What Can Someone Do With Your ID? A Calm Look at the Real Risks
What can someone do with your ID number, a photo of your ID or the card itself? What each piece unlocks, what it does not, and how to redact and report.
The message arrives after a promising chat about a remote job. To set up your payroll account, the friendly HR manager just needs a few things: a photo of the front of your ID, a photo of the back, and a selfie of you holding it. A week later you start wondering. What can someone do with your ID once it is out of your hands, and how worried should you be?
The useful answer splits into layers. The number printed on an ID card or passport is far less powerful than most people fear. A clear photo of the whole document is a different matter, and a photo plus a matching selfie is close to everything a fraudster needs. This article walks through what each layer actually unlocks, where the real damage happens, how to share a copy safely when you have to, and what to do when a document or a copy goes missing.
We use the German ID card as the worked example, because German law spells out unusually clearly what the number may and may not be used for. The principles carry over to passports and ID cards in many other countries, but the legal details do not. We read the German provisions in the original, as of October 2026. Nothing here is legal advice.
What is on the card, and what is deliberately left off
Modern ID cards and passports follow the same international playbook from ICAO, the UN’s civil aviation body. The front shows your photo, name, date of birth, expiry date and a document number. The back of an ID card, or the bottom of a passport’s photo page, carries the machine readable zone: two or three lines of blocky characters full of angle brackets that scanners at borders and hotel desks can read in one pass.
That zone repeats the document number, your name, date of birth, nationality and expiry date. The document number, the date of birth and the expiry date each get a check digit, and a final one covers them all together. The check digits are computed from the characters before them, so a scanner can tell when it misread a letter. They are not secret. Anyone who knows the other fields can calculate them, and they exist to catch typos and crude tampering, nothing more.
What matters more is what is missing. The German card, for instance, carries a nine-character serial number, a six-digit card access number for the chip, and the machine readable zone. The things that actually authorize something never appear on the card. A separate letter brings a one-time transport PIN, the unblocking code and the password to cancel the card’s online function. The six-digit PIN for online identification is one you choose yourself. The table shows how that split looks in practice:
| Item | Where it lives | What it does | Printed on the card? |
|---|---|---|---|
| Document or serial number | Front and machine readable zone | Identifies this one physical document | Yes |
| Check digits | Machine readable zone | Detect misreads and tampering | Yes |
| Card access number (chip cards) | Front | Key for the wireless link to the chip | Yes |
| PIN for online ID | In your head | Releases data for online identification | No |
| Unblocking code | PIN letter | Resets a PIN blocked after three wrong tries | No |
| Cancellation password | PIN letter | Cancels the online function if the card is lost | No |
German law adds one more safeguard that is worth knowing. Section 5 of the Personalausweisgesetz, the ID card act, says the serial number and check digits must not contain any data about the holder or even hints of it. Under § 2(8) the number is a four-digit code for the issuing office followed by five randomly assigned characters, so the only thing it gives away is which office the card was applied for at. Your birthday, gender or tax number are not hidden in it. Not every country can say the same, so if your national ID number encodes personal data, treat it with a bit more care.
What can someone do with your ID number alone?
Very little. They cannot look it up anywhere. Germany goes as far as banning companies outright from using ID serial numbers in a way that allows automated retrieval of personal data or linking of files (§ 20(3) PAuswG). Only ID offices, police, intelligence services and tax and customs investigators may run automated queries, and only for narrow purposes such as checking whether a card was reported lost or stolen. We are not aware of a public document-number lookup in most other countries either, but we have not checked them all.
They also cannot open a bank account with it, at least not in Germany. Regulated identity checks there under the Money Laundering Act, whether at a bank counter, by video call or through a chip-based app, verify the document or the chip itself, not a number typed into a form (§ 12 GwG). Many everyday contracts, like buying on invoice or signing up for a subscription, never ask for an ID at all. For those, a scammer needs your name, date of birth and address more than your ID number.
Where a number does add risk is in combination with other details, and in places that verify badly. A support agent who accepts “name, date of birth and passport number” as proof of identity is the weak point, and a scammer who can recite all three sounds a lot more convincing on the phone. The SIM swap playbook often works along those lines.
| What a stranger has | What they can realistically do |
|---|---|
| Only your ID or passport number | Practically nothing on its own |
| Number plus name and date of birth, for example from a breach | More convincing phishing and phone scams, orders from shops that barely check |
| A photo of the front | Same as above, plus your face and often your address. Enough for services that only ask for an uploaded image. |
| Photos of both sides plus a selfie holding the ID | The package most useful for account and contract fraud |
| The physical card, without the PIN | Fooling people who glance at the photo. Chip-based online ID stays locked. |
| The card and the PIN | Online identification in your name, which is why you cancel it straight away |
What can someone do with a picture of your ID?
Here the honest answer changes. A clear photo of both sides puts your face, full name, date of birth, nationality, often your address and your signature into one file. That is close to what online identity checks look at.
Many banks, mobile carriers and crypto exchanges verify new customers remotely. Some use a live video call, where you hold the document up to the camera and tilt it so the holograms flash. Others ask for an uploaded photo and a selfie, and software compares the faces. Either way, the checks answer two questions: is the document real, and is the person in front of the camera the person on the document?
In August 2022 the Chaos Computer Club, Germany’s long-running hacker association, published a report by security researcher Martin Tschirsich. He had fooled six video identification products using open-source software and, in the club’s words, “a bit of red watercolour paint”. He combined video of several real ID cards into one fake image. The paint was there so his software could recognise his fingers, which these checks ask you to place over parts of the card. According to the report, the holograms were only checked for being in the right place, not for what they showed. The attacks went unnoticed. In his test he opened the electronic health record of a consenting volunteer and saw prescriptions and diagnoses. Shortly afterwards gematik, the company that runs Germany’s health IT infrastructure, suspended video identification across that infrastructure.
How well a given provider resists that kind of trick today depends on what it has fixed since 2022. The report still explains why scammers want front, back and selfie so badly. It is the exact set of material those checks examine.
The scams that collect it
Consumer advice centres in Germany keep seeing two patterns, and they look much the same elsewhere.
The fake job. The consumer advice centre in Schleswig-Holstein described a young man who applied for a side job. The “interview” ran over WhatsApp. Then the supposed HR manager wanted to open a payroll account for him and asked for photos of both sides of his ID plus a selfie holding it. He grew suspicious, others do not. A related version asks applicants to complete a video identification themselves, framed as a test of the process. In reality they open a real bank account in their own name, which then receives money from fake shops. Germany’s consumer advice network warns that victims can end up facing a money-laundering investigation. German law punishes even reckless failure to notice that money comes from a crime.
The flat that does not exist. The landlord is abroad and cannot show the apartment, but would like a copy of your ID by email first, and later a deposit for the keys. The advice from Germany’s Verbraucherzentrale is blunt: do not send it, because fraudsters can use your identity for illegal deals.
When the leak is someone else’s
Even if you never fall for any of that, copies of your ID already sit with banks, phone carriers, rental desks and age-verification services. They can leak too. In October 2025 Discord disclosed that attackers had broken into one of its external customer service providers. About 70,000 users may have had government ID photos exposed, images they had uploaded to appeal an age decision. According to The Guardian, the attackers then tried to extort the company.
You cannot prevent breaches like that. You can keep the number of copies small and make each one less useful. Whether your email address shows up in known breaches is easy to check. There is no equivalent tool for ID images.
How to share a copy of your ID safely
Start with whether a copy is needed at all. The rules differ by country and sector, but a pattern holds in most places. Firms bound by anti-money-laundering law, such as banks, brokers and life insurers, generally must record your document details and often keep a full copy. In Germany that duty is written into § 8(2) of the Money Laundering Act, and according to the data protection authority of North Rhine-Westphalia you generally cannot insist on redaction there. If you identify with the chip-based online ID instead, no copy is made. Most other businesses only need to see the document. German data protection authorities, for example, state in their guidance that at a viewing a landlord may look at a prospective tenant’s ID but making a copy is unnecessary and therefore not allowed. The regulator in North Rhine-Westphalia applies the same to signing the lease. That is the regulators’ view, not a statute or a court ruling, but they are the ones who handle complaints and can impose fines.
When you do send one:
- Ask for alternatives first. Showing the ID in person, or a chip-based digital ID where your country offers one, beats any copy.
- Redact what is not needed. The data protection authority of North Rhine-Westphalia lists the serial number, card access number, photo, height, eye colour, nationality and the machine readable zone as fields you may and should black out when only your name and address are needed. Use a fully opaque marker in your photo editor. With semi-transparent highlighters the text underneath can show through or be brought back with image editing.
- Watermark it. Write “COPY”, the recipient, the purpose and the date across the image, over the photo but not over the fields the recipient needs. A marked copy is much harder to reuse for anything else.
- Pick the channel yourself. Upload through the company’s own site or app, reached by typing the address yourself, not through a link someone sent you. Germany’s federal IT security agency BSI recommends handing over paper copies in person or sending them over encrypted connections.
- Delete it afterwards, from the phone and from the cloud backup.
| Situation | Copy reasonable? | Redact? |
|---|---|---|
| Opening a bank or brokerage account | Yes, usually required by law. In Germany not if you use the chip-based online ID | Usually not possible |
| Phone contract | Often. In Germany a copy is allowed but must be destroyed once the details are recorded | Yes, where allowed |
| Data access request to a company | Only if they have real doubts about who you are | Yes, name and address usually suffice |
| Renting a flat | Showing the ID is normally enough. German regulators say no copy, and the one in North Rhine-Westphalia says not even at signing | Do not send a copy |
| Hotel, bike or car rental | Sometimes, depending on the country. In Germany the North Rhine-Westphalia regulator says hotels and bike rentals may not copy it. Demanding your ID as a deposit is a different matter, and German law forbids it | Yes, if a copy is unavoidable |
| A recruiter, landlord or buyer who messaged you first | No legitimate reason | Do not send anything |
What to do if your ID is lost, stolen or a copy leaks
If the physical document is gone, report it to the issuing authority so it is marked invalid. In Germany that is a legal duty: you report the loss to your ID office, usually the local citizens’ office, without undue delay, and you can cancel the card’s online ID function round the clock by calling 116 116 (+49 116 116 from abroad) with the cancellation password from your PIN letter. Cancelling the online function does not replace reporting the loss. In the United States, a lost or stolen passport is reported with form DS-64, after which, as the form puts it, the passport is “electronically cancelled and cannot be used for travel”. If it was stolen, file a police report as well. It costs nothing and becomes your best evidence if someone later signs contracts in your name.
If only a copy is out there, nothing can be cancelled, because the number belongs to the document until it is replaced. Germany’s BSI suggests writing down when and where the copy went, so police can connect the dots if a fraud attempt surfaces. Beyond that:
| Step | Why |
|---|---|
| Note the date, recipient and channel of the copy | Lets investigators link a later fraud to the source |
| Freeze your credit where your country allows it | Blocks most new credit in your name. In the US a freeze at the three bureaus is free. |
| Check credit reports and bank statements for a few months | Spots unknown accounts or contracts early |
| File a police report if misuse appears | Backs up every dispute that follows |
| Replace the document if the case is serious | New number, the leaked copy no longer matches a valid document |
| Answer any debt collector in writing | As a rule you do not owe for a contract you never signed, but staying silent can still hurt you, for example with court payment orders that have short deadlines (two weeks in Germany) |
The short version
The number on your ID is closer to a file reference than a key. On its own it opens nothing, and in Germany the law explicitly forbids businesses from using it for automated lookups or for linking files. Typing it into a form that genuinely asks for it does not give away a secret.
The picture of the whole card is what deserves care, and the picture plus a selfie most of all. That combination is the raw material for account and contract fraud, and job and rental scams exist mainly to collect it. The defences are dull and effective. Show instead of copying where you can, redact where it is allowed, mark every copy with its purpose, send nothing to people who contacted you first, and keep the letter with your cancellation codes somewhere you will find it on a bad day. For the broader habit behind these choices, see what OPSEC is.
Sources: Chaos Computer Club, Chaos Computer Club hackt Video-Ident, 10 Aug 2022 · The Guardian, Hack of age verification firm may have exposed 70,000 Discord users’ ID photos, 9 Oct 2025 · German ID card act, § 1, § 2, § 5, § 10, § 20 and § 27 PAuswG · German Money Laundering Act, § 8 and § 12 GwG · German Criminal Code, § 261 StGB · German Telecommunications and Digital Services Data Protection Act, § 7 TDDDG · LDI NRW, Personalausweis und Datenschutz · Datenschutzkonferenz, Orientierungshilfe Mietinteressent:innen, 24 Jan 2024 · BSI, Der Personalausweis · Verbraucherzentrale Schleswig-Holstein, Datenklau mit falschen Jobs · Verbraucherzentrale, Fake-Wohnungen im Internet · U.S. Department of State, Form DS-64 · FTC, Credit Freezes and Fraud Alerts.
Frequently asked questions
- What can someone do with just my ID or passport number?
- On its own, very little. A document number identifies one physical card or booklet, not you as a person, and in Germany, our worked example, there is no public lookup that turns a number into a name. We are not aware of one in most other countries either, but rules differ. Where it matters is in combination: together with your name and date of birth it makes phishing and support-desk scams more convincing, and some weak verification processes ask for nothing more.
- Is it safe to send a picture of my ID?
- Only to someone you chose to deal with, for a purpose that genuinely needs it. A clear photo of both sides carries your face, name, date of birth, often your address and signature, which is most of what an account-opening check looks at. If you must send one, redact what the recipient does not need and write the recipient, purpose and date across the image.
- What can a scammer do with a selfie holding my ID?
- That combination is exactly what many online identity checks ask for, so it is the most useful thing a fraudster can collect. Job and rental scams request it for that reason. Treat any request for a selfie with your ID from someone who contacted you first as a red flag.
- Should I replace my passport if the number was exposed?
- Usually not because of the number alone. If the physical document was lost or stolen, report it so it is cancelled. If only a copy leaked, the more useful steps are watching your bank and credit activity, freezing your credit where that is possible, and keeping a record of when and where the copy went.
- What can a business legally keep from my ID?
- It depends on the country and the sector. Banks and other firms bound by anti-money-laundering rules are usually required to record your document details and often keep a full copy. In Germany they have both the right and the duty to copy or scan the ID when they identify you under that law. Many other businesses only need to see the ID and note your name. In Germany, for example, the data protection authorities say in their guidance that a landlord may look at your ID but should not copy it. That is their view, not a statute or a ruling.
- What should I do if my ID is lost or stolen?
- Report it to the issuing authority so it is marked invalid, file a police report if it was stolen, and disable any digital or online functions tied to it. Then watch for new accounts or contracts in your name over the following months. A police report is the strongest evidence you have if someone later uses your identity.
Continue reading
Grocery loyalty programs: what your rewards card really records
Grocery loyalty programs trade discounts for data. What the Kroger privacy notice says is collected, who it is shared with and how to opt out.
Is ChatGPT Private? What Happens to What You Type
Is ChatGPT private? What gets stored, who may read it, when chats are used for training, and which settings in ChatGPT, Gemini, Claude and Copilot matter.
Is my phone listening to me? Why the ads still feel too accurate
Is my phone listening to me? What researchers and the FTC actually found, why the ads still match your conversations, and the settings that make a difference.