Check Whether a Document Request Is Genuine
Verify a sensitive document request by checking the organisation, purpose, recipient and submission route before sending identity or financial files.
On this page (11 sections)▼
A document request is genuine only when you can connect it to a real organisation, an expected purpose and an authorised receiving route. A convincing logo, your correct name or a professional-looking portal is not enough. Before sending sensitive files, verify the request through contact details you already trust and ask what information is actually required.
This guide is for requests such as identity checks, proof of income, account verification or application evidence. It focuses on the decision to disclose documents. A separate check may be needed for a document-signing notification or a suspicious attachment. Here, the main question is simpler: should this person or organisation receive this information at all?
A legitimate business can also make an excessive or poorly routed request. Verification therefore has two stages: establish that the requester is real, then establish that the requested disclosure makes sense.
Match the request to an event you recognise
Write down what you believe triggered the request. Did you apply for a service, book an appointment, start a rental application or contact the organisation yourself? An expected event creates useful context, but it does not validate every message that arrives afterward.
Check the timing and case reference against your own records. If the message claims your application will be cancelled immediately, avoid letting the deadline replace verification. Ask the established organisation whether the request and deadline are real.
Be especially cautious when someone says the normal portal has failed and you must use a new personal address or messaging account. The explanation may be genuine, but the replacement route needs independent confirmation. A convenient workaround should not silently become the authoritative process.
The FTC recommends independently contacting the claimed organisation using a trusted number or website. FTC: recognising and avoiding phishing scams Do not use the telephone number in the questionable message as your only check.
Verify the organisation and the individual separately
A real company name does not establish that the individual works there or is authorised to collect your documents. Start from the organisation’s established website, a known account area or a contact already saved from a genuine interaction. Ask the appropriate team to confirm the request, named staff member and destination.
If an agent or intermediary is involved, clarify which organisation receives the documents and for what purpose. A broker, recruiter or adviser may legitimately act on another party’s behalf, but the chain should be understandable. Ask whether direct submission to the underlying organisation is available.
Do not collect more private information about the requester than needed for verification. Your goal is to confirm their role through the organisation, not to conduct a personal investigation. If the organisation cannot confirm them, hold the disclosure.
| Claimed evidence | Why it is insufficient alone | Better check |
|---|---|---|
| Familiar company logo | Branding can be copied | Start from the known organisation |
| Correct personal details | Details may come from another source | Match to your actual application |
| Staff signature | A signature can be imitated | Confirm role through established contact |
| HTTPS address | Encryption does not establish honest purpose | Confirm the exact destination independently |
| Urgent deadline | Pressure is not authority | Verify deadline with the responsible team |
A verified identity still leaves the purpose and scope to check. A genuine employee may be using the wrong form or asking for an outdated document list.
Ask why each document is needed
Request a plain explanation for every sensitive item. The answer should connect the document to a specific decision, such as confirming an address or assessing an application. Vague language like standard procedure does not help you understand the disclosure.
Ask whether an alternative is accepted. Proof of address might be satisfied by one approved document instead of a complete financial history. The receiving organisation determines acceptable evidence, so do not redact or substitute information without agreement.
Check the stage of the process. A business may need certain evidence later, but not before you have established a relationship. If a stranger asks for identity documents just to provide a general quote, ask why that is necessary. You can hold the request without accusing anyone of fraud.
Separate required documents from optional supporting material. An instruction to upload any useful paperwork is an invitation to overshare. Ask for a specific list and limit your submission to it.
Confirm where the files will go
Find out whether documents enter the organisation’s own system, an external verification provider or a general mailbox. Ask who can access them, how your case is identified and whom to contact if you submit the wrong file. These operational questions often reveal whether the process is well defined.
A branded third-party portal is not automatically suspicious, but the underlying organisation should confirm it. Follow a route supplied from its verified account area or established contact. Do not accept a redirect chain as proof that the destination is approved.
Avoid sending passwords, recovery codes or one-time authentication codes as part of a document check. Those are account secrets, not supporting documents. If the process requires you to sign in, navigate through the organisation’s known route rather than through an unexpected login page.
| Question | Useful answer | Hold the request when |
|---|---|---|
| What is the purpose? | Specific decision and case | No responsible team can explain it |
| Which files are required? | Named evidence and relevant period | Everything is requested without scope |
| Where do I submit? | Independently confirmed route | Only a new personal account is offered |
| Who handles errors? | Identifiable support process | Nobody owns misdirected submissions |
| What happens afterward? | Clear handling and retention explanation | Answers remain inconsistent |
These are decision prompts, not a certification questionnaire. You may not obtain every internal technical detail, but you should obtain enough clarity to decide whether to proceed.
A fictional request that needs clarification
Suppose a fictional tenant, Asha, receives a message after viewing a property. It asks for a passport scan, six months of bank statements and a deposit receipt. The sender uses the letting company’s name but asks for delivery to a personal email address.
Asha calls the company using the number from the appointment record. The office confirms that an application is expected, but it does not recognise the personal address. It provides the established application route and explains which documents are required at this stage.
Asha asks whether a less detailed income document is accepted instead of full statements. The office confirms an approved alternative. She sends that document through the confirmed route and keeps the request confirmation with her application reference.
The outcome is not that all rental document requests are scams. The useful actions are independent contact, destination confirmation and scope clarification. This example is invented and does not establish a legal rule about what any landlord may request.
Decide whether to proceed, hold or decline
Proceed when the organisation, purpose, recipient and route are coherent and you are comfortable with the agreed scope. Record a short note of the confirmation, especially if a staff member approved an alternative document. You do not need an elaborate investigation file for every routine request.
Hold when a detail remains unresolved. Say precisely what needs clarification: the submission address, the reason for a requested identifier or an inconsistency in the case reference. A legitimate team should have a way to route your question.
Decline or stop engaging when the organisation disowns the request or the sender asks for account secrets. If you suspect impersonation, report it to the organisation through its known channel. Avoid forwarding your sensitive attachments along with the suspicious message unless the responsible team explicitly needs them.
A refusal to explain is a reason to pause, not definitive proof of criminal conduct. Keep your language factual. Do not publish personal allegations based only on an unfamiliar domain or a slow response.
If you already sent the documents
Identify exactly what was sent, where it went and when. Include attachments, shared links and any credentials you supplied. The next steps depend on the information, not simply on whether the message looked suspicious.
Contact the genuine organisation through a trusted route to confirm whether it received the files. If a controlled link was used, contain further access where possible. A saved attachment cannot be pulled back merely by changing a link or attempting email recall.
If account credentials were exposed, use the account provider’s recovery and security process. If identity or financial information was exposed, seek appropriate local identity-theft or fraud guidance and contact the relevant institution. Do not wait for an unknown sender to reassure you.
Preserve the original message and basic delivery details for the responsible support or security team. Avoid deleting everything in panic, because the route and timing may matter. Share the evidence only with the people helping resolve the incident.
Make verification easy for the next request
Keep trusted contact details and application references in one place. When you begin a legitimate process, ask how future document requests will arrive and whether a portal message will appear alongside email. This gives you a baseline for unexpected changes.
Use a simple personal release record: organisation, purpose, filenames, date and confirmed route. Do not add the contents of sensitive records to that log. The log should help you remember disclosures without becoming another sensitive document collection.
If a friend or family member helps, explain what they may submit and what requires your decision. A helper should not respond to every follow-up by sending more files automatically. Treat a changed purpose or new recipient as a fresh decision.
Verification works best before the files leave your control. Clear questions and a short pause are usually easier than recovering from an unnecessary disclosure.
Frequently asked questions
Does HTTPS prove the request is genuine?
No. It protects a connection but does not prove who authorised a request or why your documents are needed. Verify the organisation and destination independently.
Can a genuine organisation ask for too much information?
Yes. Ask for the purpose and accepted alternatives, and agree on the minimum useful evidence before sending.
Should I call the number in the request email?
Use a number you already trust or obtain through the organisation’s established website or account route, rather than relying on the questionable message.
Before you proceed
Verify the requester, understand the purpose, confirm the destination and agree on the evidence. That sequence protects your documents without making every legitimate application unnecessarily difficult.
Explore related workflows
Related articles
Sources and editorial disclosure
Primary documentation reviewed October 13, 2026. Worked examples are fictional illustrations. Checklists and decision frameworks are editorial recommendations; product-specific facts are linked to official documentation. These guides do not claim that signed-in product tests or customer projects were performed.
VDR Directory is published by the team behind SendNow. This ownership is relevant when evaluating any product mention. Stock photos illustrate general context; they do not demonstrate software features or identify actual affected people. Controls and tool availability depend on the provider, edition, version, device and configuration. No guide guarantees confidentiality, regulatory compliance, acceptance of altered documents, or search rankings.
Related Guides & Research
Recommended next reading for deal teams and transaction leaders.
Request Sensitive Documents From Clients
Request sensitive client documents with a specific checklist, an approved upload route, clear receipt checks and accountable handling of missing files.
Spot Fake Document-Signing Requests
Check document-signing requests through independent channels. Spot impersonation, verify the sender and respond safely if you clicked a suspicious link.
Sent a Confidential Document to the Wrong Person?
Sent a private document to the wrong person? Contain further access, preserve facts, assess what was exposed, and coordinate the next response.