To think email isn't a secure way to share your passport etc

[nuvverfing]

I have a virtual job interview next week, and the employer has asked me to email them my passport in advance, as well as showing it at the interview. They have referenced this Government guidance for identity checks: www.gov.uk/guidance/coronavirus-covid-19-right-to-work-checks#updated-advice-for-employers-carrying-out-right-to-work-checks-during-coronavirus-covid-19-adjusted-measures

Surely email isn't a secure way to share personal identity docs? I'm surprised the Government is encouraging it. I will do it, as I haven't been offered an alternative, but it feels uncomfortable. Just me?

Email isn't particularly secure but then a passport doesn't actually have a lot of personal detail on it and having a copy of the passport page doesn't allow someone to travel using your identity. If you don't want to send the passport by email, you could use a secure file sharing service like OneDrive

Passports are used for far more than travel - they are used to prove identity for many things. Identity thieves would be happy to lay their hands on digital copies of passports.

Well, how would you like to send it to them? A locked safe via courier?

Perhaps you could put a large watermark over the emailed copy plus blank a couple of the numbers out.

I'm with you on this, and have put paper photocopies in the post where necessary, followed by showing the original over Zoom.

Not infallible, not as vulnerable as a digital copy which could end up duplicated hither and yon with no one the wiser.

You can encrypt your documents with a password when sending by email

Turn it into a password encrypted file, send them that, then get a telephone number to text the password to.

It's a photo of a document.
What is anybody going to do with it? It's a hell of a lot more risky sending a photocopy or the real thing.

Absolutely do not send an unencrypted photo of your passport over email.

Even a request for that would concern me as it shows a lack of understanding around the required security/privacy of such documents.

Request a secure method of sending it or, at the very least, send it encrypted and communicate the password via another method.

Even a request for that would concern me as it shows a lack of understanding around the required security/privacy of such documents.

This.

Anyone daft enough to request an unencrypted emailed copy very obviously doesn't appreciate the security/privacy issues so is unlikely to keep it safe.

Agree with others - encrypt it

The last two government organisations, including the one I started work for last week did this

Absolutely this.

I would ask if they can give you access to a Dropbox or SharePoint link.

It’s not a digital copy. It’s a photo of one page of your passport. If you are concerned about identity theives making a knock off passport, ensure the scan photo is in black and white.

It's not.
I had a row with a big organisation about this a few years ago.
When questioned they sent me instructions for a secure email method.

We then had the discussion about our of date passport still being ID.

Absolutely do not send an unencrypted photo of your passport over email.

? Most free email accounts have automatically encrypted emails.

We do exactly the same at our work/those government guidelines. Although you can bring your passport in person if you prefer and we’ll verify at the office (or post a copy to us and we’ll verify over zoom).

Just blank out some of the details like expiry date

By old fashioned post would be a lot more secure.

The issue is not someone making a knock off copy of you passport. It's what happens if someone gets a copy of that scan. They could apply for things in your name and send the scan as proof of ID.

I mean, it’s not very likely that it would be intercepted by a 3rd party someone and used though as the big providers of free email (gmail, outlook and yahoo) all use automatic in transit TLS encryption of emails.
clean.email/blog/email-security/how-to-encrypt-email

I'm with you on this.

Expedia wanted me to email a copy of my passport along with proof of address. They could provide no other way of me getting the documents and they were unable to accept encrypted mail.

An identity thief's dream.

I'm a civil servant and we're still interviewing via MS Teams. We're asked by the recruitment team to get candidates to email us a copy of their passport and proof of home address so we can verify their identity on screen. We then forward this to recruitment. If we were interviewing in person, we'd ask them to bring the documents with them so we could verify them in person.

TealAndTurquoise, could you have a look and see how many people's passports you have copies of still lurking around on your computer, and on any web-based mail services you may use?

Eg I use gmail but through my Mac's mail app, so I end up with a copy of everything on my machine and another copy lurking on gmail's servers which I rarely log into separately.

If you have any passport images AT ALL, you are now responsible under data protection legislation for their safe-keeping.

In fact if you do have any, you are probably already in breach of data protection legislation, which states that you must delete personal data when you no longer have a business need for it. Given you pass the data onto recruitment, you no longer need it yourself and must delete all copies in your possession.

People banging on about encryption in transition...

It's not someone tapping the wires I'm concerned about, it's the absolutely rubbish security most people apply to their email accounts and the even more slapdash storage of data all over the place. Most of the time no one even thinks about it; a large number of people I know haven't a scoobie where they've saved any given download to.