How to best respond to a request to send a passport scan by unsecured email?

Question

It is not uncommon for travel or holiday accommodation companies to ask for a scan of your passport by email. Sometimes local laws require them to keep a record of the passport numbers of all visitors. I'm happy to provide that information but you usually have to send it in an unsecured email, which may have consequences as discussed in another question.

Could these companies be more responsible, and provide a public cryptographic key at least?

Are there other steps you should take to protect yourself, if you do send by unsecured email?

Answer 1

If a travel agent or someone in an allied industry needs a copy of your passport, you can always send an image with redacted information. This is an example from the Home Office site...

As can be seen, information which is exempt is blotted out (blue rectangles). It shows, yes, you are a British citizen; yes, you have a current passport, and yes, it was issued in the UK. That's all that should be required. Secondary abuse by personnel handling your image at the travel agency is eliminated.

In some jurisdictions, redaction is a legal requirement. Consider this extract from Texas, US which lists the information that should be redacted...

Unless the Court orders otherwise, an e-filed document must not contain a social security number; a birth date; a home address; the name of any person who was a minor when underlying suit was filed; a driver’s license number, passport number, tax identification number, or similar government-issued personal identification number; or a bank account number, credit card number, or other financial account number. The e-filer must redact all of this information in accordance with the redaction guidelines posted by the Court’s Clerk on the Court’s website; however, the e-filed document may contain a reference to this information as long as the reference does not include any part of the actual information (e.g., “passport number”). For good cause, the Court may order redaction of additional information

https://www.casefilexpress.com/Supreme%20Court%20eFiling%20Mandate%2011915200.pdf

In the case of Mass, US, they indicate that the last four digits of the passport number be excluded from redaction...

in the case of a social security number, taxpayer identification number, credit card or other financial account number, driver’s license number, state-issued identification card number, or passport number, only the last four digits; and

http://www.mass.gov/courts/programs/pilot-programs/interim-pid-guidelines.pdf

The rules for redaction are different depending upon jurisdiction. In the UK, bank statements submitted for visa evidence can have the account numbers redacted.

If a travel agent objects to redaction, especially if the courts in their jurisdiction allow it (i.e., they are over and above their own government), then you should consider if the staff do not understand the requirements, or finally that the agent should not be trusted. In all events, if you really NEED to send exempt information, you can send it via separate cover.

Airlines and other entities that have a LEGITIMATE need for your passport number and DOB invariably use secure channels anyway.

NOTE: for purposes of this answer, I included the right hand side of the portrait page only. There is nothing on the left hand side that needs redaction unless the passport holder is a minor.

Answer 2

When asked to send any sensitive information electronically, when the recipient is not going to be willing or able to engage in complicated security measures, I typically put the file in a secure location that I control, like Dropbox, and send a link to that file. When the recipient has confirmed receipt, I remove the contents.

Anyone who intercepts the email can still access the document, but it reduces the window of opportunity from forever down to a minute or two. Someone who needs time to process a vast stream of email or someone who hacks into the email account at a later date will have only an expired and worthless link.

Answer 3

I would think twice about sending a scan of my passport to anyone. But if I was convinced, I would scan it, import the scan into Microsoft Word, and then protect the Microsoft Word document with a password. Then I would share the password with the recipient by telephone. Finally I would attach the Microsoft Word document to an email.

The same can be done with Adobe Acrobat, if you have it.