Sending a photo of your licence or passport in Australia: when it is safe and when to say no
Send a photo of your licence or passport only to an organisation you have checked independently, only when seeing the original or a digital check will not do, and only the documents it is entitled to ask for. The Australian Passport Office’s advice is to never share photos of your passport online and to ask any organisation what it will do with your details.
Three questions before you send anything
Who is asking, confirmed how? The Australian Passport Office warns that scammers pose as trusted agencies, including the Department of Foreign Affairs and Trade, and ask you to upload an identity document. If a message or call surprises you, hang up or close it and contact the organisation through details you find yourself.
Prepare a safer copy, free. Once you have verified a legitimate request and confirmed that an edited copy is accepted, hide unnecessary details and add a watermark naming the recipient and date. Both tools run in your browser without uploading the document. Keep all required fields readable.
Do they need a copy, or would seeing it do? The OAIC’s ID scanning guidance says an organisation covered by the Privacy Act should not scan your ID if sighting it would be enough, must tell you why it needs a scan, and must destroy or de-identify the scan once it no longer needs it.
Which documents may they ask for? Often fewer than they request:
| Situation | What the official guidance says |
|---|---|
| Renting in Victoria | No more than two identity documents from a set list, and no fee from anyone, rental platforms included, for applying or for identity checks. |
| Renting in Queensland | Up to two identity documents; you can show the original instead of a copy, and a copy is kept only with your consent. At least one way to apply must not be restrictive, such as email to the agent. |
| Renting in NSW | Best practice is to sight your ID and note what is needed, without storing it. |
| Starting a job | The ATO lists your employer, once you start work, among those with a legitimate reason to ask for your tax file number. A visa holder can prove work rights through VEVO; a citizen can show an Australian passport or citizenship certificate. |
| Pub or club ID scanner | A venue covered by the Privacy Act scans only when reasonably necessary, for example under liquor licensing laws, and must tell you why. |
If you do send a copy, make it a narrow one
- Use the organisation’s own portal or an address you have checked, opening it independently instead of following an unexpected link. A portal can avoid extra attachments in chats or inboxes. A verified email address does not remove copies in inboxes or backups; either way, the recipient still controls storage and access.
- Send only the documents and sides asked for.
- When the recipient accepts an edited copy, hide numbers it does not need and watermark the copy with its name, purpose and date, such as "Banksia Rentals Pty Ltd, rental application, 18/10/2026". Cover repeated data in the machine-readable lines too, as the fictional passport shows. Some official checks require an unaltered copy.
- Ask how long they keep it: a covered organisation must destroy or de-identify the copy once it no longer needs it.
Redaction can limit what a copy reveals, while a watermark shows who it was for. The mark can be edited or removed and does not prevent identity fraud. An official channel also does not eliminate risk. A document photo can help a fraud attempt, but it does not guarantee that a verification check will succeed.
If a copy reached the wrong person
- Call IDCARE, the national identity and cyber support service, on 1800 595 160 for a free response plan.
- Report it through ReportCyber at cyber.gov.au, and to Scamwatch if a scam was involved. The Australian Cyber Security Centre’s hotline is 1300 CYBER1 (1300 292 371).
- Tell your bank, check your credit report and consider a credit ban.
- Contact the agency that issued each exposed document: your state licence issuer, the Australian Passport Office, or Services Australia’s Scams and Identity Theft Helpdesk if the scammer posed as myGov, Centrelink or Medicare.
- If someone has used your identity, ask the police for a report number and consider a Commonwealth Victims’ Certificate, which helps you reset your details with agencies and banks.
Where Dokus helps
Dokus keeps your documents encrypted on your iPhone and can make a separate copy with selected details hidden and a watermark for its recipient and date, while preserving the original. It cannot vouch for the person asking or recall a sent copy. For the loose copies already on your phone, see how to lock document copies on iPhone.
Common questions
Can a real estate agent ask for my passport, licence and Medicare card all at once?
In Victoria an agent can request no more than two identity documents from a set list, and in Queensland up to two documents to prove identity. In NSW, Fair Trading guidance calls sighting the original without storing it best practice. Elsewhere, ask which single document would do.
Can a pub keep a scan of my licence?
The OAIC says a venue covered by the Privacy Act may scan your ID only when it is reasonably necessary, must tell you why and what happens if you refuse, and must destroy or de-identify the information once it no longer needs it.
I sent my passport photo to a scammer. Will my passport be cancelled?
Not automatically. The Passport Office says a passport number cannot be used by someone else to get a new passport, and that you can keep using an exposed passport, replace or renew it, or ask for it to be cancelled. Call IDCARE on 1800 595 160 for a plan.
Does a watermark prevent identity theft?
No. It makes the intended use visible and may discourage reuse, but someone can edit the image or copy details that remain visible. Verify the recipient, share only the required information and confirm that an edited copy is accepted before sending it.