Short answer: never send ID scans or bank details as e-mail attachments or chat messages, and never send them before you have confirmed the employer is real and you have a written offer. The safest route is the employer's own HR or payroll portal, or an official remote identity check (in the US the Form I-9 remote examination, in the UK a certified digital identity provider, in India a masked Aadhaar or a DigiLocker share). If a recruiter asks for documents some other way, use a one-time secure upload link that goes straight to the employer's account – never a public file link that stays open.
When to share what during remote hiring
| Stage | Share | Do not share yet |
|---|---|---|
| Application and interviews | CV, portfolio, references (with their consent) | ID, passport, Social Security or national ID number, bank details |
| Written offer accepted | Identity and right-to-work documents, through the employer's process | Bank details by e-mail or chat |
| Onboarding / payroll set-up | Bank account, tax forms – entered by you in the payroll or HR system | Anything requested by someone you cannot verify |
The US Federal Trade Commission warns that fake job offers are built to get "your money and your personal information", that no honest employer will send you a check to deposit and ask you to send money back, and that you should never pay to get a job (FTC: job scams). Before sending anything, check the company's own website and call a number you found yourself, not one from the message.
Ways to send ID and bank documents compared
| Method | Encrypted in transit and at rest | Access ends | Who opened it | Risk |
|---|---|---|---|---|
| E-mail attachment | Usually in transit only | Never – copies stay in both mailboxes | No | High: forwarding, mailbox breaches, wrong recipient |
| Chat app (WhatsApp, Telegram, LinkedIn) | Depends on the app | Never in practice | No | High: often how job scammers ask for documents |
| Public cloud link (Drive, Dropbox "anyone with the link") | Yes | Only when you remember to stop sharing | No | Medium: the link can be forwarded |
| Employer's HR / payroll portal | Yes | Kept under the employer's retention policy | Employer's audit | Low, if the portal is the employer's real one |
| One-time secure upload link from the employer | Yes | Files go to the employer's account, not a shared folder | Upload is labelled with your name and time | Low |
| Official remote ID check (below) | Yes | Per the scheme's rules | Yes | Lowest, where available |
Official remote identity checks by country
- United States – Form I-9. Employers enrolled in E-Verify may use the DHS alternative procedure: the employee sends copies of the documents (front and back), then shows the same documents on a live video call; the employer keeps clear copies (USCIS: remote examination of documents). Employers that are not enrolled must examine the original documents in person, usually through an authorised representative.
- United Kingdom – right to work. Employers can use a certified Identity Service Provider (IDSP) to check British and Irish passports digitally; it is recommended, not mandatory, for right-to-work checks (GOV.UK). Other workers usually prove their status with a Home Office share code instead of sending documents.
- India. Share a masked Aadhaar (only the last four digits visible) instead of a full copy, or share the document from DigiLocker so the employer fetches it from the issuer instead of receiving a scan.
For employers: collect documents without creating a leak
- Ask only after the offer, and say in the offer letter exactly which documents you need and how you will collect them – that alone protects candidates from scammers using your name.
- Collect through one channel: your HR or payroll system, or an upload link that drops files into a restricted folder. Do not accept documents over chat.
- Restrict and log access: only HR sees the folder; every upload is labelled with who sent it and when.
- Keep only what the law requires, for as long as it requires (for example, I-9 copies for the retention period), then delete.
- Never send ID copies onward by e-mail to managers or agencies; share view-only and revoke afterwards.
In HelpRange you can create a file request (“ID documents – Anna Kowalska”) and send the link: the candidate uploads without creating an account, files land in your private folder labelled with their name, and you get a notification. Files are encrypted and stored in Frankfurt, Germany. File requests are part of the Unlimited plan ($174 per team a month, the whole team included).
FAQ
Is it safe to e-mail a copy of my passport to an employer?
It is the least safe common method: copies stay in mailboxes indefinitely and can be forwarded. Use the employer's HR portal or a secure upload link, and only after you have verified the employer and accepted a written offer.
Should I give my bank details before I get a job offer?
No. Bank details are needed for payroll, which starts after you have accepted an offer – and then you enter them in the payroll system yourself. A request for bank details or money before an offer is a classic job-scam sign, according to the FTC.
Can a US employer verify my I-9 documents over video?
Yes, if the employer is enrolled in E-Verify: it may use the DHS alternative procedure – you send copies of your documents and then show them on a live video call.
What is the safest way to send ID proof in India?
A masked Aadhaar (last four digits only) or a DigiLocker share, rather than a full photocopy sent over e-mail or chat.
Related: secure document upload · a password per recipient · password-protect a link.