Sharing PAN and Aadhaar on WhatsApp Risks Identity Theft

Post Views: 9

Cybersecurity professionals are advising individuals to exercise caution when transmitting critical identity and financial documents through unsecured communication channels. Official digital platforms, secure verification mechanisms, and purpose-specific document handling protocols can mitigate risks associated with data exposure.

The Problem in New Delhi

New Delhi: The practice of sharing documents such as Permanent Account Number (PAN) cards, Aadhaar cards, and bank statements through personal messaging accounts has become prevalent for various service-related verifications including loan applications, credit card approvals, rental agreements, and hospitality check-ins. Service providers often request these materials for convenience, but transmitting sensitive information without proper safeguards creates vulnerabilities. Documents shared as PDFs, images, or other file formats through unverified channels may not remain confined to the intended recipient. Even if the recipient is legitimate and has no immediate malicious intent, the documents could later be accessed through compromised devices, unauthorized cloud account breaches, or unintended forwarding. Information contained in PAN cards, Aadhaar cards, and bank statements can be exploited for identity verification, financial transactions, or other illicit activities. The risk escalates when agents request documents through personal numbers rather than official organizational systems. Financial institutions frequently engage Direct Selling Agents (DSAs) to manage loan and credit card processes. If these agents collect documents via private devices, customer data may bypass the organization’s security infrastructure. Additional copies of documents could also be stored across multiple devices, increasing exposure.

Expert Advice

Prof. Triveni Singh’s Statement

A prominent cybercrime analyst and former senior police officer, Prof. Triveni Singh, emphasized that individuals should avoid sharing identity documents with unverified personal contacts solely for procedural ease. He highlighted that unauthorized access to digital identity records could enable criminals to perpetrate further fraud or identity theft. He recommended verifying the legitimacy of the party requesting the documents and the organization they represent before transmitting sensitive data.

Recommended Approaches

The recommended approach is to request official document submission links or secure digital portals provided by banks, financial institutions, hotels, or service providers. When available, users should utilize DigiLocker or authorized digital verification systems. These platforms offer controlled processes for document exchange and verification, reducing the likelihood of unnecessary distribution. If transmission through personal messaging services is unavoidable, users must confirm the recipient’s association with the relevant organization. Adding a purpose-specific watermark, such as “For XYZ Loan Verification Only,” can clarify the document’s intended use and deter misuse. Sensitive PDFs should be protected with passwords where technically feasible, with the password communicated through a separate, trusted channel. Users should also refrain from sharing duplicate copies of PAN cards, Aadhaar cards, or bank statements unless absolutely necessary.

Legal Framework

The Digital Personal Data Protection framework mandates responsible handling of personal data for specified purposes, underscoring the need for organizations to provide secure digital channels for document collection rather than relying on personal messaging accounts.

Final Recommendations

Experts stress that PAN cards, Aadhaar cards, and bank statements should not be treated as routine paperwork. These documents contain critical information tied to an individual’s identity and financial status. Before transmitting any document via personal messaging services, users should consider three key questions: Who is requesting the information, why is it needed, and is there a secure, official method for submission? A brief verification process can significantly reduce exposure risks.