# Is Your Passport Safe With an IRS CAA Who Works From Home? Source: https://pakistanirscaa.com/blog/passport-safety-itin-agent-pakistan/ Publisher: PakistanIRSCAA.com editorial team (this site is not the IRS) Topic: Data security Published: 2026-11-08 Last updated: 2026-11-08 Reading time: 16 min > Sharing your passport with an ITIN agent can be a legitimate part of an ITIN application, but its safety depends on the provider's identity, authorization, document handling and privacy practices. Verify these before you send anything. ## Summary Sending your passport to an ITIN agent can be legitimate, but IRS authorization does not guarantee data security. Verify the agent's identity and IRS listing, ask how your passport will be examined, stored, shared and returned, and avoid sending it to unverified contacts. - A passport is generally the only standalone identification document that establishes both identity and foreign status for an ITIN application. - IRS CAA authorization is important, but it does not guarantee a provider's cybersecurity or document storage practices. - A scanned passport or photograph alone should not be treated as sufficient for CAA authentication. - WhatsApp encrypts messages in transit, but what the recipient does with the image afterwards depends on their own systems. - Ask about storage, access, third-party sharing, retention and return of originals before you share anything. Checked against IRS pages on 8 November 2026. Educational information, not tax or legal advice, and not reviewed by an EA or CPA. Disclosures: https://pakistanirscaa.com/disclosures/ Applying for a U.S. Individual Taxpayer Identification Number (ITIN) from Pakistan often requires sharing sensitive personal information with an ITIN service provider. Depending on your circumstances, this may include your passport, full legal name, date of birth, nationality, residential address, and U.S. tax documents. Many applicants focus primarily on the cost of the ITIN application or how quickly the IRS will issue their number. However, there is another question worth asking before submitting any documents: who will have access to your passport information, and how will that information be protected? An IRS Certifying Acceptance Agent (CAA), commonly called a Certified Acceptance Agent, may be authorized to authenticate eligible identification documents for ITIN applications. But IRS authorization does not eliminate the need to evaluate a provider's document security and privacy practices. This guide explains the potential risks of sharing passport information, how to evaluate an ITIN agent in Pakistan, what to ask about document storage and access, and how to reduce unnecessary exposure of your personal information. ## Quick Answer: Is It Safe to Share Your Passport With an ITIN Agent? Sharing your passport with an ITIN agent can be a legitimate part of an ITIN application. However, the safety of the process depends on the provider's identity, authorization, document-handling procedures, access controls, and privacy practices. Before submitting your passport, verify the provider's business identity, confirm any claimed IRS CAA authorization, understand how the original document will be examined, and ask how your information will be stored, shared, retained, and protected. A provider's advertised price, office location, or claim of IRS authorization should not be treated as a complete guarantee of passport security. ## Why Does an ITIN Agent Need Your Passport? The Internal Revenue Service requires ITIN applicants to establish their identity and foreign status. Form W-7, Application for IRS Individual Taxpayer Identification Number, must be supported by acceptable documentation. A valid passport is generally the only standalone identification document that can establish both identity and foreign status for many ITIN applicants, subject to applicable IRS requirements and exceptions. Other acceptable documents may require additional supporting documentation. ### What passport information is relevant to an ITIN application? A passport typically contains: - Full legal name. - Date of birth. - Nationality. - Passport number. - Photograph. - Place of birth. - Passport issuance and expiration dates. - Machine-readable identification information. These details help establish the applicant's identity and foreign status. However, the same information can be sensitive if accessed or used without authorization. ### Does every ITIN provider need to keep a copy of your passport? Not necessarily in the same manner or for the same period. The provider's document-handling and record-retention obligations depend on its role, the applicable IRS requirements, and other relevant legal obligations. Ask whether a copy is necessary, why it is being retained, who can access it, and how long it will be stored. A provider should be able to explain its retention practices rather than making vague promises about deleting everything immediately. ## What Could Happen if Your Passport Information Is Exposed? Passport information can be valuable to people attempting identity-related fraud. Exposure of passport details does not automatically mean identity theft will occur, but it may increase the risk of certain forms of misuse. Potential risks include: - **Identity impersonation:** Someone may attempt to use personal details to impersonate the passport holder during an online registration or verification process. - **Fraudulent account applications:** Stolen identity information may be used in attempts to open accounts or access services, although many institutions require additional verification. - **Social engineering:** A fraudster with accurate personal details may create more convincing phishing messages or impersonation attempts. - **Unauthorized document sharing:** Passport copies may be forwarded to individuals or organizations without the applicant's knowledge or appropriate authorization. - **Long-term data exposure:** Poorly protected documents may remain accessible after the original service has been completed. These are potential risks, not evidence that a particular ITIN provider engages in misconduct. ### Can someone open a bank account using only your passport scan? A passport scan alone is not necessarily sufficient to open an account. Financial institutions commonly use additional identity verification, customer due diligence, and fraud prevention procedures. However, exposed passport information can still be used in attempted fraud or combined with other stolen personal details. That is why unnecessary disclosure should be avoided. ## Does IRS CAA Authorization Guarantee Passport Security? No. An IRS Certifying Acceptance Agent is authorized to perform specific functions under the IRS Acceptance Agent Program. These functions include assisting with ITIN applications and authenticating eligible identification documents according to IRS procedures. CAA authorization is important because it establishes a particular relationship with the IRS and additional document authentication responsibilities. However, CAA authorization should not be interpreted as a guarantee that every aspect of the provider's cybersecurity, employee access controls, cloud storage, or internal business operations is secure. ### What should you verify separately? You should evaluate: - Current IRS authorization. - Business identity. - Passport examination procedures. - Document submission methods. - Internal access controls. - Storage and encryption practices. - Third-party sharing. - Record retention. - Incident response procedures. These factors are related, but they are not identical. ### Is every ITIN consultant an IRS CAA? No. A general tax consultant or ITIN preparation service may assist with Form W-7 without holding CAA authorization. Only appropriately authorized CAAs can perform the document authentication functions permitted under the IRS Acceptance Agent Program. To understand the distinction, read [IRS Acceptance Agent vs. Certified Acceptance Agent](https://pakistanirscaa.com/blog/acceptance-agent-vs-certified-acceptance-agent/). ## Is It Safe to Send Your Passport Through WhatsApp? Many applicants in Pakistan communicate with service providers through WhatsApp. It can be convenient for initial inquiries, appointment scheduling, and general communication. However, sending a passport image through a messaging application introduces considerations beyond the security of the message in transit. ### Does WhatsApp encrypt passport images? WhatsApp personal messages are protected by end-to-end encryption. This helps protect messages during transmission between participants. However, end-to-end encryption does not control what happens after the recipient receives and downloads a document. For example, the recipient may: - Save the image to a phone or computer. - Forward it to another employee. - Upload it to a cloud storage service. - Include it in a customer record. - Retain it after the application is completed. The security of those subsequent actions depends on the recipient's systems and procedures. ### Is a secure upload portal better? A properly implemented secure document portal may offer useful protections, such as authenticated access, controlled permissions, encrypted transmission, and managed storage. However, simply calling a website a secure portal does not establish that it has been configured correctly. Ask the provider what security measures are actually used. ### What should you do before sending a passport image? Confirm the recipient's identity, make sure you are using the provider's legitimate contact channel, and ask whether a secure upload option is available. Avoid sending sensitive documents to unfamiliar personal numbers or unverified accounts. ## Can an ITIN Agent Share or Sell Your Passport Information? An ITIN provider may need to share certain information with the IRS or authorized service providers to perform the service. For example, application preparation, document transmission, and courier arrangements may involve different organizations. However, sharing information for a legitimate service purpose is different from unauthorized disclosure or commercial misuse. ### Could your information be sold to third parties? Any organization holding personal data presents a potential risk of improper disclosure or misuse if appropriate safeguards and controls are absent. This could include unauthorized sharing for commercial purposes. However, there is no basis to assume that an ITIN provider sells passport information simply because it charges a low fee, operates from home, or has limited public visibility. ### What should you ask about third-party sharing? Ask the provider: 1. Do you share customer documents with contractors or other businesses? 2. Which service providers may receive my personal information? 3. Is information shared only when necessary to process my application? 4. Do you use customer information for unrelated marketing? 5. Can I review your privacy policy? 6. How do you restrict access by third parties? A transparent provider should explain the categories of third parties involved and the purposes for which information is shared. ### Does a privacy policy guarantee safety? No. A privacy policy describes how a business says it handles personal information. Its existence is useful, but applicants should also consider whether the provider's actual practices are consistent with those statements. ## Is a Commercial Office Safer Than a Home-Based ITIN Agent? Some ITIN service providers operate from commercial offices, while others work from home or use remote business arrangements. For applicants sharing original passports or sensitive tax documents, the provider's physical operating arrangements may be relevant. ### Why might a commercial office be useful? A verifiable commercial office may offer: - A physical location for scheduled appointments. - A recognizable business address. - A place to present original documents. - A documented point of contact. - A potentially more convenient way to resolve document-handling questions. However, a commercial office does not automatically mean that a company has strong cybersecurity, proper document storage, or qualified employees. ### Is a home-based IRS CAA unsafe? Not necessarily. A home-based CAA may be properly authorized and may maintain appropriate document security procedures. The important issue is whether the provider protects documents from unauthorized access and follows applicable IRS requirements. ### Questions to ask a home-based or office-based agent - Where are original passports examined? - Are original documents stored in a secure location? - Who can access customer documents? - Are documents left unattended? - Are digital copies stored on personal devices? - Are employees or contractors subject to access restrictions? - How are original documents returned to applicants? These questions are relevant regardless of whether the provider operates from a commercial building or a home office. ## Can an IRS CAA Verify Your Passport Remotely? Some Pakistani applicants prefer remote ITIN assistance because they live outside Lahore, Karachi, Islamabad, or other major cities. Remote assistance may be possible, but applicants should understand the distinction between a video interview and authentication of identification documents. ### Is a passport scan enough for CAA authentication? No. A scanned passport or photograph alone should not be treated as sufficient for CAA authentication. The IRS permits video conferencing for interviews under its Acceptance Agent Program procedures, but the CAA must still meet the relevant requirements for possession and examination of original identification documents or acceptable copies certified by the issuing agency. ### What should you ask a remote CAA? Before proceeding, ask: - How will you examine my original passport? - Do I need to attend an in-person appointment? - Can the interview be conducted by video? - What documents must you possess during the interview? - How will original documents be returned? - Will you prepare Form W-7(COA) when applicable? The provider should be able to explain the complete process clearly. ### Can I apply for an ITIN from Pakistan without visiting the United States? Yes. Eligible individuals can apply for an ITIN from abroad through permitted IRS procedures. However, the identification, documentation, and application requirements still apply. ## How Long Should an ITIN Agent Keep Your Passport Information? Document retention is an important but often overlooked part of passport security. An ITIN provider may have legitimate reasons or legal obligations to retain certain application records. However, unnecessary or poorly controlled retention can increase exposure if records are accessed improperly. ### What should a document retention policy explain? A clear policy should address: - What documents are retained. - Why they are retained. - How long they are kept. - Who can access them. - Whether records are stored digitally or physically. - How records are disposed of when retention is no longer required. - How applicants can contact the provider about their information. ### Can you ask an ITIN agent to delete your passport copy? You can ask about deletion and retention policies. Whether a provider can delete a particular record immediately depends on applicable legal, regulatory, and recordkeeping obligations. A responsible provider should explain those limitations rather than promising deletion that would conflict with its obligations. ## How to Verify an ITIN Agent Before Sharing Your Passport Before submitting sensitive documents, take the following precautions. ### Step 1: Verify IRS authorization If the provider claims to be an IRS Acceptance Agent or CAA, check the [IRS list of acceptance agents in Pakistan](https://www.irs.gov/individuals/international-taxpayers/acceptance-agents-pakistan). Review the directory's classification notation and confirm the provider's identity. ### Step 2: Verify the business identity Check the provider's legal business name, published contact details, and available business information. If the advertised brand differs from the IRS listing, ask for an explanation. ### Step 3: Understand the document examination process Ask how your original passport will be examined and whether the provider can authenticate it under IRS CAA procedures. ### Step 4: Review privacy practices Read the provider's privacy policy and ask about document storage, access, sharing, and retention. ### Step 5: Confirm the upload channel Use a verified contact method or secure document submission system. ### Step 6: Understand original-document handling If you must provide an original passport, confirm who will receive it, how it will be stored, and how and when it will be returned. ### Step 7: Keep your own records Retain relevant payment confirmations, service agreements, document submission acknowledgments, and correspondence. Avoid storing unnecessary passport copies in publicly accessible locations. ## Passport Security Checklist for ITIN Applicants Use this checklist before sharing identification documents. Table: Passport security checklist | Security Question | What You Should Verify | | --- | --- | | Is the provider identifiable? | Verifiable legal or business identity | | Is claimed IRS authorization verifiable? | IRS list entry and classification | | Is the document submission channel legitimate? | Verified contact or secure portal | | Is original passport examination explained? | Compliance with applicable IRS procedures | | Are digital records protected? | Appropriate storage and access controls | | Is third-party sharing disclosed? | Clear explanation of recipients and purposes | | Is document retention explained? | Defined retention and disposal practices | | Is the business address verifiable? | Consistent contact and appointment details | | Are original documents tracked? | Clear receipt and return arrangements | | Is customer support available? | Reliable contact channel for document concerns | A provider that can answer these questions clearly gives applicants a better basis for evaluating the security of its service. ## What Should You Do if You Already Shared Your Passport With an Unknown ITIN Agent? If you have already sent a passport copy to a provider and now have concerns, do not automatically assume that your identity has been stolen. Instead, take practical steps to understand and reduce potential exposure. ### Confirm the recipient Check whether you sent the document to the correct business, contact number, email address, or upload portal. ### Ask about storage and sharing Request information about where the document is stored, who can access it, and whether it has been shared with any third parties. ### Request information about deletion Ask whether the provider can delete unnecessary copies, subject to applicable recordkeeping obligations. ### Secure related accounts If you also shared passwords, verification codes, or account credentials, change affected passwords and enable multifactor authentication where available. ### Watch for suspicious activity Be cautious of unexpected identity verification requests, phishing messages, or communications referencing your passport details. ### Report suspected misuse If you have evidence of identity misuse, contact the relevant financial institution, service provider, passport authority, or appropriate law enforcement agency. Keep copies of relevant communications and evidence. ## Final Thoughts: Protect Your Passport Before You Apply for an ITIN An ITIN application may require you to share some of your most sensitive personal information. That makes the choice of service provider important. Before sharing your passport with an ITIN agent in Pakistan, verify the provider's identity, understand any claimed IRS CAA authorization, and ask how your documents will be examined, stored, accessed, shared, and returned. A low advertised fee does not automatically mean poor security. A high fee does not guarantee strong security. A commercial office does not automatically guarantee privacy, and a home-based office does not automatically mean documents are unsafe. The most useful evidence is a provider's actual authorization, transparent procedures, and demonstrated approach to protecting customer information. ### Find IRS Certified Acceptance Agents in Pakistan Explore the [Pakistan IRS CAA Directory](https://pakistanirscaa.com/directory/) to review agent profiles and the information available about each. [Browse IRS CAA Profiles in Pakistan](https://pakistanirscaa.com/directory/) ### Review MyITINPro's Agent Profile View [MyITINPro LLC's agent profile](https://pakistanirscaa.com/directory/myitinpro-llc/) to review its listed services, authorization information, and document-handling procedures. > **Disclosure.** MyITINPro LLC is a company of Svetro, Inc. Its inclusion here is not an IRS endorsement or a ranking. ## Frequently asked questions ### Is it safe to send my passport to an IRS CAA in Pakistan? It can be a legitimate part of the ITIN application process. Verify the agent's authorization, identity, document-handling procedures, and privacy practices before sharing sensitive documents. ### Can an ITIN agent misuse my passport? Any person or organization with access to sensitive information could potentially misuse it. This does not establish that a particular agent is doing so. Evaluate the provider's safeguards and transparency. ### Does IRS CAA authorization mean my passport is completely safe? No. IRS authorization is important, but it does not guarantee that every aspect of a provider's cybersecurity or document management is risk-free. ### Can someone steal my identity using a passport scan? Passport details can potentially be used in identity-related fraud or impersonation attempts, particularly when combined with other personal information. A scan alone does not guarantee that an attacker can successfully open an account. ### Is WhatsApp safe for passport verification? WhatsApp provides end-to-end encryption for personal messages, but the recipient's storage, forwarding, and access practices remain important. Ask whether a secure document portal is available. ### Should I avoid home-based ITIN agents? Not automatically. A home-based provider may be legitimate and properly authorized. Evaluate its security procedures and business identity rather than relying solely on office location. ### Is a commercial office proof that an ITIN agent is trustworthy? No. A commercial office can help establish a verifiable business presence, but it does not independently prove IRS authorization or secure data handling. ### Can a CAA verify my passport using only a photograph? A photograph alone should not be assumed sufficient for CAA authentication. The IRS requires compliance with original-document examination procedures. ### Can I apply for an ITIN remotely from Pakistan? Eligible applicants may receive remote assistance, but the provider must still satisfy applicable IRS identification and application procedures. ### Does the IRS keep my original passport? When an original passport is submitted directly to the IRS, the IRS generally returns original identification documents after processing them. Applicants should consult current IRS guidance about document handling and return times. ### Can an ITIN agent keep my passport after the application? A provider should explain any legitimate temporary possession of original documents and the arrangements for returning them. Applicants should not assume that indefinite retention of an original passport is necessary. ### Can I ask an ITIN agent to delete my passport information? Yes, you can request information about deletion. Whether immediate deletion is possible depends on applicable legal and recordkeeping requirements. ### Is a cheap ITIN service more likely to expose passport information? Price alone does not establish the security of a provider's systems. Evaluate actual safeguards, privacy practices, and document-handling procedures. ### How can I verify an IRS CAA in Pakistan? Use the IRS Acceptance Agents list for Pakistan and confirm the provider's identity and AA/CAA classification. ### What is the safest way to apply for an ITIN from Pakistan? Use an IRS-permitted application method, provide identification documents through an appropriate process, and carefully evaluate any service provider that will handle your personal information. ## Sources - [IRS: How to apply for an ITIN](https://www.irs.gov/tin/itin/how-to-apply-for-an-itin) - [IRS: Acceptance agents in Pakistan (the list this directory is compiled from)](https://www.irs.gov/individuals/international-taxpayers/acceptance-agents-pakistan) - [IRS: ITIN acceptance agents (the list and its notes)](https://www.irs.gov/tin/itin/itin-acceptance-agents) - [IRS: Instructions for Form W-7](https://www.irs.gov/instructions/iw7) - [IRS: Additional ITIN information](https://www.irs.gov/individuals/additional-itin-information) - [IRS: ITIN documentation frequently asked questions](https://www.irs.gov/individuals/international-taxpayers/itin-documentation-frequently-asked-questions-faqs) ## Related posts - [IRS Acceptance Agent vs. Certified Acceptance Agent](https://pakistanirscaa.com/blog/acceptance-agent-vs-certified-acceptance-agent/) - [How to choose an IRS Certified Acceptance Agent in Pakistan](https://pakistanirscaa.com/blog/how-to-choose-irs-certified-acceptance-agent-pakistan/) - [Is a $99 ITIN service in Pakistan really worth it?](https://pakistanirscaa.com/blog/99-dollar-itin-service-pakistan/)