Students & ApplicantsPrivacy

Scanned ID for a rental or job application: what to blur, what to keep, and how to send it

SENULA COMPANY · 2026-09-19 · 9 min read

Providing identification is a standard requirement for lease agreements, job applications, and financial verifications. Applicants frequently photograph their driver's license or passport and email the raw file directly to a landlord or human resources representative. This practice creates a permanent digital record of highly sensitive data sitting in the recipient's inbox. If that email account is ever compromised, the full ID card becomes available for identity theft.

Protecting your identity requires a proactive approach before you press the send button. You must alter the digital file so that it satisfies the recipient's verification requirements while withholding the specific data points that identity thieves target.

The principle of data minimization

The first step in document security is determining exactly what information the recipient needs to verify. A prospective landlord or an employer rarely needs the entire dataset printed on your identification card. They need to verify that you are the person you claim to be, and they need to confirm your legal name.

Consider a standard job application at a local retail store. The human resources department requires identification to verify your eligibility to work. They need to see your full name, your photograph, and your date of birth. They do not need your driver's license number, your document issue date, or your organ donor status at this early stage of the process.

By obscuring the unnecessary data fields, you practice data minimization. You provide just enough information to satisfy the business requirement while reducing your exposure. If a malicious actor gains access to the recipient's email server six months later, they find an incomplete ID card that is far less useful for opening fraudulent credit accounts.

Why a digital black box fails

Many applicants attempt to practice data minimization by opening their scanned ID in a standard document editor. They draw black digital rectangles over their ID number, their home address, and other sensitive fields. They save the file and send it off, believing the information is secure. This method creates a false sense of security due to the technical structure of PDF files.

A PDF is not a flat photograph like a traditional printed picture. It is a digital container constructed of layered objects. When you draw a black rectangle over a string of text in a PDF editor, you are simply placing a new shape object on a layer directly above the text layer.

Anyone who receives this file can open it in a similar PDF editing application. They can select the black rectangle object with their cursor and press the delete key. The rectangle vanishes, revealing the perfectly preserved, unredacted text underneath.

The text layer vulnerability

Even if you export the edited PDF using software that claims to lock the document, some programs simply instruct PDF viewers to hide the underlying text layer without actually destroying the data. The information remains encoded in the file structure.

A recipient can sometimes drag their cursor over the area beneath the black box to highlight the hidden text. They copy the invisible selection and paste it into a plain text document, such as Notepad. The ID number appears in plain text, completely bypassing the visual redaction. This vulnerability is why simple masking tools are inadequate for securing identification documents.

Physical masking before scanning

One reliable way to avoid the digital layer problem is to mask the information in the physical world before creating the digital file. This approach requires no special software and guarantees that the hidden data never enters the computer.

Cut small pieces of opaque paper or use thick, dark sticky notes. Place them directly over the physical ID card, covering the license number, address, and any barcode on the back. Take a photograph of the physical card with the paper masks in place.

Because the camera only captures the visible light reflecting off the masks, the resulting image file contains absolutely no data regarding the hidden numbers. This physical method is entirely secure against digital unmasking techniques.

Flattening the digital document

If you already have a scanned copy of your ID on your computer and need to redact it digitally, you must flatten the document after applying the black boxes. Flattening is the process of converting the separate layers of text, images, and vector shapes into a single, uniform grid of pixels.

The most reliable way to flatten a document is to convert the PDF into a standard raster image format, such as a PNG or JPEG. Once the file becomes an image, the black box and the text beneath it merge into a single layer of colored pixels. The underlying text data ceases to exist in any recoverable form.

When you need to permanently destroy the text under your redactions, drop the file into PDF → Image to convert the PDF pages into flat JPG or PNG images. Once the masked document is flattened into a static image, the redaction is permanent. If the recipient specifically requires a PDF format, you can safely convert the flattened image back into a PDF.

Adding a purposeful watermark

Masking prevents the theft of specific data fields, but it does not stop someone from misusing the redacted image itself. The document needs a watermark. A watermark restricts the future utility of the file if it falls into the wrong hands or is sold to a third party.

Using a basic photo editor, write a line of text directly across the image of the ID card. The text should state the explicit purpose of the file and include the current date. For example, a watermark might read, "Provided for 123 Main St lease application only - September 2026."

The placement of this watermark dictates its effectiveness. If you place the text neatly in the blank white margin of the page, a malicious actor can crop it out in three seconds. The watermark text must intersect key features of the ID card.

Position the text so it overlaps the edge of your photograph, the background security pattern of the card, and parts of the state seal. You must leave your name and date of birth legible. This placement makes the watermark extremely difficult to remove without visibly damaging and invalidating the ID image.

When typing your watermark, use a semi-transparent gray font. This allows the recipient to read the necessary details through the text while still making the image useless for fraudulent applications elsewhere.

Worked examples of secure preparation

Consider an applicant named Sarah moving to an apartment in Chicago. The property manager requests a copy of her driver's license. Sarah photographs her license. She uses a digital editor to draw black boxes over her license number and exact street address. She flattens the file to a JPG. She then adds the text "For Chicago Property Management background check - Nov 2026" diagonally across her face and the state logo. She sends the flat, watermarked file.

Alternatively, consider Michael applying for a remote software engineering job. The HR portal requires identity verification. Michael uses physical sticky notes to cover his passport number before taking the photo. The resulting file is naturally flat. He adds a digital watermark reading "Acme Corp Employment Verification - Oct 2026" across the bottom half of the passport page. He adds this highly restricted file to the portal.

File naming and post-transmission cleanup

File naming hygiene is a critical, often overlooked aspect of document security. Modern digital cameras generate file names with sequential numbers, such as "IMG_4921.jpg." Some applicants attempt to be helpful and rename the file to include their personal details.

Never put identification numbers, social security numbers, or full dates of birth in the filename. A file named "John_Doe_SSN_12345.pdf" exposes your data before the recipient even opens the attachment. Use a generic, clear title that identifies the purpose of the document, such as "John_Doe_ID_Redacted.pdf."

Once you have verified that the recipient has received and processed your application, delete the digital working copies from your computer. Your phone's camera roll or your computer's download folder should not serve as a permanent archive for unencrypted, high-resolution scans of your identity documents.

Because you process files locally, you can use PDF → Image without worrying about your ID lingering on a remote server, but you still need to delete the files from your own local hard drive. Keep the physical card secure in your wallet, and generate new, specifically watermarked digital copies only when the next application requires them.

Security checklist for sending ID

Common mistakes to avoid

The most frequent error is sending high-resolution, unredacted, unwatermarked photos directly from a smartphone camera. These files contain excess detail and metadata, including the exact GPS coordinates of where the photo was taken. Flattening and re-saving the file strips much of this location data.

Another common mistake is applying a watermark that is too small or placed in a corner. A watermark must dominate the image to prevent a bad actor from simply cropping the edges or using a spot-healing tool to erase the text.

Finally, applicants often forget to check the recipient's specific formatting requirements. Some portals strictly require a PDF file and will reject a JPG file. If you encounter this, you must first flatten your redacted document into an image, and then embed that flat image back into a new PDF container to satisfy the system while maintaining security.

FAQ

Does a password-protected PDF hide the redacted data?

No. Password protection restricts who can open the document or limits printing, but it does not change the file structure. Once a user enters the password to open the file, the separate layers of the black boxes and the underlying text remain intact and vulnerable.

Can I use these exact methods for passports and government documents?

Yes. The principles of data minimization and flattening apply to all identity documents. Check with the requesting organization if they require the passport machine-readable zone (the two lines of text at the bottom) to remain visible for their automated scanning systems.

Does flattening a file reduce its legal validity?

Typically, a flattened copy of an ID is sufficient for standard initial verifications like lease applications or employment background checks. The recipient is evaluating the visual evidence. Always check your jurisdiction or the specific organization's policies, as some government agencies require physical inspection of the original card.

Preparing your identity documents carefully takes an extra five minutes but prevents months of bureaucratic hassle. Secure your files properly using PDF → Image before you send that next application email.