Rental Application: Anti-Fraud Checklist + Watermark

Box - Downloadable checklist (text / CSV)

Copy the table below for immediate use.

For a CSV file: copy the block below into a file named checklist_rental_application.csv (UTF-8 encoding, ; separator).

CSV file (UTF-8) to import into your tool / spreadsheet

The block below repeats the checklist in a simple format (; separator) for a spreadsheet or tracking tool.

You can adapt it (status, notes, file name, recipient) to match your workflow.

Step;Action;Why;Status;Notes
Check_listing;Compare listing on other websites and verify consistency;Detect fake listings and inconsistencies;To_do;
Check_recipient;Ask for official agency/landlord contact details;Avoid sending to an impersonator;To_do;
Limit_scope;Send only the required documents;Data minimization;To_do;
Duplicate_files;Create a \"send version\" copy;Preserve originals;To_do;
Rename_files;Name with date plus recipient plus type;Traceability;To_do;
Watermark;Add contextual watermark on each document;Deterrence and proof of context;To_do;
Redaction;Hide non-required fields;Reduce identity misuse risk;To_do;
Test_redaction;Test copy/search of text;Avoid fake redaction;To_do;
Delivery_mode;Use expiring link plus restricted access;Limit distribution;To_do;
Password;Encrypt if needed (ZIP/PDF);Additional protection;To_do;
Separate_channel;Send password via separate channel;CNIL recommendation;To_do;
Keep_evidence;Archive email/screenshots/sent version;Incident handling;To_do;
Remove_access;Remove link/share when no longer needed;Reduce exposure;To_do;

Simple settings that work well

• Keep the text short, without ultra-sensitive data (avoid adding your full address, document number, etc.).
• Placement: central diagonal (or a light repeated pattern if you worry about cropping).
• Opacity: low to medium (the goal is to hinder reuse, not make the file unreadable).
• Repetition: useful on documents that are easy to crop (for example ID scans).

12 watermark text templates (copy/paste)

1. RENTAL APPLICATION - Single use - [Agency/Landlord name] - [DD/MM/YYYY]
2. COPY PROVIDED FOR SOLVENCY REVIEW ONLY - [DD/MM/YYYY]
3. CONFIDENTIAL - DO NOT SHARE - [Recipient name]
4. DOCUMENT SENT TO [Recipient name] - Any reuse prohibited
5. RENTAL - APPLICATION - [Recipient name] - [Listing ref]
6. PROOF FOR VIEWING / FILE REVIEW - [DD/MM/YYYY]
7. TENANT FILE - WATERMARKED VERSION - [Recipient name]
8. COPY FOR REVIEW - NOT VALID FOR OTHER USE - [DD/MM/YYYY]
9. RENTAL USE ONLY - [Recipient name] - [City]
10. SENSITIVE FILE - LIMITED SHARING - [DD/MM/YYYY]
11. SENT FOR RENTAL REVIEW - Please delete after decision - [DD/MM/YYYY]
12. RECIPIENT: [Recipient name] - FILE ID: [XXXX]

Tip: if you want a more operational watermark, use template 1 and add a simple internal identifier [DL-2026-02-22-01] (without personal data).

Step-by-step watermarking procedure (all platforms)

The simplest method (Windows / Mac / Android / iOS) is to use a web watermarking tool:

1. Open the watermarking tool.
2. Import the PDF or image.
3. Choose a text (one of the 12 templates), position, opacity and repetition.
4. Generate and download the watermarked version.
5. Rename it immediately with the date + recipient (traceability).

Possible CTAs to place on the page / website:

• "Generate my 'Rental application' watermark (pre-filled)"
• "Download the 12 templates"
• "Receive the checklist by email"
• "Try watermarking 1 document for free"

To go further, also see our watermark guide and our article how to protect your personal documents before sending them.

Security rule: annotation != deletion

If you use a true redaction tool, it should permanently remove sensitive content and ideally hidden data as well (comments, layers, metadata). Adobe documents this principle with its PDF redaction tool.

Quick test (do this every time):

1. Open the final PDF.
2. Try to select / copy text around the redacted area.
3. Use Search: if the hidden word is found, it is not real redaction.

What to redact on a payslip (fictional before / after example)

Payslips often contain identifiers and details that are not needed to assess solvency. The idea: keep what proves income and employment, while limiting what makes identity misuse easier.

Before (fictional)

• Name: Camille Martin
• Full address: 12 rue Exemple, 75000 Paris
• National ID / social security number: 2 86 ...
• Employer + company registration, period, net salary, totals, etc.

After (fictional, often recommended)

• Keep: first/last name, period, employer (at least the name), net pay, and optionally gross total if requested.
• Redact: national ID/social security number, full address if not required, internal identifiers (employee ID), IBAN if visible, internal codes/QR codes.
• Recommended watermark: RENTAL APPLICATION - Single use - Agency X - 22/02/2026
• Then test the result (copy/search) before sending.

Important: what to hide depends on what is actually requested. If a field is explicitly requested, ask for an alternative (for example a certificate) instead of guessing.

What to redact on an ID document (fictional before / after example)

In a rental file, an ID document may be part of the allowed documents. The goal is to add context (watermark) and reduce out-of-context reuse without making the document unusable.

Before (fictional)

• ID card / passport / driver's license: photo, name, date of birth, document number, MRZ (machine-readable zone), etc.

After (fictional, depending on recipient acceptance)

• Keep: photo, name, key dates, validity period, issuing authority.
• Optional (to be validated): hide part of the document number or the MRZ if the agency accepts a less reusable proof.
• Add a very visible watermark (central diagonal), because cropping is common on scanned IDs.
• Recommended watermark: COPY PROVIDED FOR RENTAL - Agency X - 22/02/2026 - DO NOT SHARE

Windows (free)

Option A (simple and robust): redact via image (rasterization)

1. Open the PDF.
2. Display the page containing the sensitive information.
3. Take a screenshot (Snipping Tool).
4. Open the image in Photos / Paint and hide the information.
5. Repeat for each required page.
6. Rebuild a PDF (for example "Microsoft Print to PDF"), then apply a watermark if needed.

Option B (PDF annotation for marking, then export)

You can annotate a PDF with the built-in Microsoft Edge reader (highlighting / annotations).

Warning: a black annotation is not always deletion. Always run the "copy / search" test.

macOS (free)

Option A (simple): screenshot + redaction on image

1. Open the PDF.
2. Take a screenshot of the area / page (Shift + Cmd + 4).
3. Open the screenshot in Preview and hide the fields (black shapes).
4. Export as PDF (or group several images, then export).
5. Apply a watermark afterward if needed.

Option B (iPhone -> Mac Continuity annotation)

Apple documents annotation workflows ("Markup") via iPhone / iPad to work on documents and images.

Again: test that the information cannot be recovered (search / copy).

iOS (iPhone / iPad) (free)

On iPhone / iPad, you can annotate a PDF or an image using Apple markup features (shapes, text, highlighting).

Recommended method (simple for a photo ID)

1. Open the image of your ID in Photos.
2. "Edit" -> Markup tool.
3. Add an opaque black rectangle over the areas to hide.
4. Save a "send version" copy (keep the original intact).
5. Apply a watermark afterward (web tool) if needed.

For a PDF: if you cannot guarantee the annotation removes the information, prefer an image version (page screenshot) for the most sensitive pages, then assemble into a PDF if needed.

Android (free)

ID document (image)

1. Open the photo in Google Photos.
2. "Edit" -> draw / markup.
3. Hide the sensitive fields.
4. Save a copy dedicated to sending.

PDF

For one or two pages: screenshot + redaction on image (similar approach to Windows / macOS).

For a large file: prefer a recognized redaction solution (even paid if used frequently), because the page-by-page screenshot method becomes time-consuming.

Recommended best practices (simple and effective)

CNIL notably recommends:

• encrypting sensitive files when needed;
• using protocols / services that ensure confidentiality and authentication (for example HTTPS, SFTP);
• sending the secret (password / key) through a separate channel;
• limiting availability duration and restricting access to authorized recipients.

From recommendations to practical actions

In practice, you can turn these recommendations into simple actions:

• Prefer a private link (drive / server) with expiration and access restrictions whenever possible.
• If you protect the file (ZIP / PDF), send the link by email and the password by SMS or phone call (separate channel).
• Remove access (or delete the link) as soon as a decision has been made.

Sending email template (copy/paste)

Subject: Rental application - [First name Last name] - [Property address]

Hello [Name / Agency],

Following our discussion about the rental of [address/area], you will find my application file via the link below:

Link (restricted access): [URL]
Available until: [DD/MM/YYYY]
File ID: [DL-XXXX]

For security reasons, the password (if needed) is sent through a separate channel.

Please confirm receipt and, once your decision has been made, deletion of unnecessary copies.

Kind regards,
[First name Last name]
[Phone]

Immediate actions: first reflexes

1. Stop the spread

• Remove access to the link (revoke it).
• Change the password if you used a protected ZIP / PDF.

2. Document everything

• Keep emails, SMS messages, URLs, screenshots, sent versions, date / time.
• Keep a simple timeline: who, when, what, through which channel.

3. Alert the relevant organizations if misuse is observed

The official Service-Public identity theft portal reminds that a victim may file an incident report when there is suspicion, then file a formal complaint once an offense is established. It also details procedures by domain (financial, administrative, digital).

In financial identity misuse cases, actions may include informing banks / financial institutions and performing checks (for example via mechanisms mentioned by public sources).

CNIL also explains response steps (complaint, online pre-complaint, etc.) and recalls the legal framework.

For general public guidance, recent French public service pages (economie.gouv.fr, Banque de France, Service-Public) also provide prevention and response pointers.

Message templates (ready to send)

Message to the recipient (request deletion / clarification)

Hello,

For security reasons, please confirm:
- your identity / role (agency/landlord) and official contact details;
- the exact use of my documents and their retention period;
- deletion of any unnecessary copies.

Without a clear reply, I will remove access to the file.

Kind regards,
[Name]

Message to an organization claiming an unpaid debt / credit you did not take

Hello,

I formally dispute being the originator of [contract/credit] referenced [ref].
I am attaching [complaint/incident report] and request the immediate suspension of any proceedings against me, as well as the disclosure of the elements used to open it (date, channel, supporting documents).

Kind regards,
[Name + contact details]

Where to find official procedures

The Service-Public "Identity theft" guide explains the steps (incident report in case of suspicion, complaint when an offense is established), useful evidence, and domain-specific procedures.

CNIL also details the available options (complaint, online pre-complaint) and the supporting documents sometimes requested depending on the type of misused information.

In addition, Banque de France and economie.gouv.fr pages can help you structure your response depending on the situation (banking, credit, administration, digital misuse).