Gave an ID Copy to an Agent or Landlord Without a Watermark? What to Do Now

The short answer: the risk isn't zero, but three steps now cut it sharply

If you have handed copies of your passport or ACR card to an agent or landlord without any watermark, there is no need to panic — but don't ignore it either. Do three things now: list what you handed over and to whom, ask them in writing what they keep and to delete what they don't need, and set up alerts on your bank accounts and phone number.

First, an accurate picture of the risk. A photocopy on its own lets someone do only so much: opening a regular bank account, registering a SIM or applying for a visa usually involves in-person verification, the original document or a face check. But plenty of steps still rely on a copy or photo alone — some online lending apps, marketplace accounts, rental registrations, online shops, or small errands done in your name without you present. The risk rises sharply when the copy travels together with your selfie, phone number and address.

So the real question is not whether the copy is "out there," but whether you know who has it, what they are using it for, whether extra copies are circulating, and whether you would find out quickly if someone started using your identity.

This guide covers the worried-but-nothing-has-happened stage. If someone has already opened an account or taken a loan in your name, go straight to what to do when your ID is used to open accounts or take loans. If your personal details have been posted online, see what to do when your personal information is exposed online.

Step one: list who has what, which pages, and when

Start by writing down every time you can remember handing over a copy or photo of an ID document. You will use this list later when asking for deletion, reporting to the police or explaining things to an institution.

Useful columns:

• Recipient: agency name and the staff member, landlord or sub-landlord, building administration;
• How: paper photocopy, phone photo, sent by WeChat or Viber, email, uploaded to a website;
• What: passport bio page, visa page, entry-stamp pages, both sides of the ACR card, driver's licence, Chinese ID card, a selfie holding the document;
• Date and stated purpose: lease signing, registration, a visa application, opening an account;
• Whether you got a receipt or handover note.

Pay special attention to two high-risk hand-overs. One is a selfie holding your ID, or any image showing your face with the document — exactly what online identity verification asks for. The other is scans sent through group chats or shared email addresses, which may be saved and forwarded by several people, so you can never be sure how many copies exist.

If you handed documents to a visa agency, use this moment to check where your case stands and whether every original has been returned. For the handover checklist when changing agencies mid-process, see how to hand over a visa case to a new agency. For documents given while renting, check who actually signed the lease with you; see verifying who you are signing a lease with.

Don't worry if the list is incomplete. Even a partial record makes the next two steps far more effective.

Step two: ask, in writing, what they keep and to delete the rest

For agents or landlords you are still dealing with, ask in writing which copies they keep, for what purpose and for how long — and ask them to delete anything no longer needed and confirm it. You are not being difficult; this is what a properly run business should do anyway.

The Philippines has a data privacy law under which organisations that process personal information generally need a stated purpose, reasonable retention and deletion when the data is no longer needed, and individuals have rights to ask about, correct and request deletion of their data. Whether a particular agent or landlord falls under it and how they must respond depends on current National Privacy Commission rules and guidance, but simply asking in writing makes people handle your data more carefully. For the business side of these obligations, see what the Data Privacy Act requires of businesses.

A short request can cover:

1. which copies or photos you submitted, on what date and for what purpose;
2. where they are now stored, how many copies exist, and whether they were passed on to anyone (Immigration, the building office, the owner);
3. a request to delete paper and electronic copies whose purpose is complete, with written confirmation;
4. a request to be told before your data is used again.

If they don't reply or brush you off, don't chase them endlessly — you now have a record that you asked for deletion, which helps if you later need to show where your data leaked. If the agency has already vanished, skip this step and focus on alerts and, where needed, a police report; see what to do when an agency disappears.

Step three: set alerts so any misuse shows up immediately

The point isn't to recover every copy. It's to know at once if anyone starts using your identity.

Alerts worth setting:

• Banks and e-wallets: turn on transaction notifications for every account and periodically check for accounts or linked devices you don't recognise.
• Your phone number: Philippine SIMs are registered against an ID. Watch for carrier notices; if your signal suddenly drops or you get a "SIM replaced" message, call your carrier straight away — see what to do if your number is hijacked by a SIM swap.
• Collection calls: if someone calls saying you owe a lending app money, don't pay and don't give any more information. Note the platform name and amount and treat it as identity fraud.
• Email and SMS: watch for "registration successful," OTP or "account under review" messages from platforms you never used — often the first sign that someone is signing up with your details.
• China side: if a copy of your Chinese ID card also went out, keep an eye on your credit record, bank accounts and the phone numbers linked to them at home.

These alerts cost almost nothing, yet they shrink the gap between misuse and discovery from months to the same day. The earlier you dispute and report, the easier everything that follows becomes.

Two more habits help. Every few months, search your own name together with your phone number to see whether anything unexpected comes up. And if a family member or friend receives a message from "you" asking for money or documents, ask them to verify by calling you directly before doing anything.

Write the alerts you set into the same list you made in step one, so you know what you are watching and where.

Next time: how to watermark, what to cover, and keeping a handover record

From now on, build three habits whenever you hand over an ID copy: watermark it with the purpose, give only the pages needed, and keep a record of the handover.

How to watermark. Write a line across the copy or photo that overlaps the data area without hiding the key details. Include who it is for, the purpose, the date and "not valid for any other use." For example: "For [company] — lease registration only — [date] — invalid for other use." On paper, write it diagonally across the photo and document number. For digital copies, add the text with your phone's markup tool and export a flattened image rather than a layer that can be removed in seconds.

Give only what is needed. A lease registration usually needs the bio page, not every visa page and entry stamp. If someone asks you to "scan everything," ask what each page is for. Where an ACR card copy will do, you may not need to hand over the passport; where the original can be shown and checked, a copy may not need to be kept at all. For when to carry the original versus a copy, see should you carry your passport or a copy.

Keep a handover record. Ask the recipient to sign a short receipt listing which copies, for what purpose, the date and who received them. When the job is done, ask for them to be returned or destroyed.

Manage digital copies too. Don't post ID images in group chats or in public cloud links. Don't name files "passport" when emailing them, and delete them from your phone afterwards — including the "recently deleted" album.

When to escalate, and where Yixing helps

Move from prevention to response as soon as you see any of these signs:

• OTPs, sign-up confirmations or account-review messages from platforms you never used;
• loans, accounts, rentals or orders made in your name, or collectors contacting you;
• a bank or carrier telling you a new account or number has been opened under your name;
• your ID photos appearing online or being used to impersonate you to family and friends.

At that point follow the response order for identity misuse: don't pay, dispute in writing, report to the police, complain to the relevant regulators, and work out where your data leaked. The list from step one and the deletion requests from step two are exactly the evidence you need.

Do you need a new passport? In most cases a leaked photocopy alone does not require replacing your passport. If serious misuse has occurred or the consulate recommends it, follow replacing or renewing a Chinese passport in the Philippines and transfer your Philippine visa to the new one. Whether replacement is needed is for the consulate to advise.

What Yixing does: when handling visas, company registration and other work for clients, we collect only the documents genuinely needed, record every handover and return originals when the job is done. If identity misuse means you need replacement documents, a visa transfer after a new passport, or updated immigration records, we can help; see our settling-in services. Yixing is a private consultancy registered with the SEC (CS202009551), holding Bureau of Immigration accreditation (BI Accreditation No. CA-202624381-1, valid until 2027-06-30) and DOLE and PRA accreditation. We are not a government office.

Every case is different — consult a licensed Philippine lawyer. This article is not legal advice.