Aadhaar and PAN photocopies: why sharing them is risky, and what safer sharing looks like

A photocopy of an Aadhaar or PAN card can be copied again, passed on and used without the owner ever knowing, and on its own it proves very little. UIDAI's rules already say an entity must verify the digital signature on Aadhaar's secure QR code before accepting it as proof of identity, and must mask the first eight digits of any copy it keeps. Safer sharing means verifying identity at the source, with consent, and keeping only what the check needs.

What happens to a copy once it leaves your hands

Most people in India have handed over Aadhaar and PAN copies more times than they can count: for a job, a SIM card, a rental agreement, a hotel stay, a loan. Each copy then sits somewhere else. It might be in an HR inbox, a background check agency's folder, a shared drive or a chat group. The owner cannot see where it went, cannot take it back and cannot tell when it is copied again.

That matters because a copy carries enough to impersonate someone wherever a lender or service accepts details without a fresh check. In July 2026, Delhi Police arrested a 24-year-old man from Punjab after a Delhi resident started getting calls from a recovery agent about EMIs on a Rs 4.5 lakh personal loan he had never taken. Police found the loan had been taken using his PAN details, and that the mobile number linked to his Aadhaar had been changed without his knowledge. According to the police, the documents of around 50 people were misused to obtain loans worth about Rs 1.6 crore from private finance companies.

The victim found out only when the recovery calls began. That is the pattern with identity misuse: the person whose details were used is usually the last to know.

A photocopy also proves very little

A photocopy shows what a card says. It does not show that the card is genuine, that it has not been edited, or that the person handing it over is the person it describes. A printout of an altered card looks much the same as a printout of a real one.

UIDAI's rules reflect this. Regulation 16C of the Aadhaar (Authentication and Offline Verification) Regulations, 2021 says an offline verification seeking entity shall not accept an Aadhaar number, in physical or electronic form, as proof of identity without first verifying UIDAI's digital signature in the Aadhaar Secure QR Code. Looking at a photocopy and filing it does not meet that bar. Scanning the secure QR code, or using one of UIDAI's other verification modes, does.

A PAN copy has the same weakness. It shows a number, a name and a date of birth, but nothing on the paper confirms that the person in front of you holds that PAN.

ADi WalletVerified records, shared with a yesPeople hold records fetched from the source, approve every request, see who holds what and can revoke access at any time.See ADi Wallet →

What the law says about collecting and keeping Aadhaar

Several rules apply to organisations that ask for Aadhaar. They are worth knowing even if you never touch the Aadhaar system directly.

• No public display. Section 29(4) of the Aadhaar Act, 2016 says no Aadhaar number, demographic information or photograph collected under the Act shall be published, displayed or posted publicly, except as the regulations allow.
• Consent and purpose for offline checks. Under section 8A of the Act, an offline verification seeking entity must take the person's consent before verifying, use the information only for that verification, and tell the person what will be shared, how it will be used and what alternatives exist. It must not collect, use or store the Aadhaar number.
• Mask what you store. Regulation 14(mb) of the 2021 regulations says Aadhaar numbers collected through physical forms or photocopies must be masked by redacting the first 8 digits before the physical copies are stored.
• Registration for app-based checks. An amendment notified on 9 December 2025 added the Aadhaar Verifiable Credential and offline face verification as verification modes. Entities that want to run Aadhaar Paperless Offline e-KYC or Verifiable Credential checks through the Aadhaar app must now register with UIDAI (regulation 13A).

The data protection law adds a wider layer. The government notified the Digital Personal Data Protection Rules on 14 November 2025, with an eighteen-month period for phased compliance. The law rests on principles that include purpose limitation, data minimisation, storage limitation and security safeguards. If a breach happens, affected people must be told without delay. The highest penalty under the Act, up to Rs 250 crore, applies to a failure to maintain reasonable security safeguards.

A cupboard or shared drive full of identity photocopies is exactly the kind of data these rules are about. Every copy you keep is a copy you have to protect, and a copy you may have to explain.

Safer sharing for individuals

• Share a masked Aadhaar where you can. UIDAI's My Aadhaar services include a masked Aadhaar download, which hides the first eight digits and shows only the last four.
• Ask what the copy is for. If someone needs only to confirm your identity, they can scan the secure QR code or use another verification mode instead of keeping a copy. If you must hand over a copy, write the purpose and the date across it.
• Check your credit report once a year. The Reserve Bank of India requires credit information companies to give individuals one free full credit report a year. Look for loans or cards you do not recognise.
• Check what is reported against your PAN. The Annual Information Statement on the income tax e-filing portal shows transactions reported against your PAN, and you can give feedback on entries you dispute. The department notes it may not show every transaction, so treat it as one signal, not a complete record.
• Act quickly on misuse. Report suspected identity fraud on the National Cyber Crime Reporting Portal, file a police complaint, and raise a dispute with the lender and the credit bureau.

Safer practice for HR and compliance teams

Most organisations collect identity copies out of habit, not because a law asks them to keep paper. A few changes reduce the risk for candidates and for you.

1. Verify instead of collecting

Decide what you actually need to know. Usually it is that the person is who they say they are. A verification result answers that. A stack of photocopies does not. Use the secure QR code or another verification mode, or work with a partner that confirms identity at the source and gives you the result.

2. If you must keep a copy, mask it

Redact the first eight digits of the Aadhaar number before storing any copy, as regulation 14(mb) requires of requesting entities. It is a sensible default for everyone else too.

3. Stop forwarding copies

Each time a copy goes from HR to a background check agency, then to a sub-vendor, it lands in one more inbox. Share a verification result or a request the candidate approves, not the document.

4. Tell candidates what you will check

Explain which checks you run, why, and how long you keep the results. Section 8A already asks this of offline verification seeking entities, and it is good practice under the data protection rules for every employer.

5. Set a retention period and keep to it

Write down how long identity records stay on file, who can open them and when they are deleted. Then count how many places one candidate's documents live today: the applicant tracking system, email, the agency, a shared drive. That count is your exposure.

How TheRollNumber helps

In ADi Wallet, Aadhaar is re-validated with a fresh OTP the person enters on each request. Employers see only the last 4 digits and the result, never the full number. PAN, degree and employment records are fetched from the source with the person's consent. They approve every request, see who holds what and can revoke access at any time. An employer using Checkkbox sees "Identity confirmed (Aadhaar, last 4)" in the report alongside education, employment and court record checks, instead of a photocopy in a folder. If your team still collects identity copies at onboarding, talk to us about moving to consent-based checks.

Sources

1. ThePrint (PTI), "Man held by Delhi Police in Rs 1.6 cr loan fraud racket, misused Aadhaar & PAN details of 50 people", July 2026
2. UIDAI, "The Aadhaar (Authentication and Offline Verification) Regulations, 2021", updated as on 15 December 2025
3. UIDAI, "The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016", as amended
4. Press Information Bureau, "DPDP Rules, 2025 Notified", November 2025
5. UIDAI, "My Aadhaar", accessed October 2026
6. Reserve Bank of India, "Free Annual Credit Report to Individuals", September 2016
7. Income Tax Department, "AIS: Annual Information Statement", accessed October 2026
8. Ministry of Home Affairs, "National Cyber Crime Reporting Portal", accessed October 2026