KYC photos, HEIC files and the free converter sites the FBI warned about
If you've done KYC from an iPhone, you may have run into this. The exchange wants your ID as a JPG or a PDF, and your phone hands over a .HEIC file instead. The upload fails, or the form just sits there.
So you search "HEIC to PDF", open the first site and upload a photo of your passport. That last step deserves more thought than it usually gets. A better starting point is a table of HEIC to PDF converters compared side by side. It lists each service's free limit and max file size, and it shows whether you need an account and when your files get deleted.
Why HEIC at all?
iPhones have saved photos as HEIC by default since iOS 11 (2017). It's a good format, roughly half the size of a JPEG at the same quality. Plenty of upload forms still don't accept it, though, and Windows can't open it without extra codecs.
The part this community should care about
In March 2025 the FBI's Denver field office warned about free online file converters. Some of them are run by criminals. The conversion works, so nothing looks off, but the "converter" app the site tells you to install is the malware. Sometimes the downloaded file itself carries it.
The FBI's list of targets included banking credentials and crypto wallets. It also named passwords, plus the session tokens that can get around MFA.
Now picture one of those sites receiving a passport scan and a KYC selfie from someone who is obviously opening an exchange account. I would rather not be that person.
Fake sites aren't the only problem, either. In July 2024, Cybernews found that two PDF services, PDF Pro and Help PDF, had exposed 89,062 uploaded files through an open Amazon S3 bucket. Passports and driving licenses were in there.
Convert on your own device
Your phone can already make a PDF, and nothing gets uploaded.
iPhone
- Photos > select the ID photos > Share > Print
- Tap the Share icon at the top of the print options screen
- Save to Files, then upload that PDF
Mac
Select the files in Finder, Control-click, then Quick Actions > Create PDF.
Windows
Install HEIF Image Extension (free) and HEVC Video Extensions ($0.99) from the Microsoft Store. Then select the photos in File Explorer, right-click, choose Print (it's under Show more options on Windows 11) and pick Microsoft Print to PDF.
If you go through KYC a lot, switch the camera to JPEG and skip the whole thing: Settings > Camera > Formats > Most Compatible.
If you really need an online converter
Borrowed laptop, no other option. It happens. At least pick a known service and read its retention policy, because they differ more than you'd think. Some delete your file right after conversion, while others keep it for up to a day. One free tier stops at two files a day, and another caps processing minutes instead.
The comparison table linked at the top is the quickest way to check. I'd look at the deletion column before uploading anything with your face on it.
My checklist
- Convert ID documents on your own device.
- Don't install a "converter" app or browser extension that a website pushes at you.
- Keep the original HEIC until the exchange has accepted the PDF.
- If you do KYC often, change the camera format.
A file format is a silly way to leak a passport. Ten minutes with the settings above makes it a lot less likely.