A new client is asking for your ID. Should you send it?

What is the company doing:

• Identity verification?
• KYC?
• Contractor screening?
• Complying with a legal requirement?

If the answer boils down to “we need it for verification” without any details, that’s not enough. For U.S. clients, it’s also important to distinguish between tax documentation and identification documents. In particular, a foreign individual who receives certain types of income from U.S. sources may file Form W-8BEN to confirm their foreign status and, under certain conditions, their eligibility for a reduced tax rate or exemption from withholding tax. This doesn’t mean that every U.S. client has the right to demand a passport scan simply because they are paying you for your work.

In addition to the document, check the request itself

Even a legitimate company can be used as a front for fraud. You should be especially cautious if the request includes an urgent demand to sign a doc or click on a specific link. Phishing schemes can exploit legitimate electronic document management services. A fraudulent email may look like a standard request to sign a file, containing a button to view the file or a QR code. Once you click the link, you may be asked to enter your login credentials or provide personal details. Even a message that technically goes through a genuine platform doesn’t guarantee that the actual document or request is legitimate. That’s why a guide to spotting fake document requests is extremely useful when a new client sends you a file through an unfamiliar workflow. It’s important to check not only the sender’s address but also whether you were expecting this document and whether its content matches your actual agreements. You should also check if the message contains any unusual requests for financial or identification details. This verification helps you move on to the next question: Does the client really need a copy of your ID?

Verify who exactly is asking for your ID

Make sure you’re communicating with a representative of the very company you agreed to work with. Check the sender’s name, email domain, the company’s website, and previous correspondence. If a client suddenly switches from a corporate email address to a different one or asks you to upload your ID to an unfamiliar website, that’s a reason to pause.

It’s even safer to verify the request through an independent channel. Specifically, contact the company through its official website.

The FTC advises asking specific questions before sharing sensitive information:

• Why is it needed?
• How will it be protected?
• Can another form of identification be used?

Ask where and how the document will be stored

• Who will have access to the document?
• How long will it be stored?
• Is a specialized system used for identity verification?

If you’re asked to simply attach your passport to a regular email, you can request a more secure method of transmission.

It’s especially concerning when someone asks you to send your ID along with your bank details, a verification code, or other account credentials. An identity verification document and credentials for accessing an account are completely different categories of data. A legitimate identity verification process shouldn’t automatically turn into a request for all your data at once.

• The client cannot explain the purpose of the verification.
• They insist on urgency.
• The client uses a suspicious domain.
• They ask you to upload a document via an unfamiliar service.
•     They promise payment only after you send your passport, bank details, and other sensitive info, even though these requirements were not discussed beforehand.

The FTC emphasizes that personal data can be used for identity theft. Specifically, to obtain services, open accounts, or perform other actions on a person’s behalf. That’s why you should treat caution regarding documents as a routine part of digital security.