Identity fraud

Shared a copy of your ID? How to recognise identity fraud

A landlord who wants a copy of your passport “for the file”, a new employer asking for an ID scan before there is a contract, or a marketplace buyer who wants to see your identity document to “verify” you: a copy takes seconds to make and cannot be taken back. The Dutch government states the consequence plainly: with a copy of an identity card carrying your name, date of birth and citizen service number (BSN), fraudsters can apply for a loan or take out a phone subscription, and you receive the bills for things you never bought (Rijksoverheid, fraud with a copy of your identity document).

The Dutch Fraud Helpdesk describes how victims usually find out: not while sharing, but through unexplained invoices, a loan that turns out to be registered in their name at the credit register, or because they are themselves accused of fraud (Fraudehelpdesk). So this is not a scam-message pattern to spot; it is a data decision followed, sometimes, by a clean-up.

Direct answer: five checks before you share a copy

1. Ask why the copy is needed, and whether something smaller will do. The organisation asking for a copy is required to explain why it is necessary or on which legal obligation it rests. Often the type of document plus the document number is enough, for example “passport, NWLFR3706” (Rijksoverheid).
2. Make a safe copy instead of a full scan. Make the BSN unreadable, including the number string at the bottom, write on the copy that it is a copy, which organisation or product it is for and the date you hand it over. The government's KopieID app does exactly that (Rijksoverheid).
3. Never send an ID copy to a private individual or through a link. When buying or selling: never send a copy of your ID. Government bodies never ask for an ID copy or bank details through a link they sent you (RvIG, Central Identity Fraud Reporting Point).
4. Share nothing before the counterparty is established. A copy belongs with a contract or a procedure you verified yourself, not with the phone number or link that asked for it.
5. Record what you shared and when. Keep a line per copy: to whom, which organisation, which date, which channel, which version of the document. That record is the only way to show later where a copy ended up.

Why a copy is more than a photo

An identity document carries exactly the combination needed to pass as you: name, date of birth, document number and often the BSN. The consequences named by the Rijksoverheid are concrete: a loan or a phone subscription in your name, and bills that arrive with you. The Fraud Helpdesk adds that victims can also be treated as the fraudster once their data has been used (Fraudehelpdesk).

That makes the trade-off different from a password: a password can be changed, a copy that has been handed over cannot. You can only limit what it contains, who receives it, and how fast you report it when something goes wrong.

What AI changes here

A copy no longer has to come out of a real printer. A generator plus basic image editing produces a passport or ID image that holds up as a screenshot, and a matching generated “assignment letter” or “landlord statement” costs almost nothing either. What the recipient sees is a tidy image with no mistakes, which is exactly the problem: image quality says nothing about whether the document belongs to an existing person and an existing organisation. The check therefore moves to the organisation and the purpose: does the party exist, and is there a real procedure that needs this copy?

What a detector does and does not see

If you are sent an ID scan, a landlord statement or an employer letter, you can run the image through the image detector and the text through the text detector. That is triage: it tells you which document to verify first and gives you a note for a report. It says nothing about authenticity. A genuine document can draw a signal from compression or a screenshot, and a fully invented document can stay silent.

What a copy or scan cannot tell you

• whether the person on the document is the person you are dealing with;
• whether the organisation asking for it exists and genuinely needs these data;
• whether a copy you received is stored, resold or used anywhere;
• whether fraud has already happened; that shows up in invoices, registrations and reports, not in the document.

Treat a request for a copy as a data decision, not a formality.

If you have already shared a copy

• Report it to the Central Identity Fraud Reporting Point (CMI) at RvIG; you receive an immediate acknowledgement and the CMI advises on next steps and can mediate with partners such as the police, the RDW (vehicle authority) or the tax administration (RvIG).
• File a police report when your data has been used. Without a report the police cannot start an investigation and you cannot recover the damage from the perpetrator or the insurer (Rijksoverheid).
• Tell your bank. If invoices or collection letters arrive for something you never took out, do not pay the collector and ask the company for the original application documents; a copy is not a valid identity document (Rijksoverheid).
• Collect evidence: bank statements, letters, applications, and your own record of what you shared and when. That record is what makes a report concrete.
• Check your credit register entry and your subscriptions, and ask for a replacement document rather than waiting for something to go wrong.

Related guides: spotting a fake job offer, avoiding the money-mule recruiter, spotting a fake debt collection letter and the fake buyer and courier trick. To check a file or a piece of text on its own, use the free checker.

Frequently asked questions

Is a copy of my passport the same as handing over my passport?

No, and that difference is exactly why a copy is so usable: you keep the document, but the data travels on its own. A copy is not a valid identity document, yet it carries the details someone needs to use your identity.

May a landlord or employer ask for a copy of my ID?

Sometimes, but the organisation must be able to explain why the copy is necessary or which legal obligation requires it. Ask, and provide a safe copy with the BSN masked instead of a full scan.

Does a high detector score prove an ID scan is fake?

No. The score describes patterns in an image or a text and says nothing about whether the document belongs to a real person or organisation. A genuine scan can draw a signal from compression and an invented document can stay silent.