in a secure location that I control, like Dropbox, and send a link to that file. When the recipient has confirmed receipt, I remove the contents.

Anyone who intercepts the email can still access the document, but it reduces the window of opportunity from forever down to a minute or two. Someone who needs time to process a vast stream of email or someone who hacks into the email account at a later date will have only an expired and worthless link.

Improve this answer
2
  • This won't protect you much. The recipient will save your passport to their computer, which probably even their kids or spouse can access. Airbnb hosts probably amass a whole bunch of passports from tourists, and later their laptop "crashes" and ends up in a random laptop repair shop that sells them on the dark web.
    – Dan Dascalescu
    May 15 at 17:21
  • It won't protect you from a malicious or inept recipient getting hacked in the way that you describe, but it will protect you if their email is what gets hacked, without having physical possession of the hard drive, which is a lot more likely.
    – Joshua Frank
    May 16 at 15:16
1

I would think twice about sending a scan of my passport to anyone. But if I was convinced, I would scan it, import the scan into Microsoft Word, and then protect the Microsoft Word document with a password. Then I would share the password with the recipient by telephone. Finally I would attach the Microsoft Word document to an email.

The same can be done with Adobe Acrobat, if you have it.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .