What can someone do with your passport number: eight pages

What the pages say about the number on its own

ITRC, the Identity Theft Resource Center, dates its page 12 December 2018, after the breach of Marriott’s Starwood hotels, although the Marriott release it quotes is dated 4 January 2019. It reports Marriott as saying that about 5.25 million unencrypted passport numbers were among the information accessed, and it says that according to numerous sources, including the US State Department, the number on its own is “not a highly valuable” piece of information for a hacker. Combined with the other data points taken in that breach, ITRC says, the number could be used to “craft a more complete profile” for identity theft, or to build a synthetic identity with more validity.

Identity Guard, a company that sells identity protection, says passport numbers on their own “aren’t particularly valuable” to identity thieves. Paired with a name or an address, it says, the number can give scammers enough to target a person with sophisticated scams, reach online accounts or create fake IDs. It adds that in “most cases” scammers need more than the number, though the number alone could give them a way to look up more leaked information on the dark web, and that a leaked scan is worse because it includes a full name, a date of birth and a photo.

LifeLock, which sells a similar service and ends its page with an offer of it, says that on its own the risk is “relatively low”, and that paired with additional information the number can become a gateway to serious identity theft and fraud. Its four examples are forging a passport, phishing, getting into finances by manipulating a bank, and opening bank accounts, loans or credit cards in the holder’s name.

The Australian Passport Office writes about its own passports. It says its controls, including facial recognition technology, mean that someone else cannot use a travel document for travel, and that a passport number can’t be used by someone else to get a new passport. In the same paragraph it adds that after a breach of passport information there is still a risk from “other types of identity fraud”.

The pages agree on the low reading and on the condition that comes with it. The sellers’ pages stop short of calling the number harmless, and so does the nonprofit’s. On Travel Stack Exchange, a community question-and-answer site, one user’s answer of 1 June 2016 says the information page of a passport holds a legal name, a date of birth and a photograph, and calls the information on it “a significant piece of the puzzle” that someone could use to obtain more information about you. That is one user’s opinion rather than a primary source, so we use it only to show the same point made outside a company or an agency.

What the number can be combined with

IdentityTheft.gov, the FTC’s site, lists passport information beside driver’s license information in its page on information that was lost, stolen or part of a data breach. For both it says an identity thief could try to “impersonate you”. The passport entry tells the reader to report a lost or stolen passport to the State Department, and the page does not separate a missing booklet from an exposed number.

The FTC’s consumer page on identity theft lists what someone could do with a stolen name and address, credit card or bank account numbers, Social Security number or medical insurance numbers: buy things with your credit cards, get new credit cards in your name, open a phone, electricity or gas account, steal your tax refund, get a job, get medical care, or pretend to be you if arrested. That list does not name a passport number, so we cite it for the kinds of misuse and not as a statement about passports.

Identity Guard’s list is longer and written for a number or a scan. It gives eight dangers: gaining access to a bank account, building a synthetic identity, applying for government benefits, opening fraudulent accounts, traveling to other countries under your name, creating a forged passport, targeting you or loved ones with sophisticated scams, and committing employment fraud. On travel the pages differ. Identity Guard says criminals can manipulate passport scans to create legitimate-looking passports that enable international travel; the Australian office, writing about its own passports, says that traveling under another identity with leaked details would need the physical passport.

Phishing is the example that several pages share. Identity Guard says that scammers who have the number but not a full scan will likely phish for more by email, text or call, for example posing as the State Department, saying the passport is due for renewal, and quoting the number with a link. ITRC says scammers take advantage of high-profile events and warns against any email, text or post that plays off fears about compromised passport numbers. The Australian office says a scam can look genuine and lists what it will never ask for in an unsolicited message, among them clicking a link, paying money to release information and giving remote access to a device. How to tell a fake message from a real one is on our phishing page.

The Travel Stack Exchange answer gives a scenario: someone phones an airline, says the email address on a miles account is no longer reachable and offers a copy of an ID. The user who wrote it adds that some airlines might put more roadblocks in the way. It is a worked example from a community answer, not a documented case.

A number exposed is not a booklet lost

USAGov, last updated 24 March 2026, covers the booklet. A lost or stolen passport must be reported to the State Department “right away”, online with Form DS-64, by phone or by mail. Once it is reported, the page says, the State Department invalidates it: “You cannot use it if you find it.” Inside the United States a replacement needs Form DS-11, in person; outside it, the nearest embassy or consulate, and in some cases a limited-validity passport. IdentityTheft.gov points the same way and uses the same words, a lost or stolen passport.

The pages that speak to an exposed number alone do not agree, and the table sets their positions side by side.

ITRC separates the two cases. If the physical document is lost or stolen, it calls that an urgent matter and says to report it to the State Department so that there is a record, which means a later fraud will find it already filed as missing. If only the number was compromised, it says “don’t be too quick to replace it”: because the number by itself does not directly result in identity theft, the page says, a new passport may not come free of charge. It adds that a passport due to expire soon, which the holder planned to replace anyway, need not wait if the holder can show it was compromised, and that the notification letter or email may be needed to explain an early request. In the Marriott case it says the company offered a replacement to anyone who could show the passport caused fraud or identity theft, and tells readers to read the specifics very carefully.

LifeLock goes the other way. Its list of steps says to report the passport as compromised and request a replacement, which it says means that “your old number becomes invalid”. The same list opens with an invitation to buy identity theft protection.

The Australian Passport Office gives three options after a breach. The first is to keep using the passport, which remains valid for travel. The second is to replace it if more than 2 years of validity remain, with a possible reduced application fee and the same expiry date, or to renew it if less than 2 years remain, in which case the remaining validity does not carry over. The third is to ask for immediate cancellation, after which the passport cannot be used for travel or identification and a full application and fee follow. It adds that applying to replace or renew generally cancels the old passport when the application is lodged. For identity checks it says that in many cases the physical passport can still be used in person after a breach, because banks and government departments verify documents through the Document Verification Service.

One limit on all of this: the State Department’s own page on lost and stolen passports returned a security wall when we tried to read it, so we do not know what it says about an exposed number alone. USAGov and IdentityTheft.gov speak of a passport that is lost or stolen.

A number you can swap and ones you cannot

ITRC makes the point that a replacement passport carries a new number, “unlike driver’s licenses” that retain their issue number. It does not stop there. It says that someone could still use the old number to piece together identifying information, so accounts, travel-related ones above all, still need careful monitoring after the swap.

On the licence, IdentityTheft.gov sends the reader to the nearest DMV branch. The state might flag the license number in case someone else tries to use it, the page says, or might suggest applying for a duplicate. The pages we read do not say whether a duplicate carries a new number, so the ITRC line and the FTC line are not set against each other here.

The Social Security number is the hard case. IdentityTheft.gov says that in “most instances” of lost or stolen numbers a new one cannot be had without evidence that someone else is misusing the number, and that a new number likely will not solve every problem because agencies and other bodies still hold records linking a person to the old one. Read together, the three documents sit at different points: ITRC and LifeLock describe a passport that can be swapped, ITRC describes a licence number that is kept, and IdentityTheft.gov describes a Social Security number that is replaced only in limited circumstances.

What the pages say to do this week

IdentityTheft.gov gives the steps for any lost, stolen or breached information, and repeats them under the passport entry: check, freeze and monitor credit. Credit reports are free at AnnualCreditReport.com, and the page says they can be checked online every week for free. A credit freeze is free to place, or to temporarily lift, and a free one-year fraud alert can be placed by contacting one of the three credit bureaus. The page also says to accept free credit monitoring if a company offers it. Our page on the credit freeze and the credit lock sets out what each does.

If the information is already being used, IdentityTheft.gov says to report it there, and our page on identity theft follows the order of the first hour. Identity Guard and LifeLock list steps of their own, among them watching statements and credit, a fraud alert, a freeze and care with phishing; both end by recommending their own services, and the credit steps (check, freeze, fraud alert) are the ones the FTC page gives for free. If the breach letter named a child, the page on child identity theft covers what the pages say about a child’s details.

On what to share in the first place, the Australian office says never to share photos of a passport online, to disclose passport information only to trusted organisations that legitimately need it, to store it in a safe place, and that it is okay to ask an organisation what it intends to do with the information. ITRC makes a similar point, that unless a piece of identifying information is required, it is worth thinking twice before handing it over, and notes that many consumers fly domestically and stay in hotels without owning a passport. Identity Guard says many hotel chains and other businesses accept alternative forms of ID.

What the pages do not say

The pages we read do not say how often a passport number on its own has led to identity theft. The three statements about its value that we read are judgments, from a nonprofit in 2018 and from two companies that sell protection, and the pages we read do not give a count or a study behind it.

The pages do not say what the State Department says about an exposed number alone, because its page was not readable. USAGov and IdentityTheft.gov speak of lost or stolen passports.

The pages do not say whether a driver’s license duplicate gets a new number; IdentityTheft.gov says only that the state might flag the number or suggest a duplicate. They do not give the current cost or time of replacing a passport with Form DS-11, since USAGov refers readers to the State Department’s current processing times. The court cases and dollar figures on the Identity Guard page carry an asterisk where a source would be in the text we read, so we do not repeat them.

The one page we read from a source that sells nothing and speaks to a number alone for a US passport is ITRC’s, from 2018, written after one breach; the further pages on the subject are from sellers, from a community answer or from the Australian office, which writes about its own passports. We tested nothing, and we replaced no passport.