Is It Safe to Send Your IC Copy to a Malaysian Landlord? How to Watermark It First

The message arrives on WhatsApp before you have even seen the unit: "Boleh hantar copy IC dulu? Nak reserve the room." The listing looks fine, the rent is reasonable, and the agent seems responsive. The whole thing costs you thirty seconds if you just send it — and one leaked identity if it goes wrong.

Renting a room or a unit in Malaysia almost always involves handing over a MyKad copy at some point. That much is not avoidable. What is worth thinking about is which point, to whom, and what is written on the copy when it goes. This guide walks through when a landlord actually needs a copy, when they are asking for more than the situation requires, how the Personal Data Protection Act 2010 applies to individual landlords (the answer surprises most people), and how to watermark the copy before you send it — free, in your browser, without the file ever being uploaded anywhere.

If you want the general playbook for MyKad copies across banks, telcos and employers as well, we cover that in how to watermark your MyKad copy before you submit it. This article stays inside the rental scenario end to end.

What one MyKad copy really hands over

Most people underestimate how much a single IC photocopy gives away, because they read the NRIC number as an opaque serial. It is not. The format is YYMMDD-PB-###G, and every block is public knowledge:

• First six digits: your date of birth (YYMMDD), printed in plain sight.
• Next two digits: a place-of-birth code identifying the state you were born in.
• Last digit: gender — odd for male, even for female.

Add the name, address and photograph printed on the front of the card, and one photocopy is a full identity package. It is enough for a syndicate to apply for personal loans in your name, to register prepaid SIMs used for scams that then trace back to you, or to open a mule account (akaun keldai) that scam proceeds pass through until it gets frozen with your name on it. The first sign most victims get is a debt collection call, a rejected loan application of their own, or a police report they did not file.

None of these attacks need your physical card. They need a clean, unmarked scan. That is specifically the thing a watermark takes away, and it is why a copy sent to a stranger claiming to be a landlord is genuinely riskier than most people treat it as.

The PDPA and individual landlords: the part nobody tells you

Malaysia's Personal Data Protection Act 2010 is the reason most people think their IC copy is protected. It is worth reading closely.

The Act regulates processing of personal data in commercial transactions, and its general principle is that data should be collected for a lawful purpose directly related to the organisation's activity, only to the extent necessary. That gives you real standing when you deal with a bank, a licensed real estate agency, or a professional property management company. Those are commercial actors, they are data users under the Act, and the 2024 amendments (in force through 2025) strengthened the regime further with breach notification and mandatory data protection officers for qualifying data users.

But the Act also has an exemption for personal data processed by an individual only for personal, family or household affairs, including recreational purposes. A person renting out a spare room in their own house, or the second unit they own as a personal investment, may sit inside that exemption. And the Personal Data Protection Commissioner has published tenancy-related guidance clarifying when landlords are considered data users — the short version is that the further you get from "a business renting out units" and the closer you get to "one person renting out one room", the weaker your PDPA-based demands become on that landlord.

This cuts two ways. On one hand, an individual landlord may not be under the same statutory duty to secure your IC copy that a real estate agency is under. On the other hand, they may not have the systems either — a copy of your IC on a personal WhatsApp account gets backed up to Google Drive or iCloud, lives in the phone gallery of whoever they share the login with, and travels with the phone if it gets sold or stolen.

None of this is a reason to refuse to sign a tenancy agreement. It is a reason to send a copy that only works for one specific tenancy — which is what watermarking does.

Every stage of a rental, and what the landlord actually needs

The single most useful distinction is which stage of the rental process you are at when the request arrives. Different stages need different things.

Stage 1 — Enquiry and property viewing

The landlord or agent needs nothing on paper at this stage. None. You are not yet in a relationship where they have a lawful purpose for keeping your identity document. What they need is to confirm you are a real prospect, and a name and phone number is enough for that.

If the appointment is in person, the safest answer to "can I have a copy of your IC first?" is "I'll bring the original to the viewing." If they want to note down the number for a viewing log, they can copy it from the original in front of you and hand the card back — a sighting, not a stored copy. If the appointment is remote (you are overseas and asking a friend or agent to view on your behalf), send a heavily watermarked copy specifically marked "For [agent] viewing appointment on [date] only", not a clean scan.

An agent or landlord who refuses to show a property unless you send the unmarked IC copy first is signalling something. In the best case, they are lazy and want a form-of-ID on file for their own convenience. In the worst case, the listing is not theirs to rent out and the IC copy is the entire product — this is a known pattern with fake listings scraped from Facebook Marketplace and iProperty.

Stage 2 — Booking fee / earnest deposit

This is the highest-risk stage, and it is where most rental scams happen. The typical shape: you see the unit (or a photo of it), the agent asks for a booking fee — often one month's rent — to hold it, and asks for a copy of your IC to draw up the paperwork. Then the earnest deposit vanishes, the agent goes silent, and your IC copy is now in an unknown gallery.

Two things reduce the risk here to a level that is manageable rather than reckless:

• Verify the person, not just the listing. If the person claims to be a REN (Real Estate Negotiator) or REA, their registration number can be checked against the Board of Valuers, Appraisers, Estate Agents and Property Managers (BOVAEP / LPPEH) public register. If the person claims to be the owner, the sale and purchase document or a copy of the title showing their name is a normal thing to ask to see — you are about to hand over money and identity to them, they can show it in return.
• Insist on a proper earnest deposit receipt— issued in the name of the licensed agency (not a personal bank account), noting the unit address, the amount, and the condition that it is applied to the first month's rent or refundable if the tenancy does not proceed. Only then does the IC copy travel, watermarked with "For [agency] earnest deposit — [address] — [date] only".

Stage 3 — Tenancy agreement

This is the point at which a copy is genuinely reasonable. The agreement identifies both parties by NRIC number, both parties sign, and both parties keep a copy. A landlord needs to be able to confirm the person named in the document is the person in front of them.

Watermark this copy with the landlord's full name (or the agency's registered name), the unit address, the phrase "tenancy agreement only", and the date of signing. That is the copy that gets attached to the executed agreement. If the address is already spelled out inside the tenancy agreement, there is no need for the IC copy to travel any further than that.

Stage 4 — Move-in, utility transfer, tenancy stamping

A well-organised handover asks for an IC copy at most once more — for LHDN stamping of the tenancy agreement, or for utility account transfers where the utility company itself is the data user (TNB, Air Selangor, Indah Water). Where the utility company asks in its own name, that is a separate transaction with a separate purpose, so the watermark should name the utility, not the landlord.

What is not reasonable at this stage is the landlord asking for extra copies "in case", or asking to keep your original card "for the file". Extra copies do not have extra purposes; they just have extra places to leak.

Stage 5 — During the tenancy and renewal

You should not be sending new IC copies during a normal tenancy. The landlord already has a copy attached to the signed agreement. If they claim to have lost it and want a fresh scan a year in, that is worth pausing on — an old copy on file at the point where a scam actor took over the landlord's account is more common than most people realise.

At renewal, if a new agreement is being signed, a fresh watermarked copy with the new date is normal. If the tenancy is simply continuing on the old terms, nothing new is needed.

Stage 6 — Move-out and deposit refund

The deposit refund is a common re-request point. A landlord might ask for a bank account slip and, sometimes, an updated IC copy for "records". The bank slip is fine; the new IC copy is not — the agreement they already have on file is the record they need. If they insist, watermark it "For [landlord] deposit refund only — [date]" and move on. What actually reduces risk here is including your bank account details on the same paper as the deposit refund instruction, so that document itself has a fixed purpose.

What to write on the watermark

Three things, in every rental context: the recipient, the purpose, and the date. For renting specifically, adding the unit address is a fourth block worth writing in, because it locks the copy even harder to one specific tenancy.

• Weak: "COPY" or "SALINAN SAHAJA". True of every photocopy ever made. It names nobody, limits nothing, never expires.
• Weak: "For rental". Which rental? A copy that says "for rental" is a copy that fits the next scam too.
• Strong: "For Ahmad bin Ismail — tenancy agreement — Unit A-12-3, [address] — 6 Sep 2026". One landlord, one unit, one purpose, one date.

Write the landlord's full legal name or the agency's registered trading name — not a nickname, not just "landlord". If the copy ever resurfaces attached to a different transaction, the mismatch is obvious on its face.

How to watermark your MyKad in about a minute

The safe way to protect an identity document online is to never put it online in the first place. ImageMarker runs entirely inside your browser — the image is processed on your own device and is never sent to a server. For a document like this, that property matters more than any feature.

1. Open imagemarker.app/en/ on your phone or laptop. No install, no account.
2. Add the photo or scan of your MyKad. It stays on your device the whole time.
3. Type the recipient, purpose, address and date, for example "For [Landlord full name] tenancy agreement — Unit A-12-3, [address] — 6 Sep 2026".
4. Turn on tiled / repeat mode. A single mark in one corner is one crop away from gone. Tiled coverage cannot be removed without visibly wrecking the image.
5. Set opacity to about 40–60%. Legible, but light enough that the name, NRIC and photo underneath stay readable so the landlord can identify you against the document.
6. Check before you send. Zoom in — if the landlord cannot read a field they need, they will ask for a redo and the whole exercise costs you time instead of saving it.
7. Send the marked copy only, then delete the clean original from your gallery and downloads so it cannot be forwarded by accident later.

One quick test for any online tool you use for this: turn on flight mode first. If it still works offline, the processing is genuinely happening on your device. If it stalls, your IC was going to be uploaded.

Rental scam patterns that use IC copies

These are not hypotheticals. They are the specific shapes consumer reports to the Ministry of Housing (KPKT), MCMC and Bank Negara routinely describe.

• The scraped listing. A real property is listed on iProperty or PropertyGuru. A fake agent scrapes the photos and re-lists on Facebook Marketplace or Mudah at a lower price. Urgency is manufactured ("two other people interested"), the IC copy and booking fee are asked for over WhatsApp, and there is never a viewing. Countermeasure: cross-check the listing on the official portal, and refuse to send anything before physically seeing the unit.
• The look-alike agent. Someone impersonates a real REN, sometimes even using their photo and name. If you are asked to bank in to a personal account rather than the agency's corporate account, or if the WhatsApp number is not the one on the agency's official website, treat that as the whole answer.
• The Malaysia-Singapore rental scam. Common with rooms marketed to Singapore-based Malaysians looking for a place in JB. Same pattern — remote enquiry, pressure to send IC and deposit before viewing — with the extra friction of the border making it easier to defer a viewing indefinitely.
• The IC-for-loan-application scam. The "landlord" asks for a clean, high-resolution copy of both sides of the IC. The unit does not exist. The copy is used to apply for personal loans and credit lines. This is why marking the copy specifically for a tenancy at a named unit is not paranoid — it is proportionate.
• The tenancy that never gets signed. Sometimes the "agreement" drags out for weeks, during which your IC copy sits in the landlord's gallery. If a booking has been paid and no draft agreement has arrived within a reasonable window, ask for the copy to be deleted in writing and stop the process.

Beyond the watermark: three more things worth doing

• Strip the EXIF data from the photo before you send it. A phone photo of your IC usually carries GPS coordinates and a precise timestamp. Your MyKad already prints an address; the photo adds a second one — where you actually were when you took it, which for most people is home. Remove them with the EXIF cleaner.
• Send the front of the card only, unless a specific process needs the back. Fewer fields in circulation, less to lose.
• Check your own credit records occasionally. CCRIS (through Bank Negara) and the private credit bureaus will show financing taken out in your name. Catching a fraud application within a month is the difference between a dispute and a debt.

If you are renting from overseas

Malaysians renting a place in KL, Penang or JB from Singapore, Australia or the UK are one of the highest-risk groups here, because the "I can't view in person" friction is the exact opening rental scams need. If you cannot travel back to view before signing, at least the following:

• Send someone you personally know to the unit — a family member, a trusted friend — for the physical viewing. Not the agent's friend.
• Video-call from inside the unit. The person on the other end should be walking through the actual rooms with you, opening windows and cupboards on request. A static photo tour is not a viewing.
• Do the tenancy agreement through a licensed agency with a real address, not a WhatsApp-only landlord. The extra fee is the price of accountability.
• Sign digitally with a service that time-stamps and both parties can access afterwards. A photograph of a signed page on WhatsApp is not the same thing.
• Watermark every copy of your IC that leaves your device with the address of the specific unit, not just the agency name.

What to say when you push back

Most people never push back because they think it makes them look like a difficult tenant. It does not. It makes you look like someone who reads the paperwork, which is exactly the kind of tenant a legitimate landlord wants. Three phrases that do most of the work:

• "Happy to show my original IC at the viewing — I'll send a watermarked copy once we're at the agreement stage."
• "What is the copy used for, and how long do you keep it?" — the two questions the PDPA General Principle already entitles you to have answered when the other side is a data user.
• "I'll send it once the earnest deposit receipt is issued in the agency's name."

FAQ

Q: Is it safe to send my IC copy online in Malaysia?
A: Only when three things are true: the person asking has a legitimate reason (a signed tenancy agreement, KYC for a licensed bank), you know who they actually are, and the copy is watermarked with that recipient, purpose and date. A clean, unmarked IC scan sent to a stranger on WhatsApp is one of the highest-risk things you can do online, because a MyKad copy alone is enough to apply for loans, register SIMs and open accounts in your name.

Q: Can a landlord in Malaysia legally demand a copy of my MyKad?
A: They can ask, and at the tenancy agreement stage it is normal — they need to identify the person they are entering a contract with. But the request has to be reasonable for that specific purpose. An individual landlord renting out a single unit for personal purposes may fall outside the PDPA entirely under its personal or household exemption, which cuts both ways: they may not have the same duty to protect your copy that an agency does, so watermarking before sending is proportionate rather than paranoid.

Q: When can I refuse to send my IC copy to an agent?
A: At the viewing stage, easily. There is no contract, no obligation and no lawful purpose that needs a stored copy of your identity document just to walk through a unit. Offer to show the original for sighting in person, or a heavily watermarked copy marked "For viewing appointment only" if the appointment is remote.

Q: Should I black out my NRIC number when sending to a landlord?
A: Not usually. The tenancy agreement identifies both parties by NRIC number, so masking it means signing a document with a number the landlord cannot verify against the copy. The bigger lever is the watermark, which binds the copy to that one tenancy agreement and one date.

Q: What if the agent asks for my IC copy on WhatsApp before I have even seen the property?
A: Treat that as a signal to slow down. There is no legitimate reason to collect a copy before any relationship exists, and it is one of the standard shapes of property listing fraud in Malaysia. Verify the listing on the agency's official channel, and do not send a clean copy before you have physically seen the unit and met the landlord or a properly credentialled agent.

Q: Does ImageMarker upload my MyKad to a server?
A: No. Everything runs inside your browser, so the image never leaves your device and there is nothing on our side to store or leak. Switch on flight mode and the tool still works — the simplest way to prove it to yourself.

Before you hit send

Renting anywhere in Malaysia is going to involve handing over MyKad copies. What is written on those copies when they go is still your call. Do the viewing first, insist on a proper receipt before the deposit, keep clean scans off WhatsApp, and when a copy has to travel, watermark it so it only fits the tenancy it was made for. That is the difference between a copy that any scammer can reuse and a copy that a legitimate landlord can accept and no one else can.