You scanned your passport at eleven at night because the visa agent asked for it, and you hit send, and something in your chest loosened. Done. That loosening is the most dangerous moment in the whole transaction, because what you felt was not safety. It was the exact instant the document stopped being yours. You can delete the file from your phone tomorrow. You cannot delete it from their inbox, their downloads folder, the backup their IT department runs on Fridays, or the phone of the colleague they forward it to next March. Relief, here, is the feeling of losing control and mistaking it for finishing.

An email attachment is a postcard, not an envelope

Email was built in the nineteen-seventies for messages passing between machines whose operators trusted each other. Encryption in transit was bolted on decades later, and it is still optional: your mail server may encrypt the hop to the next server, or it may not, and you are rarely told which. Even when every hop is encrypted, the attachment arrives and sits in plain form. It sits in your sent folder. It sits in their inbox. It sits in the preview cache their phone made when they tapped it, in the downloads folder when they saved it, in the cloud backup that quietly copies that folder every night.

A scanned ID is not like a message. A message goes stale. A scan of your passport, your tax ID, your bank statement with the account number across the top, is a working key, and it keeps working long after you have forgotten you cut it. The question is not whether the person you sent it to is trustworthy. Most are. The question is how many copies now exist in places where no one is specifically guarding them, and for how many years.

Why smart people still send it bare

If this were purely a knowledge problem, telling you would fix it. It isn't. In 1980 the psychologist Neil Weinstein asked college students to rate their own odds of various life events compared with their peers. They consistently believed good things were more likely to happen to them and bad things less likely. He called it unrealistic optimism, and the pattern has been found again and again in health, money, and safety. Identity theft is precisely the kind of event the bias feeds on: common enough to be real, abstract enough to feel like something that happens to a less careful stranger.

Layer on present bias, our well-documented tendency to overweight costs we pay right now against costs that arrive later. Protecting a file costs three concrete minutes tonight, plus the faint awkwardness of making a recipient type a password. The harm it prevents is diffuse, delayed, and possibly never. Framed that way, the brain makes the rational-feeling choice and hits send. Fear does not fix this; frightened people still discount the future. What fixes it is lowering the cost until the protected version is the default, which is what the rest of this article is for.

What a password actually does to a PDF

A password-protected PDF is not a locked folder with a readable file inside. The file's contents are encrypted, scrambled with AES, the same family of ciphers that protects your banking session. Without the password the bytes are noise. Anyone who finds the file in a backup, a cache, or a forwarded thread two years from now holds something unreadable.

Two details decide whether that protection is real. First, PDFs support two kinds of password: an open password that is required to view the file, and a permissions password that merely asks viewers not to print or copy. The permissions password is a polite request, and many tools simply ignore it. Only the open password encrypts. Second, the attacker has the file and unlimited guesses, with no server to lock them out, so a short password is a speed bump. Use a passphrase: four or five unrelated words you can read aloud over the phone. Say it in a different channel than the email. A password typed into the same message is a key taped to the door.

One more trap: a zipped folder with a password is not the same thing. The older zip encryption that many tools still default to is weak enough to be considered broken. If you must zip, choose the AES option. If you can encrypt the PDF directly, do that instead.

Send less than they asked for

Encryption protects the file. It does nothing about what is inside it. The quieter habit, the one privacy professionals call data minimisation, is to send only the pages and fields the request actually requires. A landlord verifying your identity needs the photo page, not the stamped visa pages. A reimbursement needs the receipt, not the bank statement around it. If a form asks for an account number, ask whether the last four digits will do. They often will.

For identity documents, add a visible line of text across the image before you send it: the purpose, the recipient, and the date. "For tenancy verification, Greenway Apartments, 26 Oct 2026." Place it over the content, not in a margin that can be cropped away. A marked copy is harder to reuse elsewhere, and if it ever surfaces somewhere it should not, the mark says where it leaked from. Many privacy advisers recommend exactly this, and it costs twenty seconds.

Your next moves

  • Search your sent folder right now for "passport", "ID", "statement", and your tax number. Count the bare attachments. Delete your copies, and write down who else holds one so you know what is already out.
  • Choose your passphrase method and your second channel today: a phrase of four unrelated words, delivered by text or a call, never in the email itself. Decide this once so you never have to decide it at eleven at night.
  • Find the encryption option in whatever you scan with, export a test file, and send it to yourself. Open it on a different device. If it opens without asking for a password, you set a permissions password, not an open one. Fix it before you need it.
  • Build a send kit: for the three documents you are asked for most, prepare a trimmed, watermarked, encrypted version now, in a quiet moment, so the rushed version is never the one that goes out.
  • Write a two-line reply template and keep it in your notes: "Attached is encrypted. I'll send the password separately." Recipients adapt fast, and you will stop treating caution as an apology.

Where LumenScan fits

Every step above works with any scanner and any phone. We built LumenScan because we wanted the protected version to be the easy one: it scans and reads text entirely on your device, so the document never leaves your hands to begin with, and it exports a PDF you can lock with a password before it goes anywhere. If you would like the three-minute habit to take thirty seconds, it is at https://lumenscan.lumenlabs.works. The habit matters more than the tool. Start with the sent folder.