What to do if…
you are asked to send passport or ID scans over an insecure channel urgently

What to do now

1. Verify the requester independently. Use the employer’s official website, official staff directory, or main company number. Ask to be connected to HR, onboarding, or security. If a recruiter or outside vendor contacted you, confirm the request with the employer directly.
2. Ask what the documents are for. Ask whether the request relates to Form I-9, a background check, building access, or another named process.
3. If it is for Form I-9, keep your document choice open. For Form I-9, an employer cannot specify which acceptable document or combination of documents you must present. Ask for the official instructions and choose from the acceptable options.
4. Ask for the approved secure method. Request the employer’s secure HR portal, an approved document-verification process, or physical document examination. Ask for a short extension if the secure option is not immediately available.
5. If remote Form I-9 examination is offered, check the process. The optional DHS-authorized alternative procedure is for qualified E-Verify employers in good standing. It includes sending copies of the documents, including the front and back when a document is two-sided, presenting the same documents during a live video interaction, and the employer retaining clear, legible copies. If you are unable or unwilling to send copies this way, ask for physical document examination.
6. Keep a brief record. Save the request and note who you contacted, what process was confirmed, and whether you sent anything.
7. If you already sent documents to an unverified or wrong recipient, contain the exposure. Tell the employer’s verified HR or security contact and ask the organization to investigate, limit access where possible, and explain its next steps. If the documents may have reached a scammer or unauthorized recipient, use IdentityTheft.gov and consider whether a credit freeze or fraud alert is appropriate.