Fake Aadhaar Update Website Fraud — UIDAI Verification & Recovery (2026)

“Update your Aadhaar online before 14-Jun deadline or your account will be deactivated” — these phrases, with a near-identical UIDAI logo and a near-real domain (``aadhaar-update.in``, ``uidai-update.online``), are the spine of one of India's largest identity-fraud pipelines. This page tells you exactly how to recognise the fake site, how to lock your biometric the moment you've shared anything, and how to recover under RBI / UIDAI rules.

Citizen Crisis Response Network — domain rule
The only official UIDAI domain is uidai.gov.in (and the mAadhaar app). Anything else — ``.in``, ``.online``, ``.co``, ``.help`` — is a fake.

If you suspect a fake Aadhaar-update site or have already shared OTP / biometric / mobile number: (1) immediately lock your biometrics at uidai.gov.in → My Aadhaar → Biometric Lock, (2) call 1947 (UIDAI helpline), (3) file at cybercrime.gov.in / 1930 if money has moved via AePS, (4) check the TAFCOP portal for any SIMs taken in your name, (5) freeze your bank's AePS limit, and (6) raise an Aadhaar-misuse complaint at uidai.gov.in/file-complaint. The sooner you call 1930, the better the chance the banking system can freeze the transferred funds before they leave it.

• How the fake Aadhaar update scam runs
• Six red flags in 30 seconds
• The 30-minute lockdown
• Biometric lock — the single most important step
• If money was already taken via AePS
• Sample complaint to UIDAI
• What not to do
• Can compensation be claimed?
• FAQ

1. Bait — SMS / WhatsApp / email / Google ad: “Your Aadhaar will be deactivated on [date] unless you update it online. Click here.” Look-alike domain. Sometimes a “free document upload” feature.
2. Trap — Cloned UIDAI page asks for Aadhaar number, registered mobile, OTP, and “selfie + photo of original docs.” The OTP is the actual UIDAI OTP triggered against the real UIDAI service, captured live.
3. Drain — Once OTP is in attacker hands, they (a) authenticate AePS withdrawals at “merchant” agents, (b) take SIMs in your name on TAFCOP, © seed identity into mule loan applications.

The drain often happens within minutes of the OTP capture.

Citizen tip — Type ``uidai.gov.in`` directly into the address bar or open the mAadhaar app from the official Play Store / App Store. Never click any link in any message claiming to be from UIDAI.

1. Lock biometrics at uidai.gov.in → My Aadhaar → Biometric Lock (need OTP to your registered mobile)
2. Open TAFCOP (tafcop.sancharsaathi.gov.in) → flag any unknown SIM in your name
3. Pull a CIBIL report (cibil.com) → check for unknown loans / cards
4. Freeze AePS — call your bank; ask to disable AePS withdrawal on this Aadhaar
5. Call 1947 — UIDAI 24×7 helpline; note the complaint reference
6. File at cybercrime.gov.in / 1930 if money has moved
7. Email UIDAI at [email protected] with full details + screenshots of the fake site
8. Change registered mobile at uidai.gov.in only if your SIM is in your control

UIDAI's Biometric Lock is a free service that disables AePS / fingerprint authentication entirely against your Aadhaar number. Once locked:

• No agent can debit your bank via fingerprint at any AePS terminal
• No identity verification using fingerprint is possible until you unlock it
• E-KYC for SIMs / new bank accounts also requires unlock

How to enable:

1. Open uidai.gov.in (clean browser, typed address)
2. My Aadhaar → Aadhaar Services → Lock / Unlock Biometrics
3. Enter Aadhaar + Captcha → Send OTP to registered mobile
4. Enter OTP → Lock

Lock by default; unlock only when you actively need fingerprint authentication (for example, during physical bank account opening).

Warning — If your registered mobile is no longer with you, biometric lock requires a visit to an Aadhaar Seva Kendra. Run the stolen-SIM playbook in parallel.

AePS (Aadhaar enabled Payment System) lets bank-correspondent agents withdraw cash from your bank using your fingerprint. Frauds happen when biometric replicas (silicone fingers from leaked databases) are used at unauthorised agent points.

If you see unauthorized AePS debits:

1. Within 3 working days — zero liability under RBI's Master Direction on Limiting Liability of Customers, 2017
2. Within 7 working days — capped liability (₹5,000–₹25,000 depending on account type)
3. Beyond 7 days — bank's board-approved policy

Steps:

1. Call 1930 (cyber helpline)
2. File at cybercrime.gov.in
3. Email bank's “report unauthorised transaction”; attach UIDAI lock confirmation + 1930 reference
4. Demand temporary credit within 10 working days
5. Bank must resolve in 90 days; escalate to Banking Ombudsman (cms.rbi.org.in) if not

To,
The UIDAI Regional Office (Bengaluru / Chandigarh / Delhi / Guwahati /
Hyderabad / Lucknow / Mumbai / Ranchi)

Subject: Aadhaar misuse via fake update website — request for
investigation under Aadhaar Act §29 and §38 — Aadhaar Reference No.
[VID 16-digit]

Sir / Madam,

I, [Full name], holder of Aadhaar [VID 16-digit, masked first 12], wish
to report that on [date] I encountered a phishing site purporting to
be UIDAI ([URL of fake site]) and shared / had captured my:
  [Aadhaar number / registered mobile / OTP / selfie / scan of card]

I have:
  1. Locked my biometrics on uidai.gov.in (timestamp ___).
  2. Filed at cybercrime.gov.in (Reference: ___) and called 1930
     (Reference: ___).
  3. Reviewed TAFCOP and flagged [N] unknown SIMs in my name.
  4. Pulled CIBIL report (Reference: ___) and flagged [N] suspect items.

I request UIDAI to:
  a) Confirm in writing that my Aadhaar has not been used for any
     unauthorised authentication in the [date] window.
  b) Take action under Aadhaar Act §38 (penalty for unauthorised access)
     against the operators of [URL].
  c) Coordinate with MeitY / I4C for takedown of the fake domain.

Yours faithfully,
[Signature, Name]
[VID, Registered Mobile, Email, Date]

• Do not type your Aadhaar number on any website that isn't ``uidai.gov.in`` or your bank's verified portal.
• Do not share your Aadhaar OTP with anyone — including someone claiming to be from UIDAI / a bank / an Aadhaar Seva Kendra.
• Do not upload a scan of your Aadhaar card on random portals; use the VID (Virtual ID) wherever a partial Aadhaar reference is needed.
• Do not ignore unknown SIMs on TAFCOP — these are the second-stage attack vectors.
• Do not keep biometrics unlocked by default — lock them; unlock only when needed.
• Write your Aadhaar enrolment number on a paper note kept at home, not in your phone.

• AePS / banking refund — RBI Master Direction on Limiting Liability of Customers, 2017 (zero liability if reported within 3 working days)
• Aadhaar Act penalty — UIDAI can penalise the perpetrator under Aadhaar Act §38 and the related penalty sections for unauthorised access; the victim is the complainant
• Consumer court — for a bank's negligence in approving AePS without secondary verification
• DPDP Act 2023 — Data Protection Board can impose penalties on data-handlers who leaked Aadhaar metadata enabling the fraud
• Banking Ombudsman — RB-IOS 2026 (in force 1 July 2026, replacing the 2021 scheme) covers AePS disputes; compensation up to ₹30 lakh (consequential loss) + ₹3 lakh (harassment / time / expense)

1. 0–5 min — Lock biometrics on uidai.gov.in
2. 5–15 min — TAFCOP audit; CIBIL pull
3. 15–25 min — Call 1947 + 1930 if money moved; file at cybercrime.gov.in
4. 25–30 min — Bank's “report unauthorised transaction” form
5. +24 h — Branch visit; written acknowledgement; UIDAI Regional Office written complaint
6. +72 h — RBI bank-dispute window for AePS refund

• Fake KYC update scam
• Block lost / stolen SIM
• PAN-Aadhaar fraud recovery
• AePS Aadhaar fraud recovery
• Fake police notice PDF scam
• UPI fraud recovery
• Banking Ombudsman complaint guide
• Money sent to wrong account

• UIDAI — uidai.gov.in · Helpline 1947
• MHA — National Cyber Crime Reporting Portal — cybercrime.gov.in · 1930
• RBI — Master Direction on Limiting Liability of Customers, 2017
• Banking Ombudsman — cms.rbi.org.in (RB-IOS 2026, in force 1 July 2026)
• CIBIL / CRIF Highmark / Equifax / Experian — credit-bureau dashboards
• TAFCOP / Sancharsaathi — tafcop.sancharsaathi.gov.in
• CERT-In advisories on phishing
• MeitY for fake-domain takedown
• Aadhaar Act 2016 §29 (restrictions on use), §38 (penalty for unauthorised access)
• DPDP Act 2023 + Rules 2025
• BNS 2023 §318 (cheating), §319 (cheating by personation), §336–§338 (forgery)
• IT Act 2000 §66C (identity theft), §66D (cheating by personation using computer resource)

uidai.gov.in → My Aadhaar → Aadhaar Services → Authentication History. Shows last 50 authentications. Anything you don't recognise → file a complaint.

Yes — only from uidai.gov.in. Never from third-party “Aadhaar download” sites.

Yes — for SIM, gas, e-KYC, EPF, ITR. VID is regenerated on demand and limits exposure of the actual Aadhaar number.

Yes — anyone who knows your Aadhaar can intercept OTP. Update mobile at the nearest Aadhaar Seva Kendra with biometric authentication.

Instant. Same for unlock — but unlock auto-relocks within a window. Set lock as default.

No. UIDAI runs voluntary 10-yearly update drives but does not deactivate individual Aadhaars by SMS deadline.

With Aadhaar number alone, no. With Aadhaar + a fingerprint replica or OTP, yes — that's why biometric lock matters.

No. Biometric lock / unlock is free, online, and instant.

Use Masked Aadhaar or VID wherever a copy is requested. Never the full e-Aadhaar with full number visible.

Yes — under BNS 2023 §318 (cheating), §319 (cheating by personation), §336–§338 (forgery), Aadhaar Act §38, and IT Act §66D.

Last reviewed: 17 July 2026.