KYC fraud in India goes well beyond crude fake cards. It includes insiders who issue real cards on false papers, genuine customers who lend out bank accounts, mobile numbers quietly changed, and callers posing as the bank to "update your KYC". Checking records at the source stops forged and edited documents. The rest needs controls on mobile number changes, cross-checks against independent records, and monitoring after onboarding.
Four ways KYC gets defeated, and one more at hiring
KYC asks two questions: is this person who they say they are, and will they use the account as they said? Recent court orders and police cases show four ways fraud gets past it, and a fifth that HR teams meet when they hire.
1. Fake Aadhaar made from the inside
In a ruling reported on 18 October 2026, the Rajasthan High Court rejected second bail applications from government officials, a programmer and an assistant programmer, accused of helping a man run an Aadhaar enrolment and update centre that did not meet UIDAI's conditions. According to the earlier order refusing them bail, they gave him the password to the state government's network for money, and they are accused of helping prepare forged Aadhaar cards. The court cited national security and said government servants are expected to prevent misuse of the system.
In a separate case reported on 21 October 2026, the Bombay High Court directed UIDAI to produce the documents a foreign national allegedly used to get an Aadhaar card. Investigators say five foreign nationals arrested in Panvel in 2018 had obtained PAN, voter ID and Aadhaar cards on bogus documents, with help from local facilitators. The court said those who helped them must be prosecuted if their role is revealed.
The lesson is uncomfortable. In both cases the fraud ran through the official system: an enrolment centre on a government network in one, cards issued on bogus papers in the other. A check that asks "does this record exist?" will pass such a card. A source check still stops forged and edited documents, but a card issued on false papers needs a second line of defence: matching the person to the record, and cross-checking records from issuers with no link to each other, such as tax, provident fund and education. A made-up identity has to stay consistent across all of them, which is much harder than producing one card.
2. Mule accounts: real people, real KYC, wrong use
A mule account is a bank account that criminals use to move the proceeds of fraud. The Reserve Bank's KYC Directions for commercial banks describe criminals recruiting third parties as "money mules" and using their deposit accounts to launder money from schemes such as phishing and identity theft. When the account holder is a real person, KYC at opening has nothing false to find.
So the directions focus on what happens next. Paragraph 68 requires a bank to monitor accounts to identify mules, act on them, and report suspicious transactions to FIU-IND. If an account turns out to be a mule and no suspicious transaction report was filed, the bank is deemed not to have complied.
The numbers are large. In a written reply to the Lok Sabha, the Ministry of Home Affairs said the Suspect Registry, launched by the Indian Cyber Crime Coordination Centre with banks in September 2024, had by 30 June 2026 received more than 30.48 lakh suspect identifiers from banks and shared 32.08 lakh "Layer 1" mule accounts with participating entities, with declined transactions worth Rs 25,698 crore.
For a lender, the useful question is whether an account's activity fits the person behind it. A confirmed employer, salary history and tax record give you that baseline. An account that suddenly receives many small credits from strangers and passes them on does not fit it.
3. The mobile number is the real key
Bank alerts and one-time passwords go to the customer's registered mobile number, so whoever controls the number receives them. The RBI directions treat the number as part of the identity:
- Accounts opened through Aadhaar OTP e-KYC without meeting the customer must get alerts and OTPs on the number registered with Aadhaar, and the bank needs a Board-approved process for change requests (paragraph 25).
- Other accounts opened without meeting the customer cannot link alternate numbers after due diligence, and transactions are allowed solely from the number used to open the account (paragraph 44).
- When a bank updates KYC remotely through Aadhaar OTP, it must check that the number used matches the one in the customer's profile (paragraph 42).
Telecom rules add a brake on SIM swaps. In August 2023, the Department of Telecommunications announced that a SIM replacement would need complete KYC, followed by a 24-hour bar on incoming and outgoing SMS. The Aadhaar-linked number is a target too. In a loan racket uncovered in July 2026, Delhi Police said the syndicate allegedly changed victims' Aadhaar-linked mobile numbers before taking loans in their names, and routed the money through accounts whose holders were paid a commission for their use.
Treat a number change as a high-risk event, especially when a loan, a limit increase or a new payee follows soon after, and confirm it through a channel the fraudster is unlikely to control, such as a branch visit or a video call. Customers can check which mobile connections are registered in their name on the Department of Telecommunications' Sanchar Saathi portal.
4. "KYC update" scams turn the customer into the weak point
The Reserve Bank warned about this in September 2021 and again in February 2024. Unsolicited calls, SMS or emails push customers to reveal personal or login details, or to install unverified apps, often with a false deadline and a threat to freeze or close the account. Its advice: confirm any KYC request directly with the bank, using a number from its official website, and never share OTPs, PINs or card details with anyone, or KYC documents with people you don't know.
The scam is still running. On 25 October 2026, the Times of India reported that Delhi's Shahdara cyber police had arrested two men from Jamtara, Jharkhand, one of them a 24-year-old BTech graduate, accused of cheating over 50 people. Police said the group advertised credit card KYC assistance on social media and targeted people over 50. Posing as bank officials on video calls, they had victims show their card numbers and CVVs and share their phone screens, which exposed their OTPs.
The scam works partly because KYC updation is real. The RBI directions require periodic updation at least once every two years for high-risk customers, every eight years for medium-risk and every ten years for low-risk ones. A customer with no change can confirm that by registered email or mobile number, an ATM, digital banking or a letter. Say plainly in every reminder that updation happens through the bank's own channels, and that no one from the bank will ask for an OTP, a card number or a shared screen.
5. Identity fraud at hiring
The same tricks show up at hiring. In a case reported in October 2026, Vadodara's Special Operations Group arrested two men who allegedly used forged Indian Army ex-servicemen ID cards to get jobs with security firms in the city. Police also found an Army service book, a certificate of service, a dependent certificate and a pension card.
Age is another target. In Pune, police booked a 19-year-old who allegedly used a fake Aadhaar card and school leaving certificate showing his age as 21 to get married. His original documents put him at 19 years and five months. The case was about a marriage, but the same trick would clear an age bar at hiring.
For an employer, the documents worth forging are the ones that unlock the job: identity, age, degrees, past employment and service records. Confirm each one with the body that issued it, including any ex-servicemen or other status that earns a preference.
What verifying at the source changes, and what it doesn't
| Pattern | What a document check sees | What a source check adds | What you still need |
|---|---|---|---|
| Forged or edited card or certificate | A plausible document | The issuer's record, which will not match | A logged record of the check |
| Real card issued on bogus papers | A genuine card | Proof the record exists, not how it was obtained | Cross-checks with tax, provident fund and education records |
| Mule account | A real customer | Little at opening | A verified job and income baseline, then monitoring and reporting |
| Mobile number takeover | Nothing | Little, if the number on the source record was changed | Extra checks on number changes and a pause before high-value requests |
| Forged service or ID card at hiring | A laminated card | Confirmation from the issuer, or no record | The candidate's consent and a logged record |
Source checks close the forgery gap, not every gap. They work best when several independent records, each confirmed with its own issuer, have to agree.
A short checklist for compliance and HR teams
- Stop judging documents by how they look. Confirm identity, education and employment records with their issuers, with consent, and check that they agree.
- Guard the mobile number. Re-verify every change before acting on the requests that follow it.
- Know what normal looks like. Use verified employment and income to set expectations for account activity, and report activity that does not fit.
- Keep results, not copies. Photocopies of identity cards carry their own risks, so store the outcome of a check instead.
How TheRollNumber helps
TheRollNumber builds checks around the source, not the document. In ADi Wallet, Aadhaar is re-validated with a fresh OTP the person enters on each request, and employers see only the last 4 digits and the result, never the full number. Other records are fetched from the source with the person's consent, and employment is matched across EPFO and TDS records, then confirmed by the past employer. The person approves every request and can revoke access. On Checkkbox, an employer's report shows "Identity confirmed (Aadhaar, last 4)" next to education, employment, court record and other checks. For lenders, we are offering early access for banks and NBFCs to consented identity, employment and income proof that supports their KYC, with a record of every share. To see how source checks would fit your onboarding or hiring flow, talk to us.
Sources
- LiveLaw, "Rajasthan High Court Denies Bail To Government Officials Accused Of Facilitating Fake Aadhaar Cards, Cites National Security Concerns", October 2026
- Bar and Bench, "Persons enabling foreign nationals to get fake Aadhaar, PAN cards must be prosecuted: Bombay High Court", October 2026
- Reserve Bank of India, "Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025", updated as on 1 October 2026
- Press Information Bureau (Ministry of Home Affairs), "Misleading Mobile Applications", August 2026
- Press Information Bureau (Ministry of Communications), "Two reforms introduced for Mobile User Protection to promote a cleaner and safer digital ecosystem", August 2023
- ThePrint (PTI), "Man held by Delhi Police in Rs 1.6 cr loan fraud racket, misused Aadhaar & PAN details of 50 people", July 2026
- Department of Telecommunications, "Sanchar Saathi", accessed October 2026
- Reserve Bank of India, "RBI cautions against frauds in the name of KYC updation", February 2024
- The Times of India, "BTech graduate among 2 arrested for cheating 50+ people through credit card KYC fraud", October 2026
- The Times of India, "2 men arrested with bogus ex-army ID cards", October 2026
- The Indian Express, "19-year-old gets married in Pune using fake documents showing his age as 21, FIR lodged", October 2026
