Request for identity credentials through Whatsapp.

They are correct - you will need to submit your passport information at every place in stay in Italy. If you are not being met in person - like a hotel check-in - you will need to submit images of your passport digitally. Copies of your passport data will be stored many places across Italy after your trip - it's just the way it is.

There is really no secret information on your passport and everyone should have a photo of it that you can access in a pinch as a back up anyway. WhatsApp is encrypted and is fine for submitting this information. You will find WhatsApp is the preferred mode of communication by nearly all hotels and hosts.

This is the normal course of things,
=Tod

As noted, the request is probably legit. WhatsApp messages are end-to-end encrypted.

For further security, disconnect from any wi-fi network and use cellular data to make
the transmission. You can also install a VPN on your phone and activate it before sending
the messages.

I also see no reason why you couldn't take the pictures and transmit them before you even
leave for Italy.

How can I protect myself from identity theft in this situation?

By not sending personal information through WhatsApp.

Yes, providing ID is required, but the method being asked here would not make me comfortable. Just because it may be encrypted, it doesn't mean it cannot be viewed by anyone who has access to the recipient's phone or accounts (Google, email, etc.), whether in the same household, or if their own phone or accounts are compromised. Any picture you send through WhatsAp is stored in the recipient's photo gallery on their phone and their cloud, which are NOT encrypted. It's the sending that's encrypted, not the saving, if that makes sense.

This is another reason I stay at hotels and not apartment. I just show my passport when I arrive at check in and never have to send anything beforehand.

Hiredman is right on: this is a normal procedure, and there's nothing in your passport that will compromise your identity. Relax. :O)

Thank you for this information and the caution. Frankly, it is hard to relax with all the news about scams and identify thefts. I am not that savvy about technological stuff so it's not clear to me, at times, what's safe and what's not.

There is really no secret information on your passport

This is true, but doesn't mean everyone would feel comfortable sending strangers photos of it to be stored in that person's cloud. I think this all comes down to personal comfort. If the OP is fine sending photos of their passport to their apartment host's phone then it's ok, but it's also fine for a person to prefer not to.

You can be conservative about your data and not want to send it, but it is required by law in Italy. So if you have booked "no host" lodging you really have no other choice but it send your data electronically in some fashion.

They are also required to keep it for, I think, 5 years by law but Italian privacy groups are fighting to limit retention of customer data after the EU push to strengthen privacy laws.

=Tod

if you have booked "no host" lodging you really have no other choice but it send your data electronically in some fashion.

Exactly. This is the key.

You also just made me think that sometimes at hotels they just glance at my passport and sometimes they take a photocopy. So I'm sure there's photos of my passport sitting in some back filing cabinet somewhere that anyone could access. Funny, I never thought of that before or cared.

What's App is the fantastic way we communicated as a group on our Rick Steves' tour this month.

It was how we also communicated on the days we were traveling on our own with local tours, hotels, airbnbs, organized activities, taxi's etc.

I understand that some options for accommodations will require passport. But I am also a little hesitant in sharing it like that.
But again, hotels do scan your passport, and gate agents at the airport...
Reminded me of the small tour I joined last year in Morocco. Well regarded company and recommended by friends (Portuguese company based in Morocco). They did require a copy of my passport sent through Whatsapp so they could reserve the hotels. I didn't like it, and one of the reasons I usually don't like to join a tour.

This is not an uncommon request across Europe, including the use of WhatsApp for sending sensitive data. There are strict rules about what can happen with your data and how it's processed within the EU, and people can be prosecuted for misuse- if you want more info you can look up GDPR. So it's in the interest of the host to keep your data protected.

Good point about the greater protections in the EU. Our U.S. government has done almost nothing to curtail the abuses.

@Mary:

Your passport does not contain any PHI or other sensitive information, like SSN or credit card number. It just has your name, place and date of birth, your nationality and the date of issuance and expiration date. It doesn’t It doesn’t even show your current address.

Yet, if one has your name, last name and your city of residence, s/he can find online everything about you, including your age, date of birth, current and past addresses, your relatives, your phone number, your email, your employer, the value of your house, how much you paid for it, when you bought it, how much you are paying in property taxes, and so much more information that your passport does not show.

Go to any of the following websites and test for yourself using your name, and you will see how much information about you is already available to everybody:
www.truepeoplesearch.com
www.searchpeoplefree.com
www.zabasearch.com
www.truthfinder.com
www.intelius.com
www.beenverified.com