A Practical Legal Guide for Citizens in India 🇮🇳
Imagine this:
You suddenly receive a bank message for an account you never opened.
Or you discover a loan enquiry connected to your PAN.
Or your Aadhaar authentication history shows an authentication that you do not remember making.
Or someone has used your identity documents to register a SIM card, open an account, obtain a financial service, or create an online account.
You may immediately ask:
“Mere Aadhaar ya PAN ka misuse hua hai. Ab main kya karun?”
The important thing is not to panic and not to remain silent.
Misuse of Aadhaar or PAN can become much more serious when the information is used for impersonation, financial fraud, tax-related activity, creation of accounts, obtaining loans or services, or committing another offence in someone else's name.
The good news is that a citizen has several practical steps available: preserving evidence, reporting the misuse to the concerned authority, making a cybercrime complaint where applicable, approaching the police, securing Aadhaar credentials, checking tax information, and taking corrective action with the institution where the misuse occurred.
This guide explains what you should do, whom you should approach, what evidence you should preserve, and when professional legal assistance may become necessary.
🪪1. First Understand: What Does “Aadhaar/PAN Misuse” Actually Mean?
Simply sharing your Aadhaar or PAN does not automatically mean that an offence has occurred.
The real legal issue depends on how your information was obtained and what someone did with it.
For example:
Situation 1: Someone has a copy of your Aadhaar
A person may possess your Aadhaar photocopy without having committed an offence.
However, if they use it without authority to impersonate you or obtain a service in your name, the situation becomes significantly more serious.
Situation 2: Someone uses your PAN to create financial records
Suppose you discover an unfamiliar transaction, financial account, loan-related activity or tax information connected with your PAN.
You should immediately investigate whether the activity actually belongs to you.
Situation 3: Someone impersonates you
This is more serious.
For example:
- someone uses your Aadhaar to pretend to be you;
- someone submits your PAN as their own;
- someone opens an account using your identity;
- someone obtains a loan using your documents;
- someone creates an online account in your name;
- someone uses your identity to commit fraud.
In such circumstances, you should create an official record that you did not authorise the transaction or activity.
That record can become extremely important later.
⚠️2. Why Aadhaar and PAN Misuse Can Become a Serious Problem
Your Aadhaar and PAN are not merely pieces of paper.
They can be connected with several services and databases.
Aadhaar can be used in identity verification and authentication processes, while PAN is extensively used for taxation and financial identification.
Therefore, misuse can potentially create problems involving:
- banking;
- loans;
- insurance;
- SIM/mobile connections;
- financial transactions;
- tax records;
- employment or business documentation;
- government services;
- online accounts;
- KYC;
- fraudulent registrations.
The biggest danger is not necessarily the immediate financial loss.
It can be the creation of a false identity trail.
For example:
«Someone uses your PAN to conduct a financial transaction.»
Later, an authority sees the PAN connected with that transaction.
You may then have to prove:
“I was not the person who carried out this transaction.”
That is why early reporting is extremely important.
🔎3. How Do You Know That Your Aadhaar or PAN Has Been Misused?
Sometimes the victim discovers the misuse only after the damage has occurred.
Look for warning signs such as:
🚩 Unfamiliar financial activity
You receive:
- loan messages;
- credit-card messages;
- bank account notifications;
- transaction alerts;
- financial-service emails;
- recovery calls for a loan you never took.
🚩 Unfamiliar tax information
You discover an unfamiliar transaction or information connected with your PAN.
🚩 Unexpected OTPs
You receive OTPs relating to a service that you never requested.
An OTP alone does not prove identity theft, but repeated unexplained OTPs should not be ignored.
🚩 Aadhaar authentication you do not recognise
If your Aadhaar authentication history contains an unfamiliar authentication, investigate it.
UIDAI provides an Aadhaar Authentication History service through which Aadhaar holders can review authentication records.
🚩 Unknown SIM or account
You discover that a mobile connection, financial account or other service appears to have been obtained using your identity.
🚩 Collection/recovery calls
You receive calls demanding repayment of a loan or financial obligation that you never created.
🚩 Government or tax communication
You receive a communication concerning an activity that you never carried out.
Do not simply ignore such communications.
Ignoring an identity-misuse problem can make the situation harder to explain later.
4. Step One: Don't Delete Anything 📸
This is one of the most important practical rules.
When you discover identity misuse, your first reaction may be to delete suspicious messages or block the person.
Do not destroy potential evidence.
Preserve:
- SMS messages;
- emails;
- WhatsApp conversations;
- screenshots;
- transaction details;
- account numbers;
- loan details;
- application numbers;
- dates and times;
- phone numbers;
- email addresses;
- website links;
- documents received;
- letters/notices;
- payment receipts;
- call recordings where lawfully obtained;
- Aadhaar authentication information;
- tax records;
- bank statements.
Create a separate folder containing all relevant material.
5. Step Two: Determine Exactly What Was Misused 🧩
Don't simply write:
«“My Aadhaar was misused.”»
Try to identify what happened.
For example:
«“On 28 August, I received an SMS from XYZ Bank regarding a loan application that I never made.”»
That is much more useful.
Your complaint should answer:
What?
What exactly happened?
When?
When did you discover it?
Where?
Which bank, company, website, institution or authority is involved?
How?
How did you discover the misuse?
Why do you believe it was unauthorised?
Explain the facts.
What loss occurred?
Mention financial loss, if any.
What action do you want?
For example:
- investigation;
- cancellation of fraudulent application;
- correction of records;
- freezing of fraudulent account;
- removal of unauthorised liability;
- preservation of CCTV/KYC records;
- identification of the person responsible.
6. Step Three: If Aadhaar Is Involved, Secure Your Aadhaar 🔐
If you suspect Aadhaar-related misuse, take preventive measures.
UIDAI provides facilities including Aadhaar locking/unlocking and biometric locking/unlocking. UIDAI explains that biometric locking is intended to strengthen the privacy and confidentiality of Aadhaar biometric data.
Aadhaar holders can also use UIDAI's Aadhaar Lock/Unlock service.
Why is this useful?
If you suspect that someone may attempt unauthorised biometric authentication, locking biometrics can provide an additional protective measure.
However:
«Locking your Aadhaar does not automatically cancel an earlier fraudulent transaction.»
It is primarily a preventive/security step.
Past misuse still needs to be reported separately.
7. Check Your Aadhaar Authentication History 🔍
If you suspect Aadhaar authentication misuse, check your authentication history.
UIDAI provides an Aadhaar Authentication History facility.
Look for:
- date;
- time;
- authentication type;
- authentication result;
- transaction details available in the record.
If you find something suspicious, save screenshots or other relevant records.
These records can help you explain:
«“This authentication does not correspond to any transaction or service requested by me.”»
That can be valuable evidence.
8. What If Someone Used My PAN? 💳
PAN misuse can create a different category of problems.
Suppose someone uses your PAN in connection with:
- a financial transaction;
- business activity;
- tax-related reporting;
- a loan;
- investment;
- account opening;
- fraudulent documentation.
Your first priority should be to identify where your PAN appears and what activity has been attributed to it.
If the issue concerns your Income Tax e-filing account or tax-related identity misuse, the Income Tax Department provides a specific e-filing Account Misuse mechanism. The Department also advises that an online criminal complaint/FIR can be filed through the National Cyber Crime Reporting Portal where appropriate.
9. Check Your Tax Information Carefully 🧾
If you suspect PAN misuse, check the tax information available to you through the Income Tax Department's systems.
Look for unfamiliar:
- transactions;
- income;
- reporting;
- financial information;
- tax-related communications;
- e-filing activity.
If you find something that does not belong to you, do not assume that it is merely a technical error.
First collect evidence.
Then raise the appropriate grievance or correction request.
The Income Tax Department provides a grievance mechanism through its e-filing portal.
10. Step Four: Report Cybercrime Where Applicable 🚨
If your Aadhaar/PAN was used as part of an online fraud, impersonation, financial fraud or other cybercrime, you can report the matter through the National Cyber Crime Reporting Portal.
The official portal provides facilities for reporting cybercrime complaints.
For cyber financial fraud, the national cybercrime helpline is:
📞 1930
The official cybercrime portal identifies 1930 as the Cyber Crime Helpline.
If money has been lost, do not wait unnecessarily.
Speed can matter significantly in financial fraud situations.
11. What Information Should You Keep Ready for a Cybercrime Complaint? 📂
The cybercrime portal asks for relevant incident information and supporting documents.
Depending on the complaint, you may need information such as:
- incident date and time;
- description of the incident;
- identity document;
- transaction details;
- bank/wallet/merchant information;
- transaction ID/UTR;
- amount involved;
- screenshots and supporting material.
The official portal specifically lists transaction-related information such as the bank/wallet/merchant, UTR or transaction ID, transaction date and fraud amount for financial-fraud complaints.
Practical tip
Before filing the complaint, prepare a simple chronology:
Date → Event → Evidence
Example:
28 August → Received loan SMS → Screenshot 1
28 August → Contacted bank → Email 2
29 August → Checked records → Screenshot 3
29 August → Cybercrime complaint filed → Complaint No. XYZ
This makes your case much easier to explain.
12. Should I File an FIR? 👮
If the misuse involves an apparent criminal offence, you should consider approaching the police.
For example:
- identity theft;
- impersonation;
- cheating;
- forgery;
- fraudulent financial activity;
- unauthorised access;
- cyber fraud.
The exact offences will depend on the facts.
You do not need to personally decide the final legal classification before making a complaint.
Your job as the complainant is to explain:
«What happened, what you did not authorise, and what evidence you have.»
The investigating authority can determine the applicable offences.
For cybercrime-related matters, the National Cyber Crime Reporting Portal is an official reporting channel. For emergencies or crimes outside the cybercrime portal's scope, the official portal advises contacting local police; it also lists 112 as the national police helpline.
13.Should I Also Complain to the Bank or Company? 🏦
Absolutely.
Do not rely only on a police complaint.
Suppose someone uses your Aadhaar/PAN to obtain a loan from a particular financial institution.
You should also notify that institution.
Tell them clearly:
«“I did not apply for this service/loan/account and I have not authorised the use of my identity documents.”»
Ask them to:
- mark the account/application as disputed;
- investigate the KYC;
- preserve KYC documents;
- preserve application records;
- preserve IP/device information where available;
- investigate the phone/email used;
- stop further disbursement or transactions where possible;
- correct records;
- provide a written response.
Why is this important?
Because even if the police investigation takes time, the institution needs to know immediately that:
«The person connected with the transaction is disputing the transaction.»
14. What If a Loan Was Taken Using My PAN/Aadhaar? 💰
This is one of the most frightening situations.
Suppose you receive:
«“Your EMI is overdue.”»
But you never took the loan.
Do not immediately accept liability.
Write to the lender:
«“I dispute this loan and state that I did not apply for, execute or authorise the said loan.”»
Ask for:
- loan application;
- KYC documents;
- photograph;
- registered mobile number;
- registered email;
- address;
- disbursement account;
- repayment account;
- IP/device details, where available;
- video KYC records, if applicable;
- e-sign/e-mandate records;
- call recordings, where maintained;
- other documents relied upon for sanction.
The purpose is to establish:
«Who actually applied for the loan?»
15.Don't Admit a Fraudulent Debt by Mistake ⚠️
This is a very important practical point.
Suppose a recovery agent calls you and says:
«“Aapke naam par ₹80,000 ka loan hai. Payment kijiye.”»
Do not casually say:
«“Haan, shayad mera hi hoga.”»
If you genuinely did not take the loan, state clearly:
«“I dispute this liability and did not apply for or authorise the loan.”»
Then communicate in writing.
Keep the conversation factual.
16. What If My PAN Appears in Someone Else's Business Activity? 🏢
This can be particularly serious.
Suppose you discover that your PAN has been associated with:
- a business;
- financial transactions;
- invoices;
- tax reporting;
- purchases;
- sales;
- other commercial activity.
Do not ignore it.
Collect:
- screenshots;
- transaction details;
- tax records;
- notices;
- business details;
- communications.
Then report the discrepancy to the relevant tax authority and, if fraudulent conduct is involved, consider a police/cybercrime complaint.
Your objective is to establish a clear record that:
«You did not conduct or authorise the activity.»
17. Can I Take Action Against a Company That Misused My Data? 🛡️
Potentially, yes—but the legal route depends on who collected the information, how it was processed, whether there was a security failure, what consent/authorisation existed, and what harm resulted.
India has the Digital Personal Data Protection Act, 2023, which provides a statutory framework concerning processing of digital personal data and protection of individuals' personal data.
The government has also published the Digital Personal Data Protection Rules, 2025.
However, citizens should not assume that every accidental disclosure automatically gives rise to the same legal remedy.
The facts matter.
For example:
Scenario A
You voluntarily gave Aadhaar to a legitimate service provider for a stated purpose.
Later, you suspect unauthorised disclosure.
This raises questions about:
- how the information was stored;
- whether it was disclosed;
- whether there was a security incident;
- what safeguards existed.
Scenario B
Someone stole your document and independently used it.
The focus may be more strongly on the person committing the fraud.
Scenario C
An employee deliberately used customer information for fraudulent purposes.
There may be additional legal and regulatory consequences.
18. What If My Aadhaar Was Shared With a Shop/Agent? 🧾
This situation is extremely common.
People often give copies of Aadhaar for:
- rentals;
- SIM cards;
- banking;
- hotels;
- employment;
- registrations;
- financial services;
- government services.
The fact that you voluntarily handed over a copy does not automatically mean you authorised every future use of that document.
If you discover that it was subsequently used for an unrelated purpose, preserve evidence and ask the organisation:
«“For what purpose was my Aadhaar collected, how was it used, and to whom was it disclosed?”»
Ask for a written explanation.
19. Use Masked Aadhaar Where Appropriate 🔐
UIDAI has promoted the use of Masked Aadhaar, which hides the first eight digits of the Aadhaar number on the displayed document while retaining the last four digits.
Where a service provider does not genuinely require the full Aadhaar number and accepts an appropriate alternative, using privacy-preserving identification methods can reduce unnecessary exposure.
But always check the requirements of the particular service.
Do not assume that every institution must accept a masked copy in every situation.
20. What About Sharing Aadhaar on WhatsApp? 📱
Be careful.
People frequently send:
«“Aadhaar bhej do.”»
Then they simply forward a full Aadhaar image through WhatsApp.
This creates unnecessary exposure.
Before sending:
Ask:
Why is it required?
Who is requesting it?
What purpose will it serve?
Is a masked Aadhaar acceptable?
Can another identity document be used?
Where will it be stored?
Will it be deleted after use?
A document should not be shared merely because someone says:
«“Formalities ke liye chahiye.”»
21. What If Someone Has Only My Aadhaar Number?
Don't panic.
Possession of your Aadhaar number by itself does not automatically mean that someone can carry out every transaction in your name.
Aadhaar-related systems may involve authentication mechanisms, OTPs, biometrics, demographic information or other controls depending on the service.
The correct response is therefore:
«Secure your credentials, monitor activity, investigate suspicious authentication, and report actual misuse.»
Do not assume that merely knowing the number proves fraud.
22. What If Someone Has My PAN Number?
Similarly, knowing your PAN does not automatically mean that someone can freely access all your financial information.
However, PAN is an important financial identifier.
Therefore, if you discover an unauthorised transaction or activity associated with it, investigate promptly.
Check your tax-related records and raise the appropriate grievance with the Income Tax Department where necessary. The Department provides online grievance mechanisms through its e-filing portal.
23. What If Someone Is Threatening Me With My Aadhaar Details?
Suppose someone says:
“Mere paas tumhara Aadhaar hai. Main tumhare naam par loan le lunga.”
Take the threat seriously but do not panic.
Preserve:
messages;
number;
email;
voice messages;
screenshots;
payment demands.
If the threat relates to cyber fraud or criminal activity, report it to the appropriate cybercrime/police authority.
Do not send money merely because someone claims:
“I have your Aadhaar.”
24. Can Aadhaar Misuse Lead to Criminal Liability?
Yes, depending on the conduct.
UIDAI explains that the Aadhaar Act contains offences relating to certain types of impersonation, unauthorised access and misuse of identity information. For example, UIDAI states that impersonation through false demographic or biometric information at enrolment can attract criminal consequences.
But it is important to understand:
Not every misuse situation is prosecuted under the Aadhaar Act alone.
Depending on what the person actually did, other criminal laws may also become relevant.
For example, the case may involve:
cheating;
impersonation;
forgery;
fraudulent use of electronic records;
cybercrime;
unauthorised access;
financial fraud.
The exact legal provisions depend on the facts.
25. What About Data Protection Law?
India's data-protection framework is also relevant to the broader question of how personal information is processed.
The Digital Personal Data Protection Act, 2023 establishes a framework concerning the processing of digital personal data and protection of individuals' personal data.
The government has also notified the Digital Personal Data Protection Rules, 2025.
However, citizens should distinguish between:
Data breach
Someone's information is exposed or compromised.
Identity theft
Someone actually uses the information to impersonate the person or obtain something.
Fraud
The identity information is used as part of a dishonest scheme.
These may overlap, but they are not necessarily the same legal event.
26.Can I Check Whether My Information Has Been Used in Cybercrime?
The National Cyber Crime Reporting Portal provides a “Report & Check Suspect” facility/database for certain identifiers. The portal cautions that the database is based on public complaints, is not complete, and does not certify that every listed identifier is actually connected with criminal activity.
Therefore:
Use such information as a warning/lead, not as conclusive proof.
⚖️27.When Should You Consult a Lawyer?
Professional legal assistance becomes particularly useful when:
a large loan has been taken in your name;
recovery agents are pursuing you;
your credit profile is affected;
police are treating you as a suspect;
a tax demand has arisen from activity you did not conduct;
a company refuses to correct its records;
your identity was used in a criminal offence;
you suffered substantial financial loss;
you need a legal notice;
litigation or court proceedings have started.
A lawyer can help determine:
the appropriate legal forum;
applicable statutory provisions;
evidence requirements;
notice strategy;
police/cybercrime escalation;
regulatory complaints;
civil remedies;
compensation claims;
court proceedings.
28. What NOT to Do ❌
Don't:
❌ Ignore suspicious messages.
❌ Delete evidence.
❌ Share OTPs.
❌ Share passwords.
❌ Give your Aadhaar/PAN to unknown persons.
❌ Pay a fraudster to “close the case.”
❌ Admit a loan you did not take.
❌ Publicly accuse someone without evidence.
❌ Upload your full identity documents on social media.
❌ Wait for months before reporting serious misuse.
29. What You SHOULD Do ✅
Remember the five golden rules:
1. Detect
Find out exactly what happened.
2. Document
Preserve evidence.
3. Dispute
Tell the institution in writing that the transaction/activity is unauthorised.
4. Report
Use the appropriate cybercrime, police, UIDAI, tax or institutional channel.
5. Follow up
Keep complaint numbers and written responses.
30.Final Citizen Action Checklist 🛡️
If you discover that someone has used your Aadhaar or PAN without permission, remember:
🚨 FIRST
Don't panic.
📸 SECOND
Preserve evidence.
🔍 THIRD
Find out exactly what happened.
🔐 FOURTH
Secure your Aadhaar/account credentials.
🏦 FIFTH
Notify the concerned bank/company/institution.
👮 SIXTH
Report suspected criminal activity to the appropriate police/cybercrime authority.
📞 SEVENTH
For cyber financial fraud, use 1930 promptly.
🧾 EIGHTH
Check relevant tax records if PAN misuse is suspected.
🆔 NINTH
Check Aadhaar authentication history where relevant.
📑 TENTH
Keep every complaint number and written response.
🔐⚖️Conclusion: Your Identity Is Yours—Don't Let Someone Else Create a Legal Problem in Your Name.
⚠️ Legal Disclaimer
This article is intended for general legal awareness and educational purposes only.
Leave a Comment
Your email address and mobile number will not be published. Required fields are marked *