PanicStation.org
UK USA
uk Work & employment crises

What to do if…
you are asked to send passport or ID scans over an insecure channel urgently

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Pause before sending anything. Verify the request through a trusted HR route, then ask for a secure upload method or the correct right-to-work check route instead of sending passport or ID scans over an insecure channel.

Do not do these things

  • Don’t send passport or ID scans to a personal email address, unknown mobile number, chat app, or link you cannot verify.
  • Don’t let “urgent” pressure make you bypass your employer’s normal HR or IT process.
  • Don’t assume a scan is acceptable for a manual right to work check; it is not.
  • Don’t send extra documents “just in case”, such as a bank statement, National Insurance letter, full passport, and driving licence together.
  • Don’t put the scan in the email body or send it as an unprotected attachment.
  • Don’t keep forwarding the same scan to more people because someone else asked.

What to do now

  1. Stop and confirm who is asking. Reply briefly: “I can provide what you need, but not over an insecure channel. Please confirm the secure method.” Then verify independently by calling HR or onboarding using the company directory, your offer paperwork, or a known switchboard number; do not use a number from the urgent message until you have checked it.
  2. Ask what the check is for. Ask: “Is this for a right to work check, or a general onboarding ID check?” Then ask what exact document is needed, who will access it, and how long it will be kept.
  3. If this is a right to work check, ask HR to use the correct route.
    • If you are eligible to use the online right to work service, offer to provide a share code so the employer can check it online.
    • If you are a British or Irish citizen with a valid passport, including an Irish passport card, ask whether HR can use an online identity service provider (IDSP) or check your original documents.
    • If you cannot use the online service or cannot show documents, ask HR to check whether the Employer Checking Service is the right route for your situation.
  4. Use the manual-check rule to slow the request down. For a manual right to work check, the employer must obtain original documents. They cannot rely on checking a scan, faxed copy, or a document shown over a live video link. Offer a safer route instead:
    • bring the original document to HR for checking and copying;
    • ask whether HR has a secure original-document process for remote workers, such as tracked delivery, and what happens if the document is delayed or lost;
    • use an employer-approved digital right-to-work route if one is available and suitable.
  5. Ask for a secure transfer method for any copy they genuinely need. Ask for a verified HR portal, secure upload link, or IT-approved secure document process. Check the domain, sender, and owner before uploading.
  6. If HR confirms you must send a file today, reduce the risk first.
    • Send only the exact page or document requested.
    • Use an encrypted file or secure transfer method approved by HR or IT.
    • Send any password through a different verified channel, such as reading it over the phone to HR on a known number.
    • Send it only to a verified work address or portal.
  7. Make a quick record. Save the request and your reply. Note what you sent, to whom, by what method, and the date and time.
  8. If you already sent it insecurely, contain it now.
    • Tell HR and your IT or security team that personal ID was sent insecurely.
    • Ask them to restrict access, confirm deletion from the wrong place, and tell you the correct secure route.
    • Treat any follow-up request for more documents, money, fees, or account details as suspicious until independently verified.

What can wait

  • You don’t need to decide right now whether to escalate externally; first contain the risk by switching to verified HR contacts and a secure method.
  • You don’t need to send backup IDs today unless HR confirms the exact process and document needed.
  • You don’t need to argue with the sender; it is enough to move the request onto the proper channel.

Important reassurance

It is normal to feel pressured when someone implies your start date depends on “sending it now”. A genuine employer should be able to explain the lawful route, the exact document needed, and a secure transfer method.

Scope note

These are first steps to prevent irreversible mistakes while keeping onboarding moving. Later decisions about data protection, employment, immigration, or identity-fraud risk may need specialist help.

Important note

This guide is general information, not legal, immigration, employment, data protection, financial, or professional advice. Employer processes vary; when unsure, prioritise verified contacts, official right-to-work routes, and secure transfer methods.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us