The request arrives in a chat, usually politely: send us your VFS Global login and password and we will take it from here. Sometimes it comes with a form that asks for the password alongside your passport number.
Do not. And the useful part of this article is not the warning - it is the distinction underneath it, because “never send anything” is wrong too. A booking genuinely needs things from you. Just not those things.
Two different piles
Your own paperwork. The applicant details exactly as they appear in the passport, and the documents VFS Global asks for on your route - including scans, where it requires them. There is no way around this: an application cannot be filed without them, and any service claiming otherwise is describing a process that does not exist.
Account credentials. A login, a password, a one-time code sent to an email. These belong to a VFS Global account and there is no legitimate reason for a booking service to hold them.
Almost every warning written about this market collapses the two piles into one and tells you to send nothing. That is not usable advice - it describes a service that cannot work. The usable version is that the first pile is normal and the second is a red flag.
Why the second pile is unnecessary
The part most people do not realise: you do not need a VFS Global account of your own for someone to book on your behalf. The account side is the service’s problem, not yours. Ours is handled entirely on our end - which is why we have nothing to ask you for there, and why the question of “who holds the password” never comes up.
So when a service insists on your credentials, one of two things is true. Either it is working in a way that depends on driving your account from the outside, or it wants the account for something other than your appointment. Neither is a reason for you to hand them over.
What to expect, and when
At the enquiry. Route, visa category, number of applicants, roughly when you need to travel. That is enough to say whether the route is workable and what it costs. Nothing else is needed to have that conversation, and our request form asks for nothing else.
Once the route is agreed. Applicant details as printed in the passport, and the documents your route requires. This is the point at which a real service asks for real things, in conversation, and it should be obvious why each item is needed.
Never, at any stage. A VFS Global login or password. A code from an email or SMS. Anything framed as “we need access to your account”.
The timing matters as much as the content. Documents requested before anyone has established that your route is workable are documents collected for no stated reason.
The fear underneath, and whether it is justified
The worry people actually have is not really about credentials. It is: if I hand this over, can they take my money and disappear, or ruin my application?
Worth separating.
Money. The exposure is entirely about when you pay. A service charging monthly for alerts has your money whether or not anything ever opens. A service charging after an appointment is booked does not. Ours is the second kind, and we would argue for it even if it were not - it is the only structure where our incentive and yours point the same direction.
Your documents. They are needed, so the question is not whether to send them but to whom. Send them after the route and price are agreed, over a channel you chose, to a service with reachable contacts and published terms. Not in a first message, and not to a link that arrived unprompted.
Your application. The consulate decides. Nobody can promise you a visa, and a service that does is telling you something it cannot know. What the appointment does is start the clock; the decision was never in anyone’s gift.
What makes it worse
- Reusing a password. If you have already given a VFS Global password to anyone, change it, and change it anywhere else you used the same one.
- Sending documents over a channel you did not choose. A link that arrives unprompted and asks you to upload a passport is the single most common shape of visa fraud, and official warnings say so.
- Sending documents before anything is agreed. A real service can tell you whether a route is workable without seeing a single scan.
- Believing a screenshot. Confirmed bookings, five-star reviews and busy dashboards are trivially fabricated. Reviews on a platform that verifies them, and a service that will say plainly what it cannot do, are worth more.
- Paying to “hold” a slot. Appointments are not held. That is the practice the tightening in 2026 was aimed at.
How we handle it
We ask for the applicant details and the documents your route requires, once the route is agreed, in conversation - never through a form on a public page. We ask for nothing belonging to a VFS Global account, because nothing there is yours to give: that side is ours.
You pay after the appointment is confirmed. If you want to see the whole sequence first, how it works sets it out.