“We can help you. Just send us a photo of your passport.”
Imagine receiving a message like this after asking for assistance in a social media group or contacting an organisation online.
The account looks professional. The person responding seems friendly. They promise to help you access a service or complete an application.
But before sharing personal information, there is an important question to ask:
Do you know who is requesting your data — and why they need it?
For Ukrainian refugees adapting to life in Estonia, Lithuania, and Latvia, online communication is often a convenient way to find information, contact support organisations, and access essential services.
However, searching for assistance should not create additional risks to personal privacy and security.
Understanding how to recognise suspicious requests and protect sensitive information is an important part of staying safe online.
Why Personal Data Requires Special Protection
When applying for social assistance, accessing healthcare, or requesting help with documents, people may need to provide personal information.
Depending on the service, this could include identification documents, contact details, financial information, or health-related records.
Legitimate organisations may sometimes require such information to determine eligibility or provide appropriate assistance.
However, the fact that someone offers help does not automatically mean they should receive access to your personal data.
Before sharing documents or sensitive details, it is important to verify the organisation, understand why the information is needed, and confirm that it will be transmitted through an appropriate channel.
What Information Should You Be Particularly Careful With?
Some types of information require additional caution when communicating online.
1. Passwords and verification codes
Never share passwords, PINs, or one-time verification codes received by SMS or through authentication applications.
These details can allow someone to access your accounts, even if they do not know your password.
2. Banking information
Be cautious when someone requests full payment card details, card security codes (CVV/CVC), online banking credentials, or payment confirmations.
Unexpected requests for banking access or verification payments should be treated as warning signs.
3. Identity documents
Passports, residence permits, and other official documents contain sensitive personal information.
Before sharing copies, confirm that the organisation genuinely requires them and that you are using its verified submission process.
4. Medical and personal information
Health records, diagnoses, medical test results, and information about personal circumstances deserve careful handling.
Such information should be shared only when necessary, with a verified recipient, and through a suitable secure channel.
Three Warning Signs You Should Not Ignore
Not every suspicious request is immediately obvious.
Fraudulent accounts may use official-looking logos, familiar organisation names, or messages designed to create trust.
There are several warning signs worth recognising.
1. Someone pressures you to act immediately
Messages such as “Send your documents within ten minutes or you will lose your assistance” may be attempts to create urgency and prevent verification.
Legitimate deadlines can exist, but unexpected pressure should encourage you to check the request through an independent official contact.
2. You are asked for unnecessary information or unexpected payments
Be cautious when someone requests your password, verification code, or sensitive banking details to confirm eligibility for assistance.
If a request seems unrelated to the service being provided, ask for clarification before taking action.
3. You cannot verify the account
A profile may appear official without actually belonging to the organisation it claims to represent.
A familiar logo, professional description, or large number of followers is not sufficient proof of authenticity.
Four Checks Before Sharing Personal Information
If you are unsure whether a request is genuine, use this simple checklist.
Step 1: Find the organisation’s official website.
Search for the organisation independently rather than relying only on links sent in a private message.
Step 2: Confirm the contact details.
Check whether the social media account, email address, or communication channel is listed on the official website.
Step 3: Ask why the information is needed.
A legitimate service should be able to explain what information is required and for what purpose.
Step 4: Use the appropriate submission method.
When sensitive documents are necessary, use the organisation’s verified and secure submission channel instead of sending them to an unknown personal account.
If anything seems suspicious, stop the conversation until you can verify the request.
What If You Have Already Shared Sensitive Information?
If you realise that you may have sent personal information to an unverified account, taking prompt action can help reduce potential harm.
Depending on the information involved, consider changing affected passwords, enabling additional account security, and contacting your bank if payment details may have been compromised.
If identity documents or medical records were shared, seek advice from the relevant institution or a trusted data protection service about possible next steps.
Keep records of suspicious messages and report potentially fraudulent accounts through the relevant platform.
The appropriate response will depend on what information was disclosed and how it could be misused.
Safe and Confidential Access to Support
For people seeking assistance, confidentiality is particularly important.
Ukrainian refugees may need to discuss sensitive circumstances involving health, family relationships, financial difficulties, legal status, or experiences of discrimination.
These conversations require trust and respectful handling of personal information.
Within RefAid BaltHUB, accessibility, confidentiality, and a person-centred approach are important principles of support.
Through partner organisations in Estonia, Lithuania, and Latvia, the project helps Ukrainian refugees navigate services, access information, and identify relevant assistance.
When contacting any support organisation online, including RefAid BaltHUB, it is important to use verified communication channels and clarify how personal information should be submitted when necessary.
Your Safety Matters Online, Too
Digital services can make support more accessible, particularly for people who face language barriers, mobility challenges, or difficulties reaching organisations in person.
But convenience should never come at the expense of personal security.
You do not need to share every personal detail in your first message. It is reasonable to ask questions, verify an organisation, and understand how your information will be used.
Before you click “Send,” take a moment to check who is receiving your data.
Seeking support should help you feel safer — not expose you to new risks.
If you need assistance navigating available services in Estonia, Lithuania, or Latvia, contact RefAid BaltHUB through its verified communication channels.
