Aadhaar Fraud in India: Common Scams, Risks & Safety

Aadhaar has become an important part of India's digital identity and financial ecosystem. It is used for identity verification and authentication across different services, including certain banking and digital payment processes.

With this growing use, people naturally have questions about Aadhaar fraud, biometric misuse, fake KYC calls and AEPS-related scams. The good news is that having someone's Aadhaar number alone does not give another person the ability to withdraw money from the linked bank account. UIDAI specifically states that merely knowing an Aadhaar number or having an Aadhaar card is not enough to withdraw money from an Aadhaar-linked bank account.

The bigger concern is the misuse of authentication methods, confidential information or social-engineering tactics. For example, a fraudster may pretend to be a bank representative, ask for an OTP, send a fake KYC link or convince someone to complete an authentication step without properly explaining what it is for.

This is particularly relevant for people using Aadhaar Enabled Payment System (AEPS). NPCI describes AEPS as a bank-led model that allows eligible customers to access banking services through authorised Business Correspondents and Micro ATM or other supported devices using Aadhaar authentication. AEPS supports services such as cash withdrawal, balance enquiry and mini statement, subject to the applicable banking and system requirements.

For this reason, both customers and AEPS retailers need to understand how Aadhaar-related fraud can happen and what simple precautions can reduce the risk.

In this guide, we'll cover common Aadhaar scams, AEPS fraud risks, biometric misuse, fake KYC attempts, Aadhaar authentication history, biometric locking, customer safety tips and precautions for AEPS retailers.

Quick Answer: What Is Aadhaar Fraud?

Aadhaar fraud means the misuse of Aadhaar-related information or authentication methods for an unauthorized purpose. However, simply knowing someone's Aadhaar number is not enough to withdraw money from their bank account. Users should be especially careful with OTPs, biometric authentication, fake KYC requests, phishing messages and suspicious transactions.

What Is Aadhaar Fraud?

Aadhaar fraud is not limited to one particular type of scam. It can involve attempts to misuse someone's identity information, authentication process or personal details.

In many cases, fraudsters use social engineering rather than directly attacking Aadhaar itself. They may create a convincing story and try to make the victim reveal information or perform an action.

Common examples include:

• Fake KYC update requests
• Fraudulent bank calls
• Fake UIDAI-related messages
• Phishing links
• OTP scams
• Fake customer-care numbers
• Unauthorised authentication attempts
• Misuse of personal information
• Fake financial-service offers

The important thing to understand is that an Aadhaar number and Aadhaar authentication are two different things. UIDAI provides multiple authentication methods, including demographic, biometric and OTP-based authentication, depending on the service.

Can Someone Withdraw Money Using Only Your Aadhaar Number?

No. An Aadhaar number by itself is not enough to withdraw money from an Aadhaar-linked bank account.

UIDAI clearly explains that merely knowing someone's Aadhaar number or having a copy of the Aadhaar card does not allow a person to withdraw money from the linked bank account.

This is important because many people receive messages or social-media posts claiming that sharing an Aadhaar number automatically puts their bank account at risk.

That does not mean you should share Aadhaar information carelessly. It is still sensible to provide personal information only when it is genuinely required and to avoid giving confidential authentication details to unknown people.

Never share your banking PIN, password or OTP with an unknown person.

How Does AEPS Fraud Happen?

AEPS allows eligible customers to access certain banking services through authorised touchpoints using Aadhaar authentication. NPCI's AEPS documentation describes biometric authentication as one of the supported authentication methods and lists services including cash withdrawal, balance enquiry and mini statement.

An AEPS-related fraud risk can arise when a person is tricked into an unauthorised transaction or when authentication-related information or processes are misused.

For customers, some useful precautions are:

• Use an authorised AEPS service point.
• Check the transaction amount before completing it.
• Ask the retailer to confirm the transaction details.
• Never disclose an OTP to an unknown person.
• Keep your registered mobile number active.
• Check your bank transaction alerts.
• Review Aadhaar authentication activity periodically.
• Consider biometric locking when biometric authentication is not required.

The goal is not to avoid AEPS. It is to use the service carefully and understand what you are authorizing.

What Is Biometric Misuse?

Biometric information includes authentication characteristics such as fingerprints, iris and face. UIDAI provides a biometric locking facility that allows Aadhaar holders to prevent biometric authentication when they do not want it to be available.

When biometrics are locked, biometric authentication using fingerprint, iris or face cannot be performed. UIDAI notes that a registered mobile number is required to use the biometric locking facility.

This feature can be particularly useful for people who want additional control over when their Aadhaar biometrics can be used.

Common Aadhaar Scams You Should Know About

1. Fake KYC Update Scam

A fraudster may contact you claiming that your bank account, SIM card or financial service will be blocked unless you complete KYC immediately.

They may send a link and ask you to enter:

• Aadhaar details
• PAN details
• OTP
• Banking information
• Other personal information

What to do: Don't click suspicious links. If you believe an update is genuinely required, use the official website or app of the relevant bank or organization.

2. Fake Bank or UIDAI Call

Someone may introduce themselves as a bank employee or government representative and ask you to verify your Aadhaar details.

The caller may create urgency by saying your account will be suspended.

What to do: End the call and contact the organization through its official customer-service channel.

3. OTP Scam

A fraudster may try to convince you that an OTP is needed for KYC, Aadhaar verification or account activation.

The OTP can actually be related to an authentication or transaction request.

Never share an OTP with someone simply because they claim to be a bank or government representative.

4. Fake Customer-Care Scam

Fraudsters sometimes create fake customer-care numbers or profiles. A person searching online for support may accidentally contact a fraudulent number.

The scammer may then ask for personal information or request remote access to the device.

Always use contact details published on the official website or app of the organisation.

5. Phishing Message

A message may claim that your Aadhaar, bank account or KYC needs immediate attention.

It may contain a link designed to collect your information.

Before clicking anything, check the sender and destination carefully.

6. Unauthorised Authentication

If an Aadhaar authentication record appears that you do not recognise, don't ignore it.

UIDAI's Authentication History service allows Aadhaar holders to review authentication records and provides information such as authentication modality, date and time, AUA name, transaction ID, response and error code.

How to Check Aadhaar Authentication History

One of the most useful security features provided by UIDAI is Aadhaar Authentication History.

According to UIDAI, users can view authentication records from the previous six months, with up to 50 records displayed at a time. A registered mobile number is required to access the service.

 
How to check it:

• Open the official UIDAI website.
• Go to Aadhaar Authentication History.
• Enter your Aadhaar number or VID.
• Complete the required verification.
• Select the relevant date range.
• Review the authentication records.

The history can show:

• Authentication method
• Date and time
• AUA name
• Transaction ID
• Authentication result
• UIDAI response code
• Error code, where applicable

If you see an authentication that you did not perform, UIDAI advises contacting the respective Authentication User Agency (AUA) for further information.

Check Aadhaar Authentication History on UIDAI

How to Protect Your Aadhaar Biometrics

UIDAI provides a Biometric Lock/Unlock service to help Aadhaar holders control biometric authentication. Fingerprint, iris and face authentication can be locked through the facility.

When biometrics are locked, biometric authentication cannot be performed until the Aadhaar holder unlocks or disables the biometric lock. A registered mobile number is required for this service.
When should you consider using biometric locking?

If you don't regularly need biometric Aadhaar authentication, keeping biometrics locked can provide an additional layer of control.

If you need to complete a legitimate biometric authentication, you can unlock the biometrics and then use the required service.

Is Sharing Your Aadhaar Number Safe?

Sharing an Aadhaar number is not the same as giving someone access to your bank account. UIDAI states that an Aadhaar number alone cannot be used to withdraw money from an Aadhaar-linked bank account.

Still, you should avoid sharing Aadhaar information unnecessarily.

Before providing it, ask yourself:

• Why is it being requested?
• Is the organisation legitimate?
• Is there an official process for providing it?
• Am I being asked for an OTP as well?
• Is someone pressuring me to act immediately?

Also avoid posting your Aadhaar details publicly on social media, websites or messaging groups. 

Aadhaar Safety Tips for AEPS Customers

If you use AEPS services, keep these simple precautions in mind:

 
1. Choose a Trusted Retailer
Use an authorised AEPS service point rather than an unknown person offering banking services.

2. Check the Amount
Before completing the transaction, confirm the amount being processed.

3. Keep Your Mobile Number Active
Your registered mobile number can help you receive important transaction and authentication-related notifications.

4. Don't Share OTPs
An OTP is confidential. Don't give it to someone simply because they claim to be helping with KYC or banking.

5. Check Transaction Alerts
After a cash withdrawal or other banking transaction, check the confirmation message or account information.

6. Review Authentication History
Regularly checking your Aadhaar authentication history can help you identify activity you don't recognise.

7. Consider Biometric Locking
If you don't need biometric authentication regularly, UIDAI's biometric locking facility can provide additional control.

What Precautions Should AEPS Retailers Take?

Retailers are also responsible for creating a safe environment for customers.

A retailer should:

• Use an authorised AEPS platform.
• Use supported biometric hardware and software.
• Explain the transaction before processing it.
• Confirm the transaction amount with the customer.
• Never ask for unnecessary confidential information.
• Never misuse customer Aadhaar details.
• Never ask customers to reveal passwords or banking PINs.
• Keep customer information confidential.
• Provide transaction confirmation wherever applicable.
• Follow the latest instructions from their service provider, partner bank and relevant authorities.

The retailer should also make sure that customers understand what they are authorizing before completing a transaction.

This is especially important because trust is a major part of assisted digital banking.

What Should You Do If You Notice an Unauthorised AEPS Transaction?

Don't wait if you notice an unfamiliar transaction.

Step 1: Contact Your Bank

Inform your bank immediately and report the unauthorised transaction through its official support channel.

Step 2: Preserve the Evidence

Keep:

• Transaction SMS
• Transaction ID
• Date and time
• Amount
• Screenshots
• Relevant messages
• Any other information related to the incident

Step 3: Check Aadhaar Authentication History

Review your Aadhaar authentication records to see whether there is an authentication event you don't recognise. UIDAI provides details such as date/time, authentication modality, AUA name and transaction information.

 
Step 4: Report Financial Cyber Fraud Quickly

For online financial fraud in India, the National Cyber Crime Reporting Portal provides the 1930 cybercrime helpline for reporting financial fraud.

National Cyber Crime Reporting Portal

Step 5: Follow Up

Keep your complaint/reference number and follow up with the concerned bank or authority.

Aadhaar Fraud Prevention Checklist

Before using any Aadhaar-based or AEPS service, remember:

• Don't share OTPs with unknown people.
• Don't click suspicious KYC links.
• Use official websites and apps.
• Check transaction amounts before confirming.
• Keep your mobile number updated.
• Review Aadhaar authentication history.
• Consider biometric locking when appropriate.
• Use trusted AEPS retailers.
• Keep transaction records.
• Report suspicious financial activity immediately.

Frequently Asked Questions

Can someone withdraw money using only my Aadhaar number?

No. UIDAI states that knowing an Aadhaar number alone is not enough to withdraw money from an Aadhaar-linked bank account.

Is AEPS safe to use?

AEPS is an authorised banking model developed by NPCI, but customers should still follow normal security precautions and use authorised service points.

How can I check my Aadhaar authentication history?

You can use UIDAI's Aadhaar Authentication History service or mAadhaar. A registered mobile number is required.

 
How far back can I check authentication history?

UIDAI states that authentication records from the previous six months can be viewed, with up to 50 records displayed at one time.

 
Can I lock my Aadhaar biometrics?

Yes. UIDAI provides a biometric locking facility covering fingerprint, iris and face authentication.

What should I do if I see an authentication I don't recognise?

Contact the respective Authentication User Agency (AUA) for further details and investigate the related transaction if applicable.

Should I share my Aadhaar OTP with a retailer?

You should not disclose an OTP to someone merely because they claim to be a retailer, bank employee or support representative. Use OTPs only through the legitimate verification process for your own transaction.

 
What should an AEPS retailer do to protect customers?

Retailers should use authorised systems, protect customer information, explain transactions clearly, verify the amount before processing and never misuse customer credentials or authentication information.

 
Where can I report online financial fraud?

The National Cyber Crime Reporting Portal provides the 1930 helpline for reporting online financial fraud in India.

Conclusion

Aadhaar is an important part of India's digital identity ecosystem, but using Aadhaar-based services safely requires basic awareness. The biggest misconception to avoid is that an Aadhaar number alone can be used to withdraw money from a bank account. UIDAI clearly states that this is not the case.

The more practical risks involve scams, fake KYC requests, phishing, OTP misuse, unauthorised authentication and careless handling of personal information. Customers can reduce these risks by using trusted service points, checking transaction details, protecting OTPs, reviewing Aadhaar authentication history and using UIDAI's biometric locking facility when appropriate.

For AEPS retailers, security should be part of everyday customer service. Protecting customer information, using authorised systems and explaining transactions properly can help create a safer and more trustworthy banking environment.

As digital financial services continue to expand in India, security awareness is just as important as convenience. A few careful habits can go a long way toward protecting customers and building greater trust in Aadhaar-enabled banking services.

Official Sources & References

• UIDAI – Official Aadhaar Website — Aadhaar services and security information
• UIDAI – Aadhaar Services — Aadhaar-related online services and security options
• UIDAI – Aadhaar Authentication History — Authentication records and related information
• UIDAI – Biometric Lock/Unlock — Biometric security and locking facility
• NPCI – Aadhaar Enabled Payment System (AEPS) — AEPS services and official information
• National Cyber Crime Reporting Portal — Online financial fraud reporting and cybercrime information