Too early
A good apartment in Hamburg quickly draws hundreds of applications. That puts a lot of pressure on applicants to look as complete as possible from the very first message. So the whole folder often goes out straight away: payslips, bank statements, a tenant self-disclosure form (Selbstauskunft), sometimes even a copy of one's ID. And all of it to people one has never met.
It is a bit like a concert where at some point everyone stands up. No one sees any better for it. But whoever stays seated suddenly sees nothing at all. I notice something similar with apartment applications: many people send everything as a precaution, because they assume everyone else does the same. Yet most of this information is not needed at this stage at all.
According to the guidance from Germany's federal and state data protection authorities (PDF, in German), last revised in January 2026, information about a person's financial situation is as a rule not needed before a viewing. An ID can be shown. A copy of it, on the other hand, the authorities consider inadmissible. Proof of income is only intended much later, when the apartment is about to be let and a contract is in sight.
So the documents themselves are not the problem. What matters is when they are asked for and how many people receive them.
Too risky
When we started developing Sumia, I first saw this mainly as a question of self-determination. Why should anyone have to send very personal information to many unknown recipients just to be considered for a viewing at all?
The longer I looked into it, the clearer it became to me that this is not only about self-determination, but also about security.
The consumer advice centre for North Rhine-Westphalia, the Verbraucherzentrale NRW, warns of fake apartment listings that criminals use to get hold of money or personal data. ID copies, self-disclosure forms and other documents are especially problematic, as they contain far more information than a first enquiry would require.
How real such cases can get is shown by an indictment brought by the Berlin public prosecutor's office in August 2025, reported by the German daily Berliner Zeitung. A man is alleged to have posed as an employee of non-existent property management companies and to have offered apartments that did not exist as described. He is alleged to have asked applicants for details of their income and employer, and then to have used them, among other things, to open accounts and take out loans.
Those affected are even said to have gone through banks' identity checks themselves, because they believed this was part of the application process.
On top of that, fake listings are not necessarily recognisable as such. The consumer advice centre for Lower Saxony, the Verbraucherzentrale Niedersachsen, points out that they sometimes use real photos and details from existing ads. And the ID copies that supposed landlords use to build trust may belong to uninvolved third parties.
That is exactly why it is a problem that complete documents have become almost a matter of course so early in the process.
And once they have been sent, there is hardly any control over where these documents end up. Anyone who sends their payslip to twenty or thirty places no longer knows who can access it or how long it stays stored there.
Too similar
Despite all these documents, applications do not automatically become more meaningful.
One of my own apartments in Hamburg drew 245 applications within a few days in August. Five people were invited to a viewing. However carefully the other applications had been put together, when almost everyone submits the same documents, it hardly makes a difference.
That is not the applicants' fault. Most of them are simply trying to do everything right in a tight market. At the same time, applications are being written and sent faster and faster. That makes them more complete, but not automatically more credible.
For me, this is exactly where the decisive difference lies: of course anyone can write something about themselves. But a piece of information carries different weight when it has been confirmed by an independent party.
What you can do today
Much of this can already be changed without using Sumia or becoming a member anywhere.
- For an enquiry and a viewing, a few details are enough at first. Proof of income only becomes relevant once a contract is actually on the table.
- Show, don't send. An ID can be shown without handing over a copy for good. If a copy really is required, black out any details that are not needed.
- Take warning signs seriously. These include requests for money before a viewing, unusually cheap offers, supposed landlords who are abroad, or identity checks as a condition for a viewing appointment.
- Act quickly in case of fraud. The Verbraucherzentrale Niedersachsen recommends, among other things, securing evidence, informing the listing platform and reporting it to the police.
How we solve it at Sumia
This is exactly where we started with Sumia: not with even more documents, but with the question of when which information is needed at all.
Our members are confirmed once, in a personal conversation. Among other things, this covers their identity and whether the rent they are aiming for fits their financial situation. ID and proof of income are shown for this, not stored permanently as part of the profile.
After that, the member can share their Sumia business card with an apartment application. The link applies to that particular application, is time-limited and can be revoked.
The principle behind it: confirmed, not rated.
There is no score, no ranking and no publicly visible income figure.
The actual documents only come into play once an apartment is about to be let. Checking and deciding remain with the landlord. Sumia does not broker apartments.
Sumia cannot tell whether a listing is genuine either. What can be changed, though, is how much personal information is sent out at an early stage at all.
What has not been sent cannot sit in someone else's inbox.
In closing
An apartment application does not have to consist of a complete personal file from the very first message.
Documents have their place in the application process. But ideally where they are actually needed: late enough, targeted, and to as few recipients as possible.
This does not fully prevent fraud. But it does reduce the number of sensitive documents that are spread around unnecessarily.
And perhaps, in the end, it should not be the application with the most documents that builds the most trust, but the one whose relevant details have been confirmed in a traceable way.
