Is it safe to send a photo of your NRIC in Singapore?
Send an NRIC, FIN card or passport photo only through a verified process with an explained need for the copy. An NRIC number is personal data and an identifier, but knowing it does not prove someone is you or make an unexpected caller trustworthy.
Separate identification from account access
A hospital may need to identify the right patient, and a bank, employer or mobile provider may need identity information for its service. That does not make every request for a full NRIC image necessary. Ask what the organisation needs to establish, why a copy is required and whether its official verification flow offers an alternative.
MDDI explains that NRIC numbers remain personal data. Knowing a number alone should not let someone access an account or approve a transaction. A caller who can quote yours has not proved that they are a bank employee or government officer.
| What you are being asked to do | What to check |
|---|---|
| Submit an NRIC or FIN card image | Verify the organisation and its reason for the copy; confirm the fields and sides it needs. |
| Complete an identity check in an app | Open the real app yourself. Check the named service and what you are authorising before continuing. |
| Give an NRIC number as an account password | Request a different authentication method and change any password of your own based on that number. |
| Send Singpass credentials or approve an unexplained request | Stop. Verify the request independently before giving access or authorising disclosure. |
| Respond to a threatening government investigation message | Contact the agency using its published details. A logo or knowledge of your NRIC does not validate the message. |
The February 2026 MDDI update says private organisations have until 31 December 2026 to phase out NRIC numbers for authentication, with stepped-up PDPC enforcement from 1 January 2027. It also explains that moving away from partial NRIC numbers in the public sector does not mean full numbers should be used for everything. Do not treat showing only the last four characters as a guarantee that the full number cannot be inferred.
Limit the copy and use the right channel
- Find the organisation's official website or app independently. Confirm an unexpected request through a published contact rather than replying to its sender.
- Ask why the image is needed instead of sighting the card or another supported check. Ask which fields must be visible, who can access the copy and how long it will be held.
- If the recipient accepts modifications, redact unnecessary information and add a recipient, purpose and date watermark, such as "Acme Services, application verification, 21 October 2026". Inspect both sides and any repeated information.
- Submit only through the confirmed process. Do not attach account passwords, OTPs or recovery codes. A legitimate selfie check should be part of the independently verified service, not an unexplained extra demand in a chat.
- Keep a record of the disclosure and delete spare exports you no longer need.
Some checks require a complete, unmodified document. A watermark may be removed or bypassed and does not stop identity fraud. A document photo is more information than a number alone, but neither exposure automatically proves that an account has been opened in your name.
MDDI's guidance on stored ID scans says retention must cease when the personal data is no longer needed for legal or business purposes. That can include record-keeping requirements, so do not assume every organisation must delete an image immediately after the check.
If you have already shared your NRIC photo
Preserve messages, website addresses and the details of what you sent. Stop further disclosure. Notify your bank immediately if you disclosed banking information, see unfamiliar activity or lost money. Report suspected fraud to the police through the official police reporting service.
If your Singpass may also be compromised, use Singpass's current recovery instructions: reset the password, review transaction history and follow its steps to secure your account and trusted device. Its guidance gives the helpdesk number as +65 6335 3533, and explains account suspension for scam victims. Do not assume a document-only disclosure means your Singpass password was exposed, but check for unexpected authorisations and alerts.
For help deciding whether a request is a scam, the CSA lists the ScamShield helpline at 1799. For an organisation's handling of personal data, raise the issue with its data protection officer and, where appropriate, PDPC. Recovery steps depend on what was disclosed and whether it has been misused.
Dokus can help organise originals and sharing copies. It does not issue NRICs or other official documents, verify a requester or recall an image after sending.
Common questions
Is sharing my NRIC number the same as sharing a photo of the card?
No. A card image contains additional personal information. Both deserve care, but knowing a number alone should not authenticate a person or authorise account access. Confirm why an image is needed and disclose only what the verified process requires.
Can an organisation keep an NRIC scan?
Retention depends on the purpose and applicable obligations. MDDI says organisations must stop retaining personal data when no longer needed for legal or business purposes. Ask for the reason and retention period rather than assuming all scans are forbidden or all retention is justified.
Is it safe to reveal only the last four characters?
That is not a guarantee of secrecy. Government guidance warns that full NRIC numbers can be inferred from partial numbers and that partial numbers can fail to identify someone uniquely. Ask whether the number is needed at all and use proper account authentication.
Should I send a selfie with my NRIC?
Only as part of an independently verified service's actual identity check. Do not follow an unexplained chat request or grant Singpass access simply because someone calls it verification. Check the service and the information or action you are authorising.
What if I shared both my ID and Singpass information?
Contact your bank promptly if financial accounts or money are involved, follow the official Singpass account recovery steps and report suspected fraud to the police. Reset compromised credentials and inspect your Singpass history for unfamiliar activity.