You sent a photo of your ID. What can really be done with it.

What the image alone allows

Start with what it does allow, because it is not nothing:

• Impersonating you wherever nobody verifies, which is more places than it should be: signing up for simple services, registering on platforms, opening accounts where the checks are weak.
• Passing a poor identity check. Plenty of services accept a photo of a document as proof, and a photo is exactly what they now have.
• Lending credibility to a scam. Showing your document to a third party while selling something in your name is more convincing than any story.
• Combining it with what already circulates about you. Here is the uncomfortable part: if your phone number and email already leaked in a breach, the document completes the picture.

And what it is usually NOT enough for

This is what almost nobody tells you, and it is what decides how worried to be:

• Opening a bank account at a serious institution. They now require video identification: a person or a system checking live, on video, that your face matches the document. A still photo does not pass that.
• Emptying the account you already have. An identity document is not a login credential. Getting into your banking needs your passwords and your second factor.
• Signing for you where an electronic signature applies, which requires a certificate rather than an image.

Put differently: the photo is one ingredient, not the whole recipe. The real risk depends on how many other ingredients they hold.

What actually raises the risk

From least to most serious. Work down it and you will know where you stand:

• The front side only. The mildest case.
• Both sides. Worse: the back carries data used for verification.
• Document plus a selfie holding it. This jumps sharply, because it is precisely the format many verifications ask for.
• Document, selfie, your phone and your email. That is a complete identity package.
• All of the above plus a video of you. The worst case, because it opens the door to video identification.

If you sent one side to a landlord who is probably legitimate, you are on the first rung. If you sent a stranger the document, a selfie and your number, you are on the fourth.

The check almost nobody mentions

Here is the most useful thing in this guide, and it appears in almost no article on the subject.

You are entitled to see your own credit record: the register of loans and credit granted in your name. In Spain that is the Bank of Spain's CIRBE, which lists borrowing above a certain amount and can be consulted free of charge. Most countries have an equivalent.

It is exactly the check you need if you are worried somebody borrowed money as you. Rather than living with the doubt, you look. It is what Spain's national cybersecurity institute recommends for precisely these cases.

And if something appears that you never asked for, you have stopped speculating: you have a concrete fact to take to the bank and to the police.

What to do if you already sent it

• 1. Place yourself on the scale above. One side of a document is not the same as the full package, and the response should be proportionate.
• 2. Check your credit record. It is free and it answers the question that actually matters.
• 3. Watch your mobile line. Registering a SIM in your name, or cloning yours, is one of the real routes. If your phone loses signal for no reason, call your operator from another phone: that is the signature of a SIM swap.
• 4. Check what else of yours is circulating in known breaches. What decides the risk is the combination, not the document alone.
• 5. Report it if there is a real indication, not as a precaution. Without a concrete fact a generic report goes nowhere. The steps are in how to report a scam website.

What is almost never needed: rushing to replace the document. Renewing does not change the number, so it does not invalidate what already circulates. That makes sense if the physical document was stolen, not because you sent a photo.

How to send it when you have no choice

Because sometimes you must: a tenancy, an agency, a formality. The recommended approach is obfuscation, and it genuinely works:

• Add a watermark with the purpose and the date, written across the document: "Copy for tenancy agreement, 28-08-2026". A document marked that way is far less reusable anywhere else.
• Cover what is not needed. If they only need your name and number, the photograph and signature can be pixelated.
• Send it in black and white. It reduces its usefulness for forgery, and it is what Spain's national police recommend.
• Send a password-protected PDF and pass the password through a different channel, never in the same message.
• And ask whether they genuinely need it. Many ask out of habit. Sometimes showing it is enough, without handing over a file at all.

What the photo carries that you cannot see

A photo taken on a phone drags metadata along with it: the date, the phone model and, depending on your settings, the coordinates of where you took it. Which is usually your home.

So you may be handing over your approximate address without realising, on top of the document itself. Many messaging apps strip metadata when they compress the image, but a file sent as an attachment or by email normally keeps it.

When to actually worry

Not for having sent it, but if any of these turn up:

• A loan or credit on your record that you do not recognise.
• Your phone losing signal suddenly, with no fault on the line.
• Letters from banks or lenders you have never dealt with.
• Debt claims for services you never took out.
• Welcome emails from platforms you never signed up to.

Any of those is a fact rather than a suspicion, and does justify a report and a call to your national cybersecurity helpline.

What to take away

That an identity number is not a password. It is an identifier your bank, your phone operator, your landlord and half the state already know. Its value to a fraudster is not in the number, it is in the combination.

So the useful question is not "did I send my ID?" but "what else of mine does that person hold, and what can be done with the set?" If the answer is one side of a document, you can sleep. If it is the document, a selfie and your phone, check your credit record and watch the line.