Yes, banks generally do scan your ID. Most banks electronically scan your government-issued identification when you open an account, and often again for certain in-branch transactions. Federal law requires them to verify who you are; it does not require them to use a scanner to do it. Scanning is the method banks choose because it’s fast, reduces typos, and produces a digital record that regulators can review during audits.
That distinction matters. What the law demands is verification. The scanner is how the industry has decided to deliver it.
Why the Scan Happens at All
Banks operate under the Bank Secrecy Act and the USA PATRIOT Act. Section 326 of the PATRIOT Act requires every bank to maintain a written Customer Identification Program describing exactly how it will confirm the identity of anyone opening an account. The rule that puts this into practice, 31 CFR 1020.220, tells banks to collect four items before opening an account: your name, date of birth, address, and an identifying number such as a Social Security or taxpayer ID number. The bank then has to verify that information using documents, non-documentary methods, or both. For individuals, an acceptable document is any unexpired, government-issued ID with a photograph that shows nationality or residence, such as a driver’s license or passport.
Nothing in that regulation says the document must be scanned. A teller who looks at your passport and types the details in by hand meets the legal floor. When your bank insists on running the card through a reader, that’s the bank’s internal policy building on the federal minimum, not a law aimed at you.
What the Scanner Actually Captures
When a bank scans a driver’s license or state ID, the device reads the two-dimensional barcode printed on the back of the card. That barcode holds your full legal name, date of birth, residential address, ID number, and expiration date. The scanner’s software drops all of it into the bank’s system instantly, which is why manual entry has largely gone away.
The front of the card usually gets captured too. High-resolution scanners store a digital image of the photograph, physical description, and printed security features. More advanced systems check for infrared and ultraviolet markers embedded in the card stock to spot counterfeits. Banks that offer remote account opening often pair the document scan with a live selfie and use facial-recognition software to compare your face to the photo on the card. That check is a one-to-one biometric match against your own ID, not a search across a database of other faces.
So the bank walks away with two things: a structured data file (name, address, date of birth, ID number) and, in most cases, a stored image of the card itself.
How Long the Bank Keeps It and How It’s Protected
Your scanned information moves into an encrypted internal database. Financial institutions widely use AES-256 encryption for stored customer data, the same standard used for classified government communications. Access is restricted to employees who need the record for account maintenance, fraud investigations, or compliance reporting, and banks log every view of a customer’s identification file.
Federal rules require banks to keep customer identification records for five years after an account is closed. For credit card accounts, it’s five years after the account is closed or goes dormant. Banks aren’t holding your data indefinitely out of preference; they’re holding it because FinCEN and law enforcement may ask for it during that window. Automated systems typically purge records once the retention period ends.
When a bank outsources its scanning technology to a vendor, federal regulators expect the bank to audit that vendor’s controls, negotiate inspection rights into the contract, and receive periodic compliance reports such as SOC audits or PCI assessments. A vendor holding your scanned ID is supposed to meet the same security bar as the bank.
Who Else Can See Your Data
The Gramm-Leach-Bliley Act limits how banks share your nonpublic personal information with outside parties, and your scanned ID data falls within that definition. Before sharing it with nonaffiliated third parties, the bank generally has to give you notice and an opportunity to opt out. The annual privacy notice you receive from your bank is supposed to describe the categories of information collected and when it’s shared.
Several exceptions let the bank share your data without an opt-out: disclosures needed to process a transaction you asked for, disclosures to service providers bound by confidentiality agreements, and disclosures required by law or to prevent fraud. One rule has no exceptions at all. Banks cannot share your account number with nonaffiliated third parties for marketing purposes, regardless of any other choice you’ve made.
State law adds another layer. Roughly 17 states regulate the scanning of ID barcodes, with restrictions on retention, permitted uses, or both. A handful of states have biometric privacy laws that go further, creating a private right of action when companies collect biometric identifiers like facial geometry without proper consent. Statutory damages in those states can range from $1,000 to $5,000 per violation. Because banks have to layer these state requirements on top of federal rules, privacy disclosures look different from one institution to the next.
A newer development is the Consumer Financial Protection Bureau’s Personal Financial Data Rights rule, finalized in late 2024, which would give consumers a right to revoke data access with deletion as the default practice. The first compliance deadline, originally April 2026, has been pushed back to at least June 30, 2026, and the CFPB is reconsidering parts of the rule. Even if it takes full effect, the five-year Bank Secrecy Act retention requirement will likely override a general deletion request during that holding period.
Can You Refuse the Scan?
If you’re opening a new account, refusing the scan is effectively refusing the account. The bank has to complete its Customer Identification Program obligations, and if its internal policy uses scanning as the verification method, declining means the bank won’t open the account. No institution can waive the underlying federal requirement.
For existing customers the answer is softer. Federal law requires verification at account opening, not necessarily at every visit afterward. But banks set their own policies for ongoing transactions, and many require a rescan for higher-risk activity such as large cash withdrawals, wire transfers, or changes to account ownership. Refuse in those situations and the transaction can be denied, the account flagged for review, or in persistent cases, the relationship closed under the bank’s risk management policies.
If your objection is specifically to the electronic scan rather than to presenting your ID at all, it’s worth asking whether the branch can verify you through visual inspection and manual entry. Some banks allow it, especially for routine transactions. Others have built their workflow around the scanner and won’t deviate. A long-standing customer in good standing has more room to negotiate than a walk-in opening a new account.
When the Scan Doesn’t Work
Scanners occasionally flag legitimate IDs as suspicious. It happens with newly issued licenses, cards from states the software doesn’t handle well, or barcodes worn down from years in a wallet. Under the Red Flags Rule, banks must have procedures for these alerts, which can include additional verification questions, contacting the issuing agency, running your information against public databases, or asking for a second form of ID. Non-documentary verification methods, such as checking information against consumer reporting agencies or public databases, are built into the federal rule for exactly this kind of situation.
If a scanner error leads the bank to deny you service or to report adverse information to a checking-account screening service like ChexSystems or Early Warning Services, you can dispute that report with the agency directly. The agency has to investigate and correct or remove unverifiable information, typically within 30 days. Keep a copy of the ID you presented and notes on your communication with the bank; if the problem cascades into a denial at another institution, that record makes it much easier to unwind.