How to keep ID and passport scans private on your phone

A scan of a passport or ID is one of the most useful files a thief can find. It has your name, date of birth, number and photo in one place, and some services accept it as proof of who you are. Most of us took the scan for a good reason and then forgot about it.

Where scans end up without you noticing

• Your photo library. Photographing a document puts it beside your holiday pictures. It then shows up in search and slideshows, and anyone you hand your phone to may scroll past it.
• Cloud photo sync. If photo backup is on, the scan is uploaded to your account. That is fine if the account is well protected, but it is now in a second place.
• Chat downloads. Documents you send or receive in chats are often saved to your gallery or downloads automatically.
• Email. Sent items, drafts and attachments sit in your mailbox for years.
• Scanner and camera apps. Some keep their own history of scans, in the cloud or on the phone.
• Screenshots and shared albums. One careless share sends it to a whole group.

Keep fewer copies

1. Search for the scan. Look in your photo library, downloads folder, email and chats for ID, passport, license and card scans.
2. Pick one place to keep it, if you need one at all.
3. Delete the rest, and empty the deleted folder so they are gone for good.
4. Turn off automatic saving of chat media to your gallery for chats where documents are shared.

Where to keep the one copy

• An encrypted vault that is locked behind its own PIN, with no cloud sync that you didn’t choose.
• A password manager that accepts attachments, protected by a strong master password.
• An encrypted file on a drive you control, with the passphrase kept separately.

Avoid: the photo library, a notes app, email to yourself, and any shared or synced folder you don’t fully control.

Keep the original, and know what a scan can’t do

A scan is a convenience, not a document. Many offices, border officers and banks need the original. Keep the physical passport and ID in a safe place, and don’t throw away an original because you have a scan. Know where the document number is, and keep it separate from the scan, since it is what you need to report a loss.

Also check what a scan can’t do: it may not be valid for official purposes, and some services accept only live capture.

When not to keep a scan at all

• You sent it for a single purpose, such as a rental application or a hotel booking, and it is done.
• You can show the original when needed, or retrieve the document from the issuer later.
• The only reason is “just in case”. A scan you don’t have can’t be stolen.

When you do need to send a scan

• Send it only to someone you have contacted yourself, using the official channel.
• Write the purpose and the date across the copy, so it can’t be reused unnoticed.
• Cover or crop out numbers the other side doesn’t need.
• Prefer a secure upload on the organization’s own site over email.
• Ask how long they keep it, and whether they delete it.

Remember that a photo also contains hidden data, such as the place it was taken. See how to remove location from photos.

Using Silo for scans

Silo can hold a scan behind your PIN or passphrase. Imported photos are encrypted on the phone, and with verified import you can then remove the original from your photo library, so the scan is not left sitting there. Files of any kind, such as a PDF of a passport, are a Pro feature. If you remove the originals, remember that your phone keeps removed photos in its own deleted folder for a while, so empty that too. You can export any item later.