Why Aadhaar misuse is harder to spot than card fraud
1. Pull your Aadhaar Authentication History — and read it correctly
The part almost nobody explains: a hit in this log doesn't automatically mean fraud. Plenty of legitimate services — your telecom operator's periodic re-verification, a bank's annual KYC refresh, an insurance policy renewal — will show up here too. What you're actually looking for is a transaction type and timing that doesn't match anything you did. A biometric authentication at 2 AM from a state you weren't in, or a burst of OTP authentications within minutes of each other from services you don't recognize, is the actual signal. Isolated demographic-only pings are usually low-risk verification checks, not identity theft.
2. Lock your biometrics — and understand what locking does and doesn't cover
You can lock and unlock through the myAadhaar portal or the mAadhaar app under Biometric Settings, or offline via SMS by texting your last four Aadhaar digits to 1947 to receive an OTP, then sending LOCKUID followed by the digits and that OTP to the same number. What people miss is the asymmetry in duration: locking is permanent until you manually reverse it, but unlocking is temporary — the moment you unlock for a bank visit or SIM verification, it stays open for roughly ten minutes and then re-locks automatically. This means the safe default state for someone not actively transacting is locked, and you unlock only in the exact window you need it, not proactively "just in case." OTP-based and demographic authentication continue working normally even when biometrics are locked, so this doesn't cut you off from online services, DigiLocker, or e-KYC flows that rely on OTP.
3. The check almost nobody runs: NPCI mapper vs. bank-side KYC
This is the part that genuinely doesn't get covered well anywhere, and it matters because confusing these two systems is how people miss both fraud and their own government benefits for months. When your bank tells you "your Aadhaar is linked to your account," that statement only confirms bank-side KYC — your Aadhaar number sitting in the bank's own records to satisfy RBI's identity-verification norms. It says nothing about which account actually receives Direct Benefit Transfers, subsidy payments, or is exposed to AePS-based withdrawal. That's governed by a completely separate database: the NPCI Aadhaar mapper, populated through the Aadhaar Payment Bridge System (APBS).
Here's the mechanic that creates fraud risk: your Aadhaar can be seeded — linked — to multiple bank accounts simultaneously if you've opened accounts at different banks and each one pushed a seeding request. But the mapper only ever points to one account as the "primary" — whichever seeding request landed most recently wins, silently overriding the previous one. If a fraudulent account gets seeded against your Aadhaar after yours, every DBT payment and every AePS-eligible withdrawal channel now points there instead of your real account, and neither bank will proactively tell you this happened, because from each bank's individual perspective, nothing looks wrong. You check this through NPCI's Bharat Aadhaar Seeding Enabler (BASE) portal, reachable through the Consumer tab at npci.org.in, where "Aadhaar Mapped Status" shows you the exact bank currently seeded against your Aadhaar in the mapper — not just any bank that happens to have your Aadhaar on file. You can also dial *99*99*1# from your registered mobile for a fast USSD-based check that works even without a data connection. If the bank shown isn't the one you expect, that's not a UI glitch — it means either you have an old, dormant seeding you forgot to update, or someone else's seeding request has silently overridden yours.
4. Check every SIM card issued against your identity — Sanchar Saathi / TAFCOP
Fraudulent SIM issuance using photocopied or leaked Aadhaar details is one of the most common — and most under-reported — misuse vectors, because a fraudulently issued SIM becomes the receiving end for OTPs on your bank accounts, UPI apps, and email recovery flows. The Department of Telecommunications runs a portal now folded into the broader Sanchar Saathi platform, accessible at tafcop.sancharsaathi.gov.in, where entering just your existing mobile number and an OTP returns every active connection registered against your identity nationwide, not just the number you searched from. Anything you don't recognize can be flagged directly as "not my number," which triggers the operator to investigate and disconnect it, typically within about sixty days. The Department also runs a background trigger that sends an automatic SMS alert if more than nine connections are ever registered against a single identity (six in Jammu & Kashmir, Assam, and parts of the Northeast), so if you've ever received that alert unexpectedly, it's worth running this check immediately rather than dismissing it as spam.
5. Pull your credit report — the check that catches loan fraud before collections calls do
Aadhaar-based e-KYC is now the default onboarding flow for a huge share of India's digital lending apps, many of them NBFCs operating with minimal manual verification. If your Aadhaar and PAN details have leaked together, someone can complete an entire loan application through OTP-based e-KYC without ever physically holding your Aadhaar card. The first sign most victims get isn't a UIDAI alert — it's a collections call or a dip in their CIBIL score. Pulling your free annual credit report from CIBIL, Experian, Equifax, or CRIF High Mark and scanning the "enquiries" and "accounts" sections for anything you didn't apply for is, in practice, one of the most reliable indirect signals of Aadhaar misuse that exists, precisely because it catches fraud that never shows up in UIDAI's own authentication log if the lender used offline e-KYC XML verification instead of a live OTP hit.
6. Reduce your exposure surface: Masked Aadhaar and Virtual ID
Every time you hand over a physical photocopy of your Aadhaar for a hotel check-in, a SIM purchase, or a courier KYC, you're distributing a full, reusable copy of your identity number indefinitely. A Masked Aadhaar, downloadable from the same myAadhaar portal, displays only the last four digits printed on the document while remaining fully valid for identity proof under UIDAI's own circular on e-Aadhaar validity. For any situation demanding you type your Aadhaar number into a form or verbally read it out, the 16-digit Virtual ID does the same authentication job without exposing the real number, and it can be regenerated at will if you suspect the one in use has been compromised.
7. If you find something wrong: the first thirty minutes matter most
The moment you spot an authentication entry, a SIM, or a bank seeding you don't recognize, the sequence matters. Lock your biometrics first, since this is instant and shuts the most damaging attack vector immediately. If any money has already moved, call the national cybercrime helpline at 1930 and file a parallel complaint at cybercrime.gov.in before doing anything else — early reporting materially improves the odds of a bank freezing the transaction chain before funds are moved further downstream. Separately, report the Aadhaar-specific misuse to UIDAI itself, either by calling 1947, emailing help@uidai.gov.in, or filing through their online grievance system, since this creates the formal record UIDAI needs to investigate the requesting agency on the backend — something an ordinary police complaint doesn't trigger on its own. Keep every complaint reference number; you'll need them if you later pursue compensation. Victims of negligent data handling have grounds under Section 43A of the IT Act, and Section 47 of the Aadhaar Act specifically empowers UIDAI to initiate complaints against entities that misuse Aadhaar data, which matters if the trail leads back to a private company rather than an individual fraudster.
A Simple Aadhaar Security Routine
None of these checks are one-time. Authentication history should get a quick glance every couple of months, the NPCI mapper status is worth confirming any time you switch primary banks or notice a DBT payment hasn't landed, and the SIM check is worth running after any data breach news involving an app or service you've used your Aadhaar with. Treat biometric locking as the resting state of your identity, not an emergency response — unlock it only in the window you actually need, and let it fall back to locked automatically. The system was built assuming residents would actively monitor their own footprint rather than wait for an alert that, for the most part, doesn't exist yet.
