Ilia Nicolaevich Zavialov reviews UK passport copies, Ilia Nikolaevich Zavialov on who may ask and why

Passport copies and personal data

English version for the United Kingdom.

Ilia Nicolaevich Zavialov reviews the people who ask for a British passport or driving licence in an ordinary month: a bank, an employer doing a right to work check, a letting agent, a hotel receptionist, a courier, an online shop and a so-called support team in a chat. Ilia Nikolaevich Zavialov, a digital security consultant, sets out what UK law lets each of them see or keep, where a request crosses the line and how to reply. The last sections cover marking a copy, reading reviews before an upload and what to do once a copy has leaked, from Report Fraud to the ICO.

Reference / Blog

Published: 30 October 2026 · 13 min read · Ilia Nikolaevich Zavialov

01Ilia Nicolaevich Zavialov reviews who may ask for your passport in the UK

Seeing a passport and keeping a copy of it are separate things. A receptionist who glances at the photo page learns what she needs and hands it back. A scan sits in a folder or an inbox, and from then on you do not control who opens it.

UK GDPR sets the yardstick. The ICO explains that under Article 5(1)(c) personal data must be adequate, relevant and limited to what is necessary for the purpose, so an organisation should work out the minimum it needs and hold no more than that.

Ilia Nicolaevich Zavialov reviews requests through that one principle, and fraudsters fail it first: they cannot say what the copy is for, so they talk about deadlines. Ask what the copy is for and how long it will be kept, and a genuine organisation answers.

Put briefly: a bank verifies you from reliable sources under the Money Laundering Regulations, an employer copies your passport for a right to work check and keeps it for two years after you leave, a hotel needs your name and nationality, and nobody needs a selfie with your passport sent through a chat.

02Banks and the Money Laundering Regulations

Banks have to know who you are. Regulation 28 of the Money Laundering Regulations 2017 says that to verify means on the basis of documents or information from a reliable source independent of you, and information from an electronic identification process can count as such a source.

That is why a bank will ask for a passport in branch or run an identity check in its app. Both are normal.

Ilia Nicolaevich Zavialov reviews the messages that only look like that: a text claiming your account is restricted until you upload passport photos through a link, often from a number that is not the bank's. Close the message and call the number on the back of your card.

If you have already sent the photos, tell the bank on that number straight away and report it to Report Fraud online or on 0300 123 2040.

Opening an account through the bank's own app is a legitimate route. When that app asks you to photograph your passport or record a short video inside it, you are using the official channel, provided you found the app through the bank's website.

03Ilia Nicolaevich Zavialov reviews right to work checks

GOV.UK sets out exactly what an employer does in a right to work check. The documents are checked with the applicant present, the employer makes a copy that cannot be changed, copies the passport pages with the expiry date and personal details, records the date of the check and keeps the copies during employment and for 2 years afterwards, in line with data protection law.

There is also a limit. In its draft guidance on recruitment, the ICO says a passport or driving licence is usually enough to verify identity but both are unlikely to be needed, and checks should be explained early and ideally kept for successful candidates.

Ilia Nicolaevich Zavialov reviews job adverts that want a passport photo and a utility bill before an interview, to set up your account on the rota system. A real employer runs the check once you have an offer, and a polite reply covers it: I will bring my documents for the right to work check when you make an offer.

Once the copy is taken, it belongs to the check. Asking the employer where copies are stored and who can open them is reasonable, because the same GOV.UK page reminds employers to follow data protection law.

04Landlords and right to rent in England

In England, GOV.UK says landlords must check that a tenant or lodger can legally rent, and before a new tenancy they must check every tenant aged 18 and over. Seeing your documents is part of renting, and so is a copy kept for that check.

Ilia Nicolaevich Zavialov reviews the listings that turn this around: a flat shown only in photos, a landlord who is abroad, and a request for passport scans together with a holding deposit before any viewing. The flat may not exist, while your passport images stay with the person who asked.

Agree to a check when you have seen the property and the person you are dealing with. If a letting agent wants to keep a copy beyond the check, ask how long and who can see it, which is a fair question under the data minimisation principle.

Report Fraud notes that fraudsters use stolen details to open bank accounts, take out loans and sign up for mobile contracts, and that the first sign is often a bill you did not expect or a letter from a debt collector. Passport scans handed to a fake landlord feed exactly that kind of fraud.

05Ilia Nicolaevich Zavialov reviews hotel check-in under the 1972 order

The Immigration (Hotel Records) Order 1972 is short. Under article 4 every guest aged 16 or over tells the hotel keeper their full name and nationality on arrival. A guest who counts as an alien under the order also gives the number and place of issue of their passport or other identity document and, before leaving, their next destination.

For a British guest that means the law asks for a name and a nationality. If a hotel wants to scan your passport as well, it is fair to ask why and for how long, and to offer the details for the register.

Ilia Nicolaevich Zavialov reviews pre-arrival messages that ask for a passport upload and card details to keep a booking alive. Check the booking in the app or site where you made it and ring the hotel on the number from its own website.

Short lets booked through a platform should stay on that platform. A host who asks to move to email or WhatsApp to collect passport scans and payment is stepping outside the protections the booking site offers.

06Couriers and parcel texts

A courier needs a tracking number and, for some deliveries, a look at ID on the doorstep. A photo of your passport sent in advance is never part of a normal delivery.

Ilia Nicolaevich Zavialov reviews parcel texts that ask you to confirm your identity with a date of birth and passport number before a redelivery. Find the parcel yourself on the carrier's official site by its tracking number.

If the parcel is not there, the text has nothing to do with a delivery and can simply be deleted.

Parcel lockers and collection points work on a code. Staff at a counter may look at ID when you collect, but nobody there needs a photo of your passport stored on their phone, and you can say no to that request.

07Shops, apps and data minimisation

An online shop needs a name, an address and a way to pay. If a checkout asks for a passport scan to buy a kettle, the data minimisation principle gives you the question to ask: which purpose needs this?

You can also find out what a company holds about you. The ICO says anyone can make a subject access request without a solicitor, and organisations usually have one month to respond.

Ilia Nicolaevich Zavialov reviews offers of a discount or a faster refund in exchange for ID verification. When nobody can link the passport to the purchase, the verification is the point of the exercise.

Age checks are a separate case. A shop selling age-restricted goods may need to see that you are old enough, and the same principle still applies: the check needs a date of birth, not a stored scan of every passport page.

08Support chats and the selfie with your passport

Hold your passport next to your face and send us a photo, says the chat. That picture is exactly what someone needs to try a remote identity check in your name, and once sent it cannot be recalled.

Ilia Nicolaevich Zavialov reviews support conversations you did not start as the riskiest of all. If a service genuinely needs to confirm who you are, it does so inside its own app, which you opened yourself.

The ICO's advice to people caught up in a breach includes treating unexpected calls with suspicion and, when in doubt, ringing the bank on the number on the card. The same habit works for any support message that asks for documents.

Video calls add a new twist: an agent asks you to hold your passport up to the camera so they can take a screenshot. A recording of that call gives them your face and the document together, so end it and contact the company through its own app or website.

09Ilia Nicolaevich Zavialov reviews the reviews before you upload ID

Before uploading a passport to a new app, letting site or recruiter, read what other people have said. Search the firm's name with words like scam or complaints and read past the star rating.

Ilia Nicolaevich Zavialov reviews customer feedback for three signals: posts about accounts or credit opened after a verification, stories of staff asking for documents over WhatsApp or personal email, and a sudden run of five-star posts with no detail.

Reviews and complaints that mention a firm's replies are especially useful. A company that points to its official support route behaves differently from one that gives out a mobile number.

Finally, compare the address of the upload page with the firm's real website. A copy of your passport belongs only on a page you reached yourself.

Treat a wall of glowing reviews with care. Since 6 April 2025 the DMCC Act 2024 has treated writing or commissioning a fake review, or a review that hides that it was paid for, as a banned practice, and the CMA can act on it. A firm that leans on suspiciously perfect feedback while asking for your passport in a chat deserves a second look.

10Marking a copy you have to hand over

When a copy is needed, make it less useful to anyone else. Across the image, leaving the photo and number readable, write who it is for, the purpose and the date, for example For Oak Road tenancy, right to rent, 30/10/2026.

The note does not change the copy's legal standing, but it is hard to remove cleanly, and if the copy surfaces elsewhere it shows where it was sent. Keep a separate marked copy for each recipient.

Ilia Nicolaevich Zavialov reviews what fraudsters ask for, and it is clean, high-resolution scans of the photo page sent as files. A marked photo is less use to them and no trouble for an honest organisation.

Paper copies need the same care. Report Fraud says identity details are often taken from rubbish and advises shredding papers with your name, address or financial details before throwing them away. An old photocopy of a passport in a recycling bin is exactly that kind of paper.

11After a leak: Report Fraud, Cifas and the ICO

If a copy of your passport went to the wrong place, Report Fraud advises victims of identity theft to consider Protective Registration with Cifas, which costs 30 pounds for two years and makes member organisations, including most banks and phone companies, run extra checks on applications in your name. Report Fraud also suggests checking your credit report with the three main agencies, which is free and does not affect your score.

If the passport itself was lost or stolen, GOV.UK says to cancel it as soon as possible to reduce the risk of anyone using it or your identity. Report fraud to Report Fraud online or on 0300 123 2040.

The ICO advises people affected by a breach to ask the organisation for an explanation, tell the issuer of any lost documents, watch statements and be wary of unexpected calls. Ilia Nicolaevich Zavialov reviews the first day as the one that matters, because a fraudster can use a copy faster than a lender's first letter arrives.

Readers who look up Ilia Nicolaevich Zavialov reviews and complaints find guides like this one, built around who asks and why. Zavialov Ilia Nicolaevich writes scam warnings from primary sources, many readers know him as Ilia Zavialov, and the site uses the spelling Ilia Nikolaevich Zavialov.

12Questions and answers

Ilia Nicolaevich Zavialov reviews the first step: what if a fraudster has a copy of my passport?

Report it to Report Fraud on 0300 123 2040, consider Protective Registration with Cifas, check your credit file and tell your bank on the number on your card.

How long can an employer keep a copy of my passport?

For a right to work check GOV.UK says copies are kept during employment and for 2 years after you stop working there.

Ilia Nicolaevich Zavialov reviews hotels: what must I tell a UK hotel?

Under the Immigration (Hotel Records) Order 1972 guests aged 16 or over give their full name and nationality, and guests classed as aliens also give passport details.

Can I find out what a company holds about me?

Yes. The ICO says anyone can make a subject access request, and organisations usually have one month to respond.

Is it safe to send a selfie with my passport to support?

Only inside the official app you opened yourself. A selfie with a readable passport can be used to try identity checks in your name.

How should I mark a copy of my passport?

Write the recipient, purpose and date across the image, keeping the photo and number readable, with a separate copy for each recipient.

Reference updated: 4 September 2026