We recently had a vacation in Italy and used AirBNB to book our accommodation in three different cities we visited.

We've used AirBNB quite a few times now but we had a new experience this time: one of the hosts told me she makes a scan of the passport of each guest. Sitting on the dinner table was a shiny new looking handheld scanner similar to this:

I was tempted to ask if she also wanted my fingerprints and a DNA sample too. Not wanting to be too offensive though, I simply told her that there was no way she would be making a copy of our documents. I tried to explain it to her from her own perspective: that AirBNB had already verified my identity and that AirBNB automatically gives her insurance (Italy is included) and she doesn't need a copy of my passport to be eligible for the insurance. At best, I suggested, she would be welcome to look at the passport to see that the name matches the AirBNB account - but no copies under any circumstances.

A common problem

A quick search in Google reveals we weren't the first people to have such an experience with a host. However, the AirBNB FAQ has no definite comment on the topic. I wrote to AirBNB's safety team and explained the risks with copying documents onto home computers and they are now considering adding something about this issue to their policies and FAQ.

I would suggest that anybody else who is asked for a copy of an identity document should also fill in the safety report form and ask AirBNB to publish a firm policy prohibiting hosts from demanding copies of identity documents.

Just what is at risk?

Just how bad could it be? Some of the following risks come to mind:

  • The host's computer is sold, sent for repair or stolen and the passport images all end up in the hands of strangers.
  • Viruses and trojans designed to search hard disks for sensitive documents can quickly recognise a passport image. Such viruses are far more likely to hit a home computer than one of those computers used by passport scanners at an airport or bank.
  • Maybe the host even has children or housemates who access the same computer.
  • The host may actually be making themself a target by keeping a cache of these documents - it would be a fairly low-tech hack for a criminal to look through AirBNB listings for hosts who explicitly mention they want to copy an identity document at check-in.

Did the world really get safer since September 2001?

Ever since the horrors of 09/11/2001, many people have felt an urge to try and make the world safer. Simultaneously, the rise of cheap technology has made it easy for people to take security precautions too far.

Everywhere from bed and breakfasts to luggage storage companies are now trying to scan and make a rather permanent electronic copy of identity documents at each opportunity. Having electronic copies of identity documents floating around in so many different places, many of them on poorly maintained computers that are used by staff to surf the web when they are not busy, is actually a huge increase in the risk of identity fraud.

A good proportion of these companies are not even required to scan/copy identity documents - for some of them it is sufficient for them to simply look at the document, just as a train conductor looks at a ticket. Many are simply scanning the documents because management have realized this is the most efficient way to accurately build up a marketing database including customer date of birth (which is harder to ask for directly).

There was significant outrage a few years ago when Mossad agents were accused of using passport images presumably acquired at airports to give identities to their operatives. The quality of passport images now available in the hard disk of a typical AirBNB host or bed'n'breakfast are now likely to be of a higher quality more easily accessible for any number of unintended uses.