Rental applications: what tenants and landlords should mask

Mask what the landlord does not need to decide, and watermark every copy with its purpose, date and recipient. Leave visible what they check: your name, income and employer. Before a viewing, share only your name and contact details.

This guide covers France, Germany, the UK and the US, as of September 2026. It is general information, not legal advice.

Why are rental application files a target for fraud?

A rental file is a ready-made identity kit: ID card, payslips, tax notice, proof of address. France's victim-assistance service, Cybermalveillance, warns that fake rental ads are used to collect these documents for identity theft. The French Interior Ministry adds that they can be used to open an online bank account or take out a loan in your name.

The US Federal Trade Commission (FTC) warns that rental scammers may ask for a Social Security number, a driver's license photo and paystubs, then use them to steal your identity. In March 2025, the UK Home Office reported nearly £9 million in rental fraud losses across about 5,000 reported cases the previous year.

What can a landlord ask for, and when?

France. A decree of 5 November 2015 lists what a landlord or agency may request: a valid ID with photo and signature, proof of address, proof of activity and proof of income, such as the last three payslips or one of the last two tax notices. Bank statements, the Carte Vitale health card, the family record book and criminal record extracts are not allowed. The CNIL says the fine can reach €3,000, or €15,000 for a company.

Germany. The DSK, the conference of German data protection authorities, updated its guidance in January 2026. If you view the home on your own, the landlord may check your details against your ID card, but a copy is not necessary and therefore not allowed. Proof of income comes only when you are the chosen candidate, just before signing: a payslip, bank statement or tax assessment, with unneeded details blacked out.

UK and US. In England, landlords must check the right to rent of every adult tenant. For a check on original documents, GOV.UK says they copy them, including the pages with your details, and keep the copies during the tenancy and for one year after. Do not mask those. In the US, the FTC says a landlord does not need your Social Security number or credit score until you have agreed to rent.

What should you mask on each document?

Two numbers need extra care. The CNIL explains that the French social security number identifies you with certainty; only bodies authorised by a specific legal text may use it, such as employers for payroll. A landlord needs your net pay, not that number. German payslips must by law show the tax ID, the social insurance number and church tax data. Church tax reveals a religion, and the DSK says landlords may not ask about religion.

How do you mask and watermark a copy properly?

1. Check that the listing and the person are real before sending anything.
2. Work on a copy and keep the original.
3. Mask the fields from the table with a tool that removes the text, not one that draws a box over it.
4. Try to select or copy the text under each mask. Nothing should come out.
5. Add a watermark with purpose, date and recipient, for example: Copy from Jane Example for Example Lettings only, rental of 12 Example Street, 23 September 2026.
6. Send it through a channel you control, or hand it over in person.

Step 3 matters most. The UK regulator, the ICO, warns that black rectangles drawn over a PDF can leave the text underneath: pasting the document into Notepad can reveal it. It adds that blurring or pixelating can sometimes be reversed. Step 5 follows Cybermalveillance's advice.

In France, DossierFacile, the State's digital rental file, covers your documents with watermarks and shares them by a link you can switch off. FiligraneFacile, another State service, adds a watermark to a document. A tool that works inside the browser, such as ONYRI Sanitize, masks a PDF, Word file or scan without uploading it and exports a flattened copy. Detection is not exhaustive: review every page before you download.

What should agencies and landlords mask before forwarding a file?

Agencies receive many complete files and pass some on. Under the CNIL's 2021 framework for rental professionals, when the agent chooses the tenant, the owner should in principle receive only the shortlisted files. Documents beyond the legal list should be deleted or returned. If a former agent keeps copies in case of a dispute, the CNIL recommends anonymising them where possible, or else pseudonymising them.

• Forward shortlisted files only, and only the pages the owner needs.
• Mask social security numbers, tax IDs and bank details first.
• For a first comparison, labels such as Candidate 1 and Candidate 2 are often enough.
• Delete or return documents that were never allowed.
• In Germany, note that you checked the ID card instead of copying it.
• Set a deletion date for unsuccessful applicants' files.

How long can files be kept? The CNIL considers three months adequate for documents used to assess solvency. The DSK says applicants' data must be deleted once no longer needed, as a rule after six months at the latest where a discrimination claim is possible, and by agents once the lease is signed with someone else.

Frequently asked questions

Sources & references