Someone asks for a copy of your Aadhaar, your PAN or a cancelled cheque. You open WhatsApp, attach the photo, and it is gone in two seconds. It is also now in their gallery, in their cloud backup, in the chat their colleague was forwarded, and on the shop computer where the file was printed.
This post explains how to share documents securely when the other side only needs to look at something once: what actually happens to a file after you send it, why chat apps and email are the wrong pipe for identity papers, and what to do differently with a shop, a landlord or an office.
- The risk is not the sending. It is the copy that stays behind on the other person's phone for years.
- Share the narrowest thing that answers the question — one page, masked where possible, never the whole folder.
- A one-time link or a passkey-protected share leaves no permanent copy in a chat history.
- For Aadhaar, use the masked version UIDAI provides unless the full number is genuinely required.
- Write on the copy what it is for, and ask the receiver to delete it once the job is done.
What happens to a file after you send it
Most people picture sharing as handing over a sheet of paper. Digital sharing is not handing over; it is manufacturing copies. One WhatsApp send of a PAN card typically creates at least four:
- The copy in your own sent messages, which stays until you clear the chat.
- The copy in the receiver's chat, saved to their gallery automatically on many phones.
- The copy in their phone's cloud backup, which outlives the phone itself.
- The copy they forward to whoever actually needed it — an accountant, a colleague, a head office.
Nothing was hacked in that list. The file simply went where files go. Two years later that dealership has staff you never met, and your identity document is still on their machine.
"What is this person going to do with it, and when are they finished with it?" If the answer is "check a number once", they do not need a permanent copy, and the way you send it should reflect that.
Three rules to share documents securely
Everything below comes back to three habits. They cost about thirty seconds each.
Rule 1: send the narrowest thing that answers the question
A bank asking for address proof does not need your full rent agreement with the deposit amount in it. A shop verifying a warranty needs the invoice, not your card statement. Crop, screenshot the single page, or black out the lines that are nobody's business before you send.
Rule 2: prefer a channel that expires
A chat message is permanent by default. A share that needs a code, or a link that stops working, is temporary by default. Temporary is the right default for identity documents, because you are lending a look rather than giving a copy.
Rule 3: label the copy with its purpose
Where you have to hand over an actual copy, write across it: "For SBI home loan application, March 2026". It does not stop misuse by a determined fraudster, but it makes a stray copy useless for anything else and it tells an honest office that the copy is out of date.
Why chat apps and email are the wrong pipe
This is not about whether WhatsApp encrypts messages in transit. Assume it does. The problem is what sits at the two ends.
| Method | What it is fine for | Where it goes wrong |
|---|---|---|
| WhatsApp or similar chat | A photo of a product, a quotation, anything you would not mind a stranger seeing | Auto-save to gallery, cloud backup, easy forwarding, and a permanent record in two chat histories |
| Email attachment | Invoices, letters, business paperwork | Sits in two mailboxes forever, often synced to a laptop and a phone, and searchable by anyone who gets into either account |
| Open cloud link | Large files for people you trust | A link with no code works for anyone who ever sees it, including in a forwarded message |
| Link plus a code, or a passkey share | Identity documents, bank papers, anything sensitive | Needs one extra step from the receiver, so explain the code when you send it |
| Paper copy in person | Offices that insist on it | You lose track of where the sheet ends up, so always label the purpose |
The last two rows are the ones worth building a habit around. Everything sensitive should travel by a route the receiver has to unlock, and everything you hand over on paper should say what it is for.
How a passkey share differs in practice
A passkey share splits the delivery into two parts: the file goes one way, the six-digit code goes another. The receiver opens the share and types the code to see the document. In VaultStorage that means you send a file from your phone to another phone with a six-digit passkey, and without that code the file does not open.
Three things change because of that split:
- A forwarded link is useless on its own. Whoever it reaches still needs the code from you.
- Nothing lands in a gallery. The receiver views the document rather than automatically saving a copy into their photos.
- You know who you gave the code to. That is one person, by name, rather than a chat that has been forwarded twice.
Say the code out loud on a call, or send it in a different app from the file. Pasting the code directly under the link in the same chat undoes the whole point.
Aadhaar, PAN and what to mask
Identity documents deserve stricter handling than everything else, because they are the raw material for opening accounts in your name.
- Aadhaar: UIDAI offers a masked version, which hides all but the last four digits. For most address or identity checks that is enough. Use the full number only where it is genuinely required and where the organisation is entitled to ask.
- PAN: often needed in full for tax matters, so instead of masking it, control where the copy lands. Never post a PAN image in a group.
- Bank details: a cancelled cheque shows your account number, IFSC and signature together. If someone only needs the IFSC or the account number, type it in a message rather than sending the image of the cheque.
- DigiLocker documents: where the other side accepts a DigiLocker issued copy, use it. The document is fetched from the issuer rather than from your gallery, so nobody is relying on your photograph.
A single request for "Aadhaar, PAN, cancelled cheque and a photo" over a chat, from a number you were given by someone you have not met, is the standard shape of an account-opening fraud. Slow down, call the organisation on a number you found yourself, and ask which single document they need.
Sharing with a shop, a landlord or an office
Each of these has a normal request and an unreasonable one, and knowing the difference saves an argument.
- A shop or service centre needs proof of purchase and sometimes the serial number. It does not need your identity documents. Send the invoice page only.
- A landlord reasonably wants identity and address proof and something showing you can pay. Masked Aadhaar plus a salary slip with the account number blacked out usually does it. A full bank statement is more than the situation needs.
- An office or HR department will need originals sighted and copies kept. Hand these over in person where you can, label each copy with the purpose and the date, and ask how long they retain them.
- An insurance or loan agent should be sending you a secure upload link from the company itself. If the request is coming through a personal WhatsApp number, treat it as unverified until you check.
After the file is delivered
Sharing has an ending, and most people skip it. Two minutes closes the loop:
- Confirm it was received and readable. Otherwise you will send it again, creating another copy.
- Ask for deletion once the work is done. "Once the account is opened, please delete the copies from the chat." Many people will actually do it if asked plainly.
- Clear your own side. Delete the attachment from your sent folder or chat, and empty the deleted items.
- Keep a note of who has what. A short list — who, what document, what date, what for — turns a vague worry into a checkable fact if anything goes wrong later.
That last list is the quiet advantage. Most people cannot name a single organisation holding a copy of their Aadhaar. Being able to name all of them is what makes a problem fixable.
Key takeaways
- Sending a file makes copies; secure sharing is really about limiting how many and for how long.
- Crop, mask and send one page rather than the whole document.
- Use a channel the receiver has to unlock, and send the code by a different route from the file.
- Label every paper copy with its purpose and date.
- Ask for deletion when the job is done, and keep your own list of who holds what.
Questions people ask
The message may travel safely, but that is not the risk. The copy stays in two chat histories, is often saved to the receiver's gallery, rides along into their cloud backup, and can be forwarded in one tap. For identity documents, prefer a share the receiver has to unlock with a code you send separately.
It hides all but the last four digits of the number, while still showing your name, photograph and other details. For many address and identity checks that is enough to satisfy the person asking. UIDAI offers the masked download itself, so you are not editing anything, which is what makes it acceptable to most offices.
Yes, and asking plainly often works. When you send anything sensitive, say what it is for and add one line asking for the copies to be removed once the work is complete. Also ask how long they normally keep documents. An office that cannot answer that question is worth being more careful with.
It helps because the link alone opens nothing. Whoever receives the forward still needs the code, and the code came from you to one named person. The protection only holds if you send the code by a different route from the link, such as saying it on a call rather than pasting it in the same chat.
