Is it safe to send my ID for identity verification (KYC)?
It depends who's asking. Banks and regulated entities must verify your identity and usually require the full document inside their official app. The rule: verify inside the entity's app, redact whatever the process doesn't require, and mark every copy you send by email or web form.
- Published:
- Reviewed:
- Editorial responsibility:
- Ofuska
- Jurisdiction:
- Spain
Why they ask for it
Anti-money-laundering rules require banks, fintechs and investment platforms to verify their customers' identity (KYC, "know your customer"). It's the process with the least room for redacting.
The problem starts outside the official apps: verifications by email, third-party forms, or shady services asking for "a photo of both sides of your ID", no questions asked.
The real risk
Fake KYC checks are a direct route to identity theft: someone registers you on real services with your document. And copies emailed to legitimate services sit outside their secure verification systems.
How to send it with Ofuska
- 1
Store
Your DNI encrypted on your phone. For KYC inside an official app, use the app's own flow.
- 2
Redact
If they ask for a copy by email or form, ask which fields they verify, cover only what the process does not require and send it in colour if needed.
- 3
Trace
An "Entity X, KYC, date" mosaic plus the invisible watermark. If you retain the local copy and the required pixels survive, Verify Copy can link it to that send.
Verify Copy can link a PNG or JPEG to a copy stored on this phone if the image still contains the watermark. The app tells you whether it found a current watermark, an older one or none it can verify. PDFs cannot be checked directly.
Safer sharing guide →
In KYC: mark, don't hide
Law 10/2010 requires regulated entities to formally identify customers and retain the due-diligence documents they obtain. The official channel may require a complete, legible ID: follow its requirements and do not hide fields unless the entity confirms that it accepts them redacted.
If you must provide a complete copy, mark the entity and date when the channel allows it. Use black and white only if accepted. The v2 watermark can link the image to a local copy only if the required pixels survive.
Legal basis and sources
Frequently asked questions
- Can a bank reject my redacted ID?
- Yes: regulated KYC checks usually require the full, legible document. In that case use the entity's official app — not email — and if you have no choice but to send a copy, at least mark it with the recipient mosaic.
- How do I know a KYC check is legitimate?
- Check that the entity is registered (Bank of Spain, or CNMV for investment), that the verification happens on their official domain or app, and distrust any KYC that arrives via a messaging link. If in doubt, send nothing.