AirBNB hosts scanning identity documents and passports?

We recently had a vacation in Italy and used AirBNB to book our accommodation in three different cities we visited.

We've used AirBNB quite a few times now but we had a new experience this time: one of the hosts told me she makes a scan of the passport of each guest. Sitting on the dinner table was a shiny new looking handheld scanner similar to this:

I was tempted to ask if she also wanted my fingerprints and a DNA sample too. Not wanting to be too offensive though, I simply told her that there was no way she would be making a copy of our documents. I tried to explain it to her from her own perspective: that AirBNB had already verified my identity and that AirBNB automatically gives her insurance (Italy is included) and she doesn't need a copy of my passport to be eligible for the insurance. At best, I suggested, she would be welcome to look at the passport to see that the name matches the AirBNB account - but no copies under any circumstances.

A common problem

A quick search in Google reveals we weren't the first people to have such an experience with a host. However, the AirBNB FAQ has no definite comment on the topic. I wrote to AirBNB's safety team and explained the risks with copying documents onto home computers and they are now considering adding something about this issue to their policies and FAQ.

I would suggest that anybody else who is asked for a copy of an identity document should also fill in the safety report form and ask AirBNB to publish a firm policy prohibiting hosts from demanding copies of identity documents.

Just what is at risk?

Just how bad could it be? Some of the following risks come to mind:

  • The host's computer is sold, sent for repair or stolen and the passport images all end up in the hands of strangers.
  • Viruses and trojans designed to search hard disks for sensitive documents can quickly recognise a passport image. Such viruses are far more likely to hit a home computer than one of those computers used by passport scanners at an airport or bank.
  • Maybe the host even has children or housemates who access the same computer.
  • The host may actually be making themself a target by keeping a cache of these documents - it would be a fairly low-tech hack for a criminal to look through AirBNB listings for hosts who explicitly mention they want to copy an identity document at check-in.

Did the world really get safer since September 2001?

Ever since the horrors of 09/11/2001, many people have felt an urge to try and make the world safer. Simultaneously, the rise of cheap technology has made it easy for people to take security precautions too far.

Everywhere from bed and breakfasts to luggage storage companies are now trying to scan and make a rather permanent electronic copy of identity documents at each opportunity. Having electronic copies of identity documents floating around in so many different places, many of them on poorly maintained computers that are used by staff to surf the web when they are not busy, is actually a huge increase in the risk of identity fraud.

A good proportion of these companies are not even required to scan/copy identity documents - for some of them it is sufficient for them to simply look at the document, just as a train conductor looks at a ticket. Many are simply scanning the documents because management have realized this is the most efficient way to accurately build up a marketing database including customer date of birth (which is harder to ask for directly).

There was significant outrage a few years ago when Mossad agents were accused of using passport images presumably acquired at airports to give identities to a their operatives. The quality of passport images now available in the hard disk of a typical AirBNB host or bed'n'breakfast are now likely to be of a higher quality more easily accessible for any number of unintended uses.

Comments

You've got an off-by-10 error in the year there.

Thanks for the feedback.

Daniel, it is simply the law in Italy since ever, 2001 has nothing to do with it, however the law does not require a photocopy, only that the names, and ID document number are provided IIRC (probably also because the law predetas the existence of photocopiers by decades :).

What Simo says before me is correct. The Italian law requires that in case of hospitality of a foreign citizen, his presence has to be declared to the local Prefettura within 48 hours from the start of the stay (if the guest is an Italian citizen the same obligation holds but it is required only if the stay is planned to be longer than 30 days). Here you can find the form (from the official website of the Italian police: http://questure.poliziadistato.it/file/4520_4938.pdf).
The form, as you can see, requires to fill in some data about the guest(among others: first and last name, date and place of birth, city of residency, etc.) i.e. all the data that you can find on a passport. So probably your host thought that taking a scan of your passport was the easiest thing to do, and having a convenient device to do it seems, in fact, a good idea. Please note that the same form informs that failing to present the declaration in due time can lead to up to 3 years in jail and a fine of up to 15.000 € per person hosted.

Given that Italy's former president and prime minister is a convicted criminal, why should anybody feel that their data is safe in the hands of Italian authorities? One reason people use community-based services like AirBNB is that they are uncomfortable with the way conventional accommodation providers are systematically gathering up all this private data and putting it in databases (official or otherwise) where it will eventually be leaked or stolen or whatever. In any case, the copying or scanning is not necessary to comply with such a law, it is just a host putting their own convenience above the risk of identity fraud for the guest.