Is it safe to share your Aadhaar card photo or number?

What someone can and cannot do with your Aadhaar number

UIDAI says that knowing your Aadhaar number, or the bank account linked to it, is not enough for anyone to withdraw money from that account. An Aadhaar check needs something only you have: your fingerprint, iris or face, or an OTP sent to your registered phone.

So the risk sits with the OTP and your biometrics, and with places that accept a photocopy without checking it, which UIDAI says is not good practice. Its advice is to treat Aadhaar like a bank account number or passport: use it where it is needed, and keep it off social media and other public platforms.

Never share your Aadhaar OTP

An Aadhaar OTP completes a check in your name. UIDAI tells holders not to disclose the OTP to anyone unauthorised, and not to share their Aadhaar app PIN with anyone at all.

Use a masked Aadhaar when the full number isn't needed

A masked Aadhaar shows only the last four digits; the first eight are replaced with x's. You get it by choosing the mask option when you download e-Aadhaar from the myAadhaar portal, and UIDAI says e-Aadhaar is as valid as the physical card.

You can also generate a 16-digit Virtual ID (VID) on myAadhaar and use it for authentication instead of your Aadhaar number. UIDAI says a VID can be changed after the end of the calendar day.

In May 2022 a UIDAI regional office advised sharing only masked copies, and the IT ministry withdrew that advice two days later as open to misinterpretation. So a masked copy is a good habit, not a rule every office must accept.

Lock your biometrics and check your history

• Biometric lock. Once on, your fingerprint, iris and face cannot be used for Aadhaar authentication until you unlock them. UIDAI suggests it if you suspect misuse or don't currently use biometric services such as AePS. It needs a registered mobile number.
• Aadhaar lock. A stronger step that stops all authentication, by biometrics, details or OTP, until you unlock it with your latest VID. UIDAI says it is free.
• Authentication history. UIDAI says you can see six months of Aadhaar authentications on its website or app. If your email is linked, UIDAI also emails you after each one.

If you see an authentication you did not make, contact UIDAI on 1947 or at help@uidai.gov.in.

Who actually needs your Aadhaar

UIDAI lists government schemes such as ration distribution and NREGA, banks and telecom operators among those that use Aadhaar authentication, usually when you receive a benefit or sign up for a service. Anyone collecting it should take your consent and tell you the purpose, and UIDAI urges you to insist on that.

A buyer on a marketplace, a match on a dating app or a caller who says they are from your bank does not need a photo of your Aadhaar. If a stranger asks for one to verify you, say no.

If it already happened

1. Check your authentication history on UIDAI's website or app for anything you don't recognise.
2. Lock your biometrics, or lock Aadhaar entirely, until you know what happened.
3. Call UIDAI on 1947 or email help@uidai.gov.in about any authentication you did not make.
4. If you shared an OTP and money moved, call your bank at once.
5. If a SIM or account was opened in your name, tell that operator or bank in writing and keep their reply.

• Call 1930The national cyber fraud helpline. Call within hours if money left your account.
• cybercrime.gov.inFile a complaint online and keep the acknowledgement number.
• Chakshu on Sanchar SaathiReport a fraud call, SMS or WhatsApp number.

Questions