Sending a photo of your licence or passport in Australia: when it is safe and when to say no
Send a photo of your licence or passport only to an organisation you have checked independently, only when seeing the original or a digital check will not do, and only the documents it is entitled to ask for. The Australian Passport Office’s advice is to never share photos of your passport online and to ask any organisation what it will do with your details.
Three questions before you send anything
Who is asking, confirmed how? The Passport Office warns that scammers pose as trusted agencies, including the Department of Foreign Affairs and Trade, and ask you to upload an identity document. If a message or call surprises you, hang up or close it and contact the organisation through details you find yourself.
Do they need a copy, or would seeing it do? The OAIC says an organisation covered by the Privacy Act should not scan your ID if sighting it would be enough, must tell you why it needs a scan, and must destroy or de-identify the scan once it no longer needs it.
Which documents may they ask for? Often fewer than they request:
| Situation | What the official guidance says |
|---|---|
| Renting in Victoria | No more than two identity documents from a set list, and no fee from anyone, rental platforms included, for applying or for identity checks. |
| Renting in Queensland | Up to two identity documents; you can show the original instead of a copy, and a copy is kept only with your consent. At least one way to apply must not be restrictive, such as email to the agent. |
| Renting in NSW | Best practice is to sight your ID and note what is needed, without storing it. |
| Starting a job | The ATO lists your employer, once you start work, among those with a legitimate reason to ask for your tax file number. A visa holder can prove work rights through VEVO; a citizen can show an Australian passport or citizenship certificate. |
| Pub or club ID scanner | A venue covered by the Privacy Act scans only when reasonably necessary, for example under liquor licensing laws, and must tell you why. |
If you do send a copy, make it a narrow one
- Use the organisation’s own portal or an address you have checked, not a link that arrived with the request.
- Send only the documents and sides asked for.
- Hide numbers the recipient does not need and watermark the copy with its name, purpose and date, such as "Banksia Rentals Pty Ltd, rental application, 13/10/2026".
- Ask how long they keep it: a covered organisation must destroy or de-identify the copy once it no longer needs it.
Neither mark nor redaction makes a copy safe in the wrong hands; they limit what it reveals and show who it was for.
If a copy reached the wrong person
- Call IDCARE, the national identity and cyber support service, on 1800 595 160 for a free response plan.
- Report it through ReportCyber at cyber.gov.au, and to Scamwatch if a scam was involved. The Australian Cyber Security Centre’s hotline is 1300 CYBER1 (1300 292 371).
- Tell your bank, check your credit report and consider a credit ban.
- Contact the agency that issued each exposed document: your state licence issuer, the Australian Passport Office, or Services Australia’s Scams and Identity Theft Helpdesk if the scammer posed as myGov, Centrelink or Medicare.
- If someone has used your identity, ask the police for a report number and consider a Commonwealth Victims’ Certificate, which helps you reset your details with agencies and banks.
Where Dokus helps
Dokus keeps your documents encrypted on your iPhone and makes a fresh, marked copy each time you share, so the original never travels. It cannot vouch for the person asking or recall a sent copy. For the loose copies already on your phone, see how to lock document copies on iPhone.
Common questions
Can a real estate agent ask for my passport, licence and Medicare card all at once?
In Victoria an agent can request no more than two identity documents from a set list, and in Queensland up to two documents to prove identity. In NSW, Fair Trading guidance calls sighting the original without storing it best practice. Elsewhere, ask which single document would do.
Can a pub keep a scan of my licence?
The OAIC says a venue covered by the Privacy Act may scan your ID only when it is reasonably necessary, must tell you why and what happens if you refuse, and must destroy or de-identify the information once it no longer needs it.
I sent my passport photo to a scammer. Will my passport be cancelled?
Not automatically. The Passport Office says a passport number cannot be used by someone else to get a new passport, and that you can keep using an exposed passport, replace or renew it, or ask for it to be cancelled. Call IDCARE on 1800 595 160 for a plan.
