ID Card Copy: Watermark It Without Overexposing

When is it relevant to send a copy, and which alternatives should you request?

Before watermarking, the best risk reduction is to avoid sending a raw copy if it is not necessary. Even in legitimate situations, you can often propose a more minimized alternative or ask to limit which information actually needs to be visible.

Core principle: "prove your identity" != "always send an ID copy"

In other contexts (exercising data protection rights), CNIL reminds that in principle it is not always mandatory to systematically provide an ID card copy: the key point is to prove identity. A copy is therefore not an automatic reflex.

👉 Apply this logic to daily life: if the organization already has reliable elements (customer account, in-person exchange, strong authentication...), ask why the copy is indispensable and how long it will be kept.

6 quick questions to ask before sending a copy

1. Who exactly are you? (company name, registration number if professional, official website, address)
2. Why is this copy necessary (specific purpose)?
3. Which information must remain visible (photo, name, birth date, validity...)?
4. Who will have access to the document (team, vendor)?
5. How long will it be kept (or deleted after verification)?
6. How can I send it securely (restricted link, encrypted deposit, separate password channel)?

These questions help for two reasons: they discourage suspicious requests (rushed fraudsters), and they give you a clear framework to choose the right level of watermarking and redaction.

Recommended alternative: one-time-use identity proof

If you have a compatible ID card and an eligible smartphone, the France Identite app can generate a one-time identity proof (recipient, duration, purpose). It is designed as an alternative that limits the circulation of photocopies and scans.

Practical point: acceptance still depends on the recipient (not all services are used to this format yet).

Field tip: propose the alternative first before sending a scan. If it is refused, ask which information is strictly required, then move to watermark + redaction.

Anti-overexposure checklist (downloadable) + CSV

This checklist is designed to be reused before every sending of an identity document copy. Goal: reduce the attack surface, keep a trace, and avoid routine mistakes.

CSV file (UTF-8, separator ;) to copy into a file

Paste this block into a file (for example id_copy_checklist.csv) for quick tracking in a spreadsheet or notes tool.

Step;Action;Why;Status;Notes
Check_context;Identify process and risk level;Adjust watermark/redaction;To_do;
Identify_recipient;Verify legal name official site and domain email;Avoid fake support;To_do;
Ask_purpose;Ask why and which information must remain visible;Minimization;To_do;
Propose_alternative;Offer one-time identity proof when possible;Limit distribution;To_do;
Send_version;Duplicate file to create a send version;Keep original;To_do;
Watermark;Add recipient plus date plus purpose;Traceability and deterrence;To_do;
Redact;Hide non necessary fields;Reduce risks;To_do;
Verify_redaction;Test copy/search and open on another device;Annotation != deletion;To_do;
Delivery_mode;Prefer restricted link plus expiration;Limit copies;To_do;
Password;Encrypt if needed (ZIP/PDF);Secure transit;To_do;
Separate_channel;Send password through separate channel;CNIL recommendation;To_do;
Keep_proof;Archive email screenshots and sent version;Incident management;To_do;
Remove_access;Revoke link after verification;Reduce exposure;To_do;

Watermark without overexposing: simple rules + 12 ready-to-copy templates

Watermarking an ID copy mainly helps prevent out-of-context reuse (cropping, re-sharing, generic reuse) and adds a label: who received the copy, when, and for what purpose. It is not absolute protection, but it is very effective when done properly.

Golden rules (common mistakes to avoid)

• Do not add sensitive information in the watermark (full address, document number, full customer number, etc.).
• Prefer: recipient, date, purpose, and optionally a non-sensitive internal identifier.
• Use a watermark that is hard to crop out: central diagonal or light repeated pattern.
• Do not make the document unreadable: the goal is to hinder reuse, not verification.

12 watermark texts (copy/paste)

1. COPY FOR IDENTITY VERIFICATION — [Recipient] — [DD/MM/YYYY]
2. ONE-TIME USE — PROCESS [Purpose] — [Recipient] — [DD/MM/YYYY]
3. CONFIDENTIAL — DO NOT SHARE — [Recipient]
4. COPY SENT TO [Recipient] — DELETE AFTER REVIEW
5. IDENTITY — VERIFICATION ONLY — [DD/MM/YYYY]
6. COPY PROVIDED FOR [Purpose] — [Recipient] — [City]
7. SENSITIVE DOCUMENT — LIMITED SHARING — [DD/MM/YYYY]
8. COPY FOR ADMINISTRATIVE USE — [Recipient] — [DD/MM/YYYY]
9. RECIPIENT: [Recipient] — FILE REF: [ID-XXXX]
10. DO NOT REUSE OUT OF CONTEXT — [Recipient]
11. COPY FOR REVIEW — NOT VALID FOR OTHER USE — [DD/MM/YYYY]
12. VERIFICATION WITH CONSENT — [Recipient] — [DD/MM/YYYY]

Redaction: what to hide (and how to avoid the "annotation != deletion" trap)

Redaction means making information unreadable without distorting the document. The key point: many tools visually black out content, but do not necessarily remove underlying data (copyable text, layers, metadata).

In other words: hiding and truly deleting are not always the same. If you cannot guarantee deletion, use a more robust workflow (rasterization / flattened PDF print) and always test.

Simple tests after redaction (never skip these)

These tests take less than 2 minutes and prevent a false sense of security:

1. Search the PDF for a word that should be hidden (name, address, number, etc.).
2. Copy/paste text around the blacked-out area into a notes app.
3. Open the file on another device (not the original app) and test again.
4. Check that there is no separate selectable annotation layer.

Step-by-step procedures (free): watermark + redact on Windows, macOS, iOS, Android

Goal: offer free and realistic methods while keeping the rule "annotation != deletion" + tests. If you do this often, a dedicated redaction solution can save time.

Secure sending: limit distribution and separate the secret

Even a well-watermarked and redacted document can leak if delivery is poorly controlled. CNIL recommends simple precautions: encrypt when needed, use transfers that ensure confidentiality, and send secrets (password / key) through a separate channel.

6 good practices without over-engineering

1. Use a restricted-access link (named invitation) rather than an attachment that is easy to forward.
2. Enable expiration (or delete the link after verification).
3. If you encrypt/protect the file: send the password via a separate channel (SMS/call).
4. Do not send "scan + password" in the same email.
5. Keep a proof version (watermarked) + sending trace (date, recipient).
6. Explicitly ask for deletion after use, without being aggressive.

Sending email template (copy/paste)

Subject: Identity verification — [First Last Name] — [File reference]

Hello [Name / Service],

As requested, I am sending an identity document for verification related to [purpose].
To limit risks of out-of-context reuse, the copy is watermarked with the recipient and the date.

Link (restricted access): [URL]
Available until: [DD/MM/YYYY]
Reference: [ID-XXXX]

For security reasons, the password (if applicable) is shared through a separate channel.

Please confirm receipt and, once verification is completed, deletion of non-necessary copies.

Kind regards,
[First Last Name]
[Phone]

What to do in case of identity theft: immediate actions + procedures + templates

If you detect (or suspect) identity misuse, the priority is to act quickly, document the situation, then use the official procedures that fit the case.

Immediate actions (within 30 minutes)

1. Stop distribution: revoke the link, remove access, change the password if needed.
2. Keep evidence: emails, SMS, screenshots, URLs, sent versions, dates/times.
3. Assess impact: where the data may have been used (bank, telecom, administrations...).
4. Start procedures: police log/report if suspicious, complaint if an offense is confirmed (depending on the case).

Official procedures (France): Service-Public and CNIL

Service-Public explains that in case of suspected identity theft, you may file a police report entry; and when identity theft is confirmed, the victim may file a complaint and notify the organizations concerned.

CNIL also publishes practical guidance on reacting to identity theft and the measures to take depending on the type of processing or organization involved.

Message templates (ready to use)

Message to the recipient (request clarification + deletion)

Hello,
I detect / suspect a risk of uncontrolled circulation of my identity document.
Please confirm:
- the exact purpose of the collection,
- who has access to the document,
- how long it is retained,
- immediate deletion of any unnecessary copy,
- and the responsible contact point.
Without a clear response, I will remove access and start the necessary procedures.
Kind regards,
[First Last Name]

Message to the bank / financial institution (pre-alert)

Hello,
I suspect identity theft. Please:
- strengthen monitoring on my file and block any unauthorized account/credit opening,
- confirm recent operations and the dedicated contact channels,
- indicate the procedure to follow (documents to provide, possible objections / blocks).
Kind regards,
[Name + contact details]

Preparation message for a report (police / reporting)

Hello,
I would like to report suspected/observed identity theft.
Facts: [date/time], [channel], [organization], [documents sent], [available evidence].
Damage/risks: [account, credit, telecom, etc.].
I attach: copies of exchanges, listing/link identifiers, screenshots, and any useful document.

Kind regards,
[Name + contact details]

CNIL complaint / claim (depending on the situation)

If the problem involves an organization that processes your data abusively (unjustified retention, refusal to delete, improper use...), CNIL provides an online complaint service. Keep your evidence and build a clear timeline.

Legal notes, CNIL compliance and editorial transparency

• No legal advice: this article provides security and minimization best practices, but it does not replace legal advice adapted to your situation.
• Proportionality: always ask which information is necessary, and avoid sending more than what is needed for the stated purpose.
• Retention: ask for the retention period and deletion after verification.
• Proof: keep a minimal log (recipient, date, watermarked version) to document the sending context.
• Fictional examples: all before/after data in this article is fictional and contains no real information.

Visual ideas (useful and actionable)

• Infographic "3 protection levels": alternative / watermark / watermark + redaction + secure delivery.
• Fictional screenshots of watermark settings (opacity, rotation, repetition).
• Diagram "link + expiration + password via separate channel".
• Visual comparison "annotation vs redaction" + test checklist.

Relevant CTAs

• Generate a ready-to-use "Identity verification" watermark
• Download the checklist (CSV)
• Get the 12 watermark templates by email
• Subscribe to monthly "sensitive documents" tips (5 minutes)

Mini FAQ: ID copy, watermarking and secure delivery

Frequent questions to avoid the most common mistakes before sending a copy of an identity document.