Aadhaar & PAN Identity-Theft Protection in India (2026 Practical Guide)

What attackers can actually do with your Aadhaar or PAN

It’s useful to be precise about the risk so you act on the real ones.

What an Aadhaar or PAN copy alone usually can’t do

Empty your bank account directly — bank transactions need OTPs, PINs, or biometrics, not just a document image.
Authorise an Aadhaar-based payment without OTP/biometric authentication.

What an Aadhaar or PAN copy can enable

Loan or credit-card applications in your name at lenders with weak verification, especially in fintech.
SIM swap attempts using forged identity documents.
Account opening on services that accept basic e-KYC.
Stitching together a fuller identity over time, by combining the document with a phone number and a selfie.

So the goal isn’t panic — it’s closing the easy avenues quickly.

Do these protective steps today

Lock your Aadhaar biometrics. Visit the UIDAI website or open the mAadhaar app and turn on biometric lock. This blocks fingerprint/iris-based authentication until you unlock it again. Reversible, free, takes a minute.
Switch to masked Aadhaar. When sharing Aadhaar for routine purposes, download and share a masked Aadhaar PDF from UIDAI, which hides the first 8 digits.
Use Aadhaar VID (Virtual ID) where the service accepts it, instead of your full Aadhaar number.
Tell your bank what was shared, and ask them to flag your account for elevated verification.
Enable two-factor authentication on your email and banking. Most attacks need email or SMS, so harden both.
Set a SIM-swap PIN with your telecom operator if they offer one.

Set up monthly monitoring

Identity misuse often shows up weeks or months later. Build a simple monthly habit:

Pull your credit report from CIBIL, Experian, Equifax, or CRIF. Each bureau offers a free annual report, and many offer free monthly checks via apps.
Scan for unfamiliar enquiries or active loans. An unknown enquiry is the earliest warning sign.
Check your email and SMS for unfamiliar OTPs or “welcome to X” messages — those mean someone tried to open an account in your name.
Audit linked apps on your phone monthly — remove anything you don’t recognise.

If you spot actual misuse

Dispute the loan or account immediately with the lender or service provider. Send a written email and keep proof.
File a complaint at cybercrime.gov.in and call 1930.
Raise a dispute with the credit bureau showing the unfamiliar entry — they’re obligated to investigate.
Inform UIDAI if you suspect Aadhaar-linked misuse, and consider unlocking biometrics only for verified, in-person KYC after that.
Document everything with dates and reference numbers — the paper trail decides outcomes.

Safer KYC practice from now on

Only share KYC with regulated, accountable institutions. A WhatsApp agent is not one.
Add a purpose watermark. When you upload an Aadhaar/PAN copy, overlay it with text like “For ABC Bank KYC, 21 Jun 2026 only.” This deters reuse.
Prefer masked Aadhaar / VID whenever a service accepts it.
Never send a clean image plus a selfie to an unverified counterpart. That combination is the most valuable bundle for identity theft.
If asked “just one more document for verification” after the fact, pause. That’s a classic withdrawal-blocking and data-harvesting pattern.

Get human help (free and confidential)

Cyber-crime helpline: 1930
National portal: cybercrime.gov.in
Tele-MANAS: 14416 / 1800-891-4416
KIRAN: 1800-599-0019

Frequently asked questions

I shared my Aadhaar with a betting site — what should I do first?

Lock biometrics via UIDAI today, watch your credit report for new enquiries, and file a complaint at cybercrime.gov.in. Tell your bank too, so they raise verification on your account.

Can someone take a loan in my name with just an Aadhaar copy?

Reputable lenders won’t, but lower-tier fintechs sometimes do with weak verification. That’s exactly what credit-report monitoring catches early.

What is masked Aadhaar?

A version of your Aadhaar PDF where the first 8 of 12 digits are hidden. UIDAI’s site lets you download it. Use it for low-risk verification.

Is Aadhaar VID safer than the Aadhaar number?

Yes for many use-cases — VID is a temporary 16-digit number tied to your Aadhaar that you can regenerate. Use it where services accept VID.

Should I print or share Aadhaar over WhatsApp?

Avoid both for unknown recipients. If you must share, mask it and add a purpose watermark.

Can I unlock biometrics later?

Yes. Lock/unlock is on/off via UIDAI or mAadhaar at any time.

What about PAN misuse?

PAN is required for big financial transactions, so misuse usually appears as unfamiliar enquiries on your credit report or unexpected tax-portal activity. Check both monthly.

Should I file a police FIR right away?

Start at cybercrime.gov.in and 1930. State cyber-cells will guide you on an FIR if needed.

Can KYC documents be revoked?

Not in the literal sense — they’re still your identity. But locking biometrics, using masked Aadhaar going forward, and monitoring credit are the practical equivalents of containment.

Where can I get help for the stress?

Tele-MANAS (14416) and KIRAN (1800-599-0019) — free, confidential.

Aadhaar & PAN Identity-Theft Protection: A Practical Guide for India