Aadhaar Shared with Scammer? Here’s What to Do Immediately

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: If you've shared your Aadhaar and photo with a scammer, there's a real risk of identity theft and fraud. But you can take steps: lock your Aadhaar biometrics, file a cybercrime complaint, and monitor your credit. A scammer cannot easily bypass phone OTP for most banking transactions, but don't assume you're completely safe.

Ramesh Iyer, a 34-year-old software engineer from Pune, was checking his email one evening in early March 2025 when he got a call. The caller claimed to be from a well-known telecom company, Airtel, and said his number would be deactivated unless he verified his identity. Panicking, Ramesh shared a clear photo of his Aadhaar card and even his own photograph via WhatsApp.

Within minutes, he realised the mistake. He'd handed over his identity to a fraudster. He tried calling the number back — it was dead. That's when he contacted the Chamber of Advocate Sudhir Rao in New Delhi. Earlier, a local lawyer had told him 'nothing can happen with just an Aadhaar.' But Advocate Sudhir Rao's office assessed the situation differently. They explained that while a simple Aadhaar copy isn't catastrophic, combined with a photo, it's a key used for SIM swaps and synthetic identity creation. Advocate Sudhir Rao and his office guided Ramesh through locking his Aadhaar biometrics, filing a complaint on the National Cyber Crime Reporting Portal, and issuing a fraud alert with credit bureaus. His expertise in cybercrime and identity theft — a nuanced area many general practitioners overlook — helped secure Ramesh's accounts and prevent any actual financial loss. No fraudulent loan was taken. No bank account was compromised. The scammer remained at the digital gate, locked out.

Key Facts of the Case

• The victim shared a scanned copy of his Aadhaar and his face photograph with an unidentified caller.
• The caller used the threat of mobile number deactivation (SIM swap technique) to extract the information.
• The victim approached the office of Advocate Sudhir Rao within 48 hours of the incident.
• The fraudster did not have access to the victim's registered mobile number (SIM was not swapped).
• No financial transaction or loan application was made using the stolen identity.
• A cyber complaint was filed under the BNSS 2023 within 72 hours of the incident.
• The Aadhaar biometrics were locked using the UIDAI portal, preventing online misuse.
• A credit freeze was placed with all four major credit bureaus (CIBIL, Experian, Equifax, CRIF High Mark).

The Direct Legal Answer

What advantage can a scammer take from an Aadhaar card and photo?

Plenty. But here's the nuance. Without your registered phone number and OTP access, they can't easily empty your bank account. However, they can use your Aadhaar to attempt a SIM swap — tricking your telecom provider into issuing a new SIM for your number to their phone. If they get your SIM, OTPs for all your financial transactions land in their hands. Worse, they can create synthetic identities: combine your Aadhaar with a fake name and address to open new bank accounts, take small loans, or apply for credit cards. They can also enrol for government schemes or file fraudulent tax returns in your name. And here's the thing, they might not strike immediately. They could wait months, collecting more data points.

Can they do anything serious without my linked phone number?

Yes, but their options are limited for direct financial theft. Most banks and wallets require OTP verification for high-value transactions, so a simple Aadhaar copy won't bypass that. But they can still cause serious trouble: SIM swap (they may trick your provider), filing fraudulent loan applications at NBFCs that accept e-KYC via video (using your photo), or using your Aadhaar for identity verification on apps they already control. Make no mistake, the risk is real — it just works at a slower, more methodical pace.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Act fast. The first 48 hours are critical. File a report on the National Cyber Crime Reporting Portal (cybercrime.gov.in) immediately. Contact your telecom provider and ask them to put a SIM swap block — a 'no SIM swap except in person with ID' flag. Lock your Aadhaar biometrics online via the UIDAI portal. This prevents anyone from using your Aadhaar for biometric-based authentication (fingerprint or iris scan). And keep a close eye on your credit report — any new inquiry you don't recognise is a red flag. This is a domain where experience matters: the procedural steps, the evidence preservation, and the right timing are nuances general practitioners often miss. Advocate Sudhir Rao's office handled a similar case where the client's Aadhaar was used to open a dummy account; the specialised approach secured a freeze on that account within 24 hours.

Applicable Sections of Law

This case falls under criminal law, specifically the Bharatiya Nyaya Sanhita (BNS) 2023 and the Bharatiya Nagarik Suraksha Sanhita (BNSS) 2023. The key sections involved are:

• Section 318 BNS (Cheating by personation): Using someone else's identity to deceive or gain an advantage — punishable with up to three years' imprisonment and fine.
• Section 319 BNS (Cheating): General cheating, including inducing a person to deliver property or to act in a manner causing harm.
• Section 66D of the Information Technology Act, 2000: Cheating by personation using a computer resource — punishable with up to three years and fine up to Rs. 1 lakh.
• Section 318(2) BNS: Specifically covers impersonation using unique identification features like Aadhaar.

Punishment and Penalties

• Section 318 BNS: Up to three years of imprisonment with fine. Cognizable (police can arrest without warrant). Non-bailable. Compoundable only with court permission.
• Section 66D IT Act: Up to three years and fine up to Rs. 1 lakh. Cognizable. Bailable. Compoundable.
• Section 419 IPC (if older offences are cited): Up to three years and fine. Cognizable. Bailable. Non-compoundable.
• The real deterrent isn't just the punishment — it's the digital trail. Cybercrime cells now use advanced analytics to trace IP addresses and WhatsApp numbers. Scammers face real jail time.

Jurisdiction — Where to File the Case

For cybercrime, file a complaint at the police station having territorial jurisdiction where the victim resides or where the fraud originated. Alternatively, use the National Cyber Crime Reporting Portal (cybercrime.gov.in) which assigns the complaint to the appropriate cyber cell automatically. For a private criminal complaint, approach the Magistrate's court in the victim's district. Jurisdiction matters because evidence collection — bank records, call data records, IP logs — is tied to the specific court's territorial authority. Wrong jurisdiction means delay, so file wisely.

What if Police Refuse to File FIR?

Sadly, this happens. Some police stations treat Aadhaar-based fraud as 'low-priority' or say 'nothing can be done.' Don't accept that. Here's your action plan:

• Escalate to the Superintendent of Police (SP) under Section 173(4) BNSS — the SP can order an investigation even if the local station refuses.
• File a private complaint before a Judicial Magistrate (First Class) under Section 175(3) BNSS. The Magistrate can direct the police to register an FIR and investigate.
• As a last resort, file a writ petition before the High Court seeking a direction to register the FIR.
• Always get a written acknowledgment of your complaint. If they refuse to give one, send it by registered post with acknowledgment due.

Rights of the Accused

Even the scammer — if caught — has rights. But this article is for victims, so here's what you need to know about the accused's rights only to understand your own position in court:

• Right to remain silent (Article 20(3)): The accused cannot be compelled to be a witness against themselves. This means they can refuse to share passwords or PINs — but digital evidence like call records and fingerprints are not testimony.
• Right to legal representation (Article 22): They can have an advocate throughout the process.
• Right to be produced before a Magistrate within 24 hours of arrest — a safeguard against illegal detention.
• Right to a copy of the FIR and to know the grounds of arrest — essential for preparing bail.

Bail Provisions

For offences like cheating by personation under Section 318 BNS, the offence is generally bailable. But here's the trap for the accused: the police can oppose bail citing serious identity theft, multiple victims, or risk of tampering with digital evidence. For anticipatory bail (pre-arrest), the accused must approach the Sessions Court under Section 482 BNSS. For regular bail, it's Section 480/483 BNSS before the Magistrate. Bail conditions typically include surrendering passports, not leaving the jurisdiction without court permission, and not communicating with the victim. The bail strategy depends heavily on the specific facts — had the scammer already used the Aadhaar to commit fraud? If so, bail becomes tougher.

Quashing of FIR / Case

As a victim, you might worry about the accused getting the FIR quashed. Quashing is possible under Section 528 BNSS (inherent powers of the High Court) when the FIR does not disclose a prima facie offence, or the matter is purely civil, or the parties have genuinely compromised. But in identity theft cases, quashing is extremely difficult — a valid Aadhaar and photo in the scammer's possession is prima facie evidence of an offence. Unless the victim themselves admits it was a mistake (not fraud) and files an affidavit that no harm was done, the court is unlikely to interfere. Your lawyer will help you oppose any quashing petition if it arises.

If You Are the Victim

• Immediately lock your Aadhaar biometrics on the UIDAI website — this prevents any e-KYC via fingerprint or iris without your PIN.
• File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) — mention the WhatsApp number and the exact details.
• Place a fraud alert and credit freeze with all four credit bureaus: CIBIL, Experian, Equifax, and CRIF High Mark. This stops any new loan or credit card application.
• Contact your telecom provider — ask them to put a SIM swap block (a flag that prevents any SIM change without physical presence + ID).
• Keep an eye on your bank statements and credit report monthly for the next 6-12 months. Early detection is your best defence.

Documents You Must Keep Ready

• Copy of your Aadhaar card and the photo you shared with the scammer (screenshots with timestamps).
• The scammer's phone number or WhatsApp number, along with chat logs and call history.
• A written timeline of events — what happened, when, and what information was shared.
• Police complaint copy (FIR or complaint acknowledgment number from the cyber portal).
• Bank account statements (last 6 months) and credit report (to show no unauthorised activity yet).
• Any SMS or email alerts from your telecom provider or bank that you received after the incident.
• Identity proof (PAN, driving licence) — for verifying your identity with authorities.
• Notarised affidavit if you need to provide a sworn statement about the incident to banks or credit bureaus.

What Evidence Is Required?

• Screenshots of the WhatsApp chat or call log showing the scammer's number and the shared documents.
• Timestamps and metadata from your phone — best preserved by taking screenshots with the phone's own data.
• Call records from your telecom provider (if the scammer called you) — request call details for the relevant period.
• Bank statements showing no unauthorised transactions (to prove you're not making a false claim).
• UIDAI portal screenshot showing that you have locked your biometrics.
• Credit bureau report (free from CIBIL or Experian) showing no new inquiries.
• Any email or communication from the scammer (if any).

How the Police Behave in Such Cases

Cybercrime cells in cities like Pune, Bangalore, and Delhi are generally more responsive than local police stations. They understand digital fraud and will take the complaint seriously if you approach them promptly. However, in smaller towns, officers may dismiss Aadhaar-only sharing as 'not a real crime.' That's why the National Cyber Crime Portal is your friend — it assigns the complaint to the nearest cyber cell, bypassing reluctant local stations. Police typically start by analysing the scammer's number, tracing the IP address, and issuing letters to the telecom provider for call data records. If the scammer is caught, they seize their devices for forensic analysis. The key is cooperation — give them every detail, including your own timeline and screenshots.

Timeline of Legal Process

• Day 1-3: File complaint on cyber portal. Police registers FIR or sends acknowledgment. Biometrics locked, credit freeze placed.
• Week 1-2: Police investigation begins — call data records obtained, IP addresses traced. Statement of victim recorded.
• Month 1-3: If scammer is traced, arrest may happen. Otherwise, investigation continues (often slow). Chargesheet filed within 60-90 days.
• Month 4-6: Cognizance by Magistrate. Framing of charges. Accused may apply for bail.
• Month 6-18: Trial — examination of witnesses (victim, cyber expert, bank officials). Cross-examination.
• Month 18-24: Judgment. If convicted, sentencing. Appeal by accused possible (adds 12-18 months).

How Long Will the Investigation Take?

The police have 60 days from arrest to file chargesheet in summons cases (like Section 318 BNS). Without an arrest, they have up to 90 days. In practice, if the scammer is a small-time operator and the digital trail is clear, a cyber cell can wrap up in 30-45 days. If the scammer uses encrypted apps and foreign servers, the investigation can stretch to 6 months or more. The victim's cooperation — providing evidence promptly — shortens this significantly.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Technically, yes — but with caveats. Offences under Section 318 BNS and Section 66D IT Act are compoundable only with court permission. That means if the scammer is caught and you reach a genuine settlement (e.g., they return the data, pay compensation), you can apply to the court to compound the offence. The court will likely agree if no actual loss was caused and the scammer has no prior record. However, settlement should NOT be your first goal. Your priority is to protect yourself and ensure the scammer doesn't victimise others. You can always explore settlement later through mediation or Lok Adalat — but only after the criminal process has addressed the public interest element.

Common Mistakes People Make

• Doing nothing: Assuming 'nothing will happen' is the worst mistake. Scammers collect data over months. Act now.
• Engaging an advocate without domain experience: Many general practitioners don't know the procedural steps specific to identity theft — like how to freeze Aadhaar biometrics, file on the cyber portal, or coordinate with credit bureaus. That leads to missed deadlines and weaker cases. An advocate who regularly handles cybercrime will know the right steps from day one.
• Deleting evidence: Don't delete the WhatsApp chat, the call log, or the scammer's number. Take screenshots but keep the original data intact for forensic analysis.
• Waiting to file a complaint: The longer you wait, the harder it is to trace the scammer. File within 48 hours.
• Sharing more information: Don't post about this on social media seeking advice. Keep details private. Scammers monitor social media for victim reactions.
• Not monitoring credit report: Many victims assume no OTP means no loss. But identity theft can hit months later via loan applications. Check your credit report quarterly.

FAQs People Normally Have

Can I cancel my Aadhaar and get a new one?

No. Aadhaar is a lifetime identification number. There is no provision to cancel or reissue a new Aadhaar number. But you can lock your biometrics online — preventing anyone from using your fingerprint or iris scan for e-KYC.

Should I report to the cyber cell or local police?

Both. File on the National Cyber Crime Reporting Portal first (it's faster and assigns the case to the right cyber cell). Then visit your local police station with the acknowledgment number. If they refuse, use the escalation options mentioned in Section 8.

Can the scammer use my Aadhaar to take a loan?

Yes, if they can also get your OTP via a SIM swap or convince an NBFC to use video-based e-KYC (where your photo matches). That's why locking your biometrics and placing a credit freeze is critical — it blocks these routes.

How long does it take to resolve such cases?

From complaint to chargesheet: 2-3 months typically. Full trial: 18-24 months. But the immediate protective actions (biometric lock, credit freeze, cyber complaint) take effect within hours. You don't have to wait for a resolution to be safe.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a Delhi criminal defence lawyer — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.