Guide Scams and phishing
I sent a photo of my ID to a scammer: what to do now
Scammers ask for a copy of your ID under all sorts of pretexts: “identity verification” for a loan, a flat you want to rent, a prize you've supposedly won, a job offer or a message that claims to be from a government agency. If you've already sent it, money won't vanish from your account because of the photo alone. But a document image with your name, date of birth and document number can be used to open credit or accounts in your name, and makes the next scam aimed at you far more convincing. Here's what to do, step by step.
Key points
- A photo of your ID is mainly used to apply for credit or open accounts in your name, or to make follow-up scams more believable – the scammer now knows exactly who you are.
- Stop replying, save the conversation and tell your bank. If you also gave card details, banking access or a one-time code, call your bank right now – that is the urgent part.
- Make it hard to open credit in your name. In the US, a credit freeze is free and lasts until you lift it; in the UK, Cifas Protective Registration flags your details for extra checks (£30 for two years).
- Watch your credit report and post for accounts you don't recognise. If your actual passport or ID card was stolen, report it so it gets cancelled.
Why scammers want a copy of your ID
From what we see in a SOC, an ID photo is one of the most valuable things a scammer can collect, even though it doesn't pay out straight away. They ask for it under many pretexts:
- “Identity verification” for a loan or a prize – see advance-fee loan scams and fake prize giveaways.
- A rental flat that doesn't exist – see rental scams.
- A job offer. The FTC puts it plainly: job scammers promise you a job, but what they want is your money and your personal information. It also warns that if you gave personal information thinking it was for payroll, you may now have an identity theft problem.
- A message posing as a government agency, bank or delivery company asking you to “confirm your identity” by uploading a document.
What they can do with it
The good news is that lenders and banks often check identity – by credit report, by contacting you, or against fraud databases. The steps below make those checks much more likely to stop an application in your name.
What to do now – step by step
- Stop replying. Don't send any more documents, details or money, even if the scammer threatens you or insists that “verification” won't go through without them.
- Save the evidence: the conversation, the email including the sender's address, phone numbers, links and the original ad. The police and your bank will want it.
- Tell your bank. Call the number on your card or on the bank's own website, explain that a scammer has a copy of your ID, and ask how they can protect your account.
- Make it hard to open credit in your name.
- US: the FTC explains that a credit freeze is free, has to be placed with each of the three credit bureaus (Equifax, Experian and TransUnion) and lasts until you lift it; while it's on, nobody can open new credit in your name. A free initial fraud alert lasts one year and asks lenders to verify your identity first – you contact one bureau, which must notify the other two.
- UK: Cifas Protective Registration puts a warning flag on your details in the National Fraud Database, so organisations that use Cifas data run extra checks before accepting an application in your name. Cifas says it costs £30 for two years, can slow down your own genuine applications, doesn't affect your credit score and isn't insurance against fraud losses.
- Elsewhere: ask your bank and your national credit reference agency or fraud prevention service what protection is available.
- Report the scam to the police or your national fraud reporting service – in the US at ReportFraud.ftc.gov. A report helps if credit is taken out in your name later: you'll have proof you flagged the misuse early.
- If your document itself was lost or stolen, cancel it. GOV.UK says a lost or stolen UK passport must be cancelled as soon as possible – that reduces the risk of anyone else using it or your identity. Other countries' passport offices and licensing authorities offer similar services.
What to watch for in the coming weeks
The FTC lists these warning signs of identity theft:
- accounts in your name you don't recognise – on your credit report or in letters from lenders,
- bills that stop arriving – someone may have changed your billing address,
- charges or withdrawals you didn't make.
Also be careful with these:
- A call from “your bank”, “the police” or “a government agency” that knows your name, address and document number. That proves nothing – the scammer has those details. Hang up and call back on an official number. How these calls work: Bank impersonation scam calls.
- A letter or reminder about a contract you never signed. Don't ignore it. Contact the lender using details from its official website, not from the letter, say it's identity fraud and give them your police or FTC report number.
- Someone offering to “clean your identity” or “remove your ID from databases” for a fee. That's another scam – see recovery scams.
How not to send it next time
- Treat any request for an ID copy by email or chat as suspicious, especially from a “government agency”, a “recruiter” or a “landlord” you've never met. If in doubt, contact the organisation through its official website or phone number, not by replying.
- Give a copy only to someone you've checked yourself and who genuinely needs it – a bank where you are opening an account on its own website or app, yes; a “loan broker” from an ad, an unknown landlord or a contest organiser, no.
- Verify identity only inside the official app or website of a service you opened yourself, never through a link someone sent you.
FAQ
What can a scammer do with a photo of my ID?
Most often they try to use your details to apply for a loan, a credit card or a phone contract, or to open a bank or payment account in your name. Your details also make follow-up calls and emails more convincing: someone who can read out your full name, address and document number sounds like your bank or the police. The FTC lists accounts you don't recognise and bills that stop arriving among the warning signs of identity theft.
Do I need a new passport or driving licence?
If you only sent a photo and still have the document, there's usually no general procedure to cancel it just for that – the steps below (bank, credit freeze or Cifas, monitoring) protect you better. If the document itself was lost or stolen, report it: GOV.UK says a lost or stolen UK passport must be cancelled as soon as possible, which reduces the risk of anyone else using it or your identity. Other countries have similar services – check your passport office or licensing authority.
How do I stop someone opening credit in my name in the US?
Place a credit freeze with each of the three credit bureaus – Equifax, Experian and TransUnion. The FTC explains that it's free and lasts until you lift it, and while it's in place nobody, including you, can open new credit in your name. A free initial fraud alert lasts one year and asks lenders to verify your identity first; you place it with one bureau, which must tell the other two.
What can I do in the UK?
Tell your bank and consider Cifas Protective Registration. According to Cifas, it adds a warning flag to your details in the National Fraud Database, so member organisations run extra identity checks before accepting an application in your name. It costs £30 for two years, doesn't affect your credit score and isn't insurance against losses. Check your credit reports regularly as well.
I also sent a selfie holding my ID. Is that worse?
Yes, take it more seriously. Some services verify new customers with a photo of the document and a face photo, so a selfie with your ID gives a scammer more material to pose as you. Go through all the steps below, not just the first two, and keep watching your credit report for several months.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
SIM swap scam: your phone suddenly has no signal – what to do
Your phone suddenly shows “No service” or “SOS only”, maybe right after someone called claiming to be your mobile carrier and asked for a code from a text message. That's the classic sign of a SIM swap: a criminal has moved your phone number to a SIM or eSIM they control. From then on, your calls and verification texts go to them – including codes from your bank and email. The FBI's Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021 alone, with more than $68 million in losses. Here's how to spot it, what to do in the first minutes and how to protect your number.
Guide
A "hotel" message asks you to verify your card or pay a balance: how to spot the scam and what to do
The message knows your name, your dates and your booking number. It says your payment failed, or that the reservation will be cancelled unless you verify your card within the hour. It can still be a scam – and police have described travellers who lost thousands this way. Here's how to tell, and what to do if you've already entered your card.
Guide
A supplier says their bank details have changed: how to spot invoice fraud and what to do if you've already paid
The email comes from an address you know, follows on from a real order and simply says the supplier has a new bank account. Accounts pay it – and a few weeks later the real supplier chases an unpaid invoice. The FBI calls this business email compromise and counts it among the costliest frauds it tracks. Here's how to spot it, a simple rule your whole business can follow, and what to do in the first hour if the money has gone.