A 34 year old man from Rajasthan woke up one morning to find police at his door. It was not a one time thing. Over the next six years, law enforcement teams from 33 different states showed up at his home. FIRs worth crores of rupees in cyber fraud had been filed against him from across the country.

He had never committed a single crime.

Years earlier his email had been hacked. Inside that email were scanned copies of his Aadhaar card, PAN card and voter ID. Fraudsters used those documents to open bank accounts, register fake businesses and cheat hundreds of people across India. Everything was done in his name, with his documents, while he had no idea any of it was happening.

Six years of police visits, legal battles and a ruined reputation. All because of files sitting in a hacked email inbox.

This is what identity theft in India actually looks like. Not just financial loss. A completely innocent person’s life turned upside down while the real criminals are never found. And it can happen to anyone who has ever scanned and shared their documents online.

What Is Identity Theft?

Most people think identity theft means someone hacks into your bank account and transfers money out. That is one version of it. But honestly, it can get much worse than that.

When someone gets hold of your Aadhaar number, PAN card, phone number or date of birth, they do not need all of it. Two or three of these details together is enough for a fraudster to open a bank account in your name, apply for a loan you never asked for, or run a fake business using your identity. You find out months or years later when a recovery agent shows up at your door or an FIR gets filed against you for something you never did.

That is the part nobody talks about. The damage is not always financial. Sometimes it follows you around for years.

How Common Is Identity Theft in India?

More common than most people realize.

According to a 2025 report by U.S. cybersecurity firm Entrust, India’s PAN card is now the most-forged identity document globally, appearing in over 27% of all identity and tax document fraud cases worldwide.

In April 2025, Indian authorities uncovered a fraud ring that had exploited loopholes in UIDAI’s enrollment software to illegally update the personal and biometric data of over 1,500 Aadhaar card holders. Fraudsters changed names, birthdates, and linked phone numbers using tools like cloned iris scans and silicone fingerprints.

And it is not just targeted attacks. In one of India’s largest alleged data breaches, a hacking group claimed to have stolen records of 815 million Indian residents, including Aadhaar details, passport information, names, phone numbers, and addresses, reportedly sourced from ICMR’s Covid-19 testing database.

Your data may already be out there. The question is whether you know how to protect yourself.

How Do Fraudsters Steal Your Identity?

There is no single method. Scammers use whatever works.

1. Phishing messages and fake websites You get a message saying your KYC is expiring. The link looks real, the website looks real, and you enter your details without a second thought. That is it. The fraudster has your information and you have no idea it happened.

2. Hacked email accounts Open your sent folder right now. There is a good chance you have emailed scanned documents to a bank, an employer or an insurance company at some point. If someone gets into your email, they do not need to do anything else. Everything is already sitting there waiting for them.

3. SIM swap fraud The fraudster calls your telecom provider pretending to be you and gets a new SIM issued on your number. Your phone goes silent. They start receiving your OTPs. By the time you figure out what happened, your bank account has already been accessed.

4. Data breaches You signed up for an app or filled a form somewhere. That company got hacked. Your Aadhaar number, phone number and date of birth are now being sold on the dark web for less than the cost of a meal.

5. Fake KYC calls A calm, professional sounding person calls from what seems like your bank or UIDAI. They just need your Aadhaar number and a quick OTP for verification. They are not from your bank. They never were.

If you receive a suspicious message asking for personal details, run it through our Scam Message Checker before doing anything.

What Can Fraudsters Do With Your Identity?

Once someone has your details, here is what they can misuse:

In the Rajasthan case, investigators discovered that the victim’s documents had been used to open fraudulent bank accounts across multiple states. These accounts were used for GST-linked transactions worth crores of rupees. When victims of those scams filed complaints, the trail kept pointing back to this one innocent man’s documents.

Clearing your name after this kind of theft can take years.

Warning Signs That Your Identity Has Been Stolen

Most people find out too late. Watch out for these red flags:

Check: Fake Aadhaar and PAN Update Scam: How It Works

What to Do If Your Identity Is Stolen: Step by Step

Step 1: Freeze Your Bank Accounts and Aadhaar

Call your bank first. Tell them what happened and ask for a temporary hold on all transactions.

Do not wait until you have more information. While you are at it, open the mAadhaar app and lock your biometrics. This means nobody can use your fingerprints or iris scan to authenticate anything until you unlock it yourself. You can also do this on uidai.gov.in if you do not have the app.

Step 2: Check Your Credit Report

Go to cibil.com, experian.in, equifax.in or crif.in and download your credit report. Go through it carefully and look for loans, credit cards or enquiries you never made.

Even one unfamiliar entry is worth investigating. Raise a dispute on the bureau’s website and they have to respond within 30 days by law.

Step 3: File a Complaint on cybercrime.gov.in

Go to cybercrime.gov.in and file under Other Cyber Crimes. Write down what happened as clearly as you can, attach whatever evidence you have and submit. You will get a tracking number within 48 hours and your complaint gets sent to the local cyber cell automatically.

Step 4: File an FIR at Your Local Police Station

Do not stop at the online complaint. Go to your nearest police station and file a physical FIR. Section 66C of the IT Act covers identity theft and the punishment goes up to three years in prison.

If the police say it is not their jurisdiction, tell them about Section 154 of CrPC. Any station can register a Zero FIR regardless of where the crime happened.

Step 5: Report to UIDAI and Your Telecom Provider

Aadhaar misused? Email help@uidai.gov.in or call 1947.

SIM swapped? Go to your telecom store with your ID and ask them to block the fake SIM and restore your original number on the spot.

Step 6: Inform Your Contacts

If someone created a fake profile in your name, report it to the platform. Facebook, Instagram and LinkedIn all have impersonation reporting tools. Also tell your close contacts directly so nobody sends money to someone pretending to be you.

What Laws Protect You in India?

India has clear laws that cover identity theft. Here is what you should know.

How to Protect Yourself Before It Happens

Prevention is always better than trying to fix the damage later. Here are practical steps you can take today:

Last thing. Go to your social media profiles right now and check what is publicly visible. Your date of birth, phone number and home address sitting open on your profile is all a fraudster needs to start building a case against you.er together are enough for a fraudster to start building a fake identity using your name.

Also read: How Smart People Lose Money to Scams in India

Real Case: A Six-Year Identity Theft Nightmare

A man from Rajasthan had his email hacked. Inside that inbox were scanned copies of his Aadhaar, PAN and other identity documents. The hackers used those documents to open bank accounts and run fraud operations across multiple states. All of it in his name, without him knowing any of it was happening.

Then the police started showing up at his door. FIRs from different states kept getting linked to his name. Officers who had no reason to doubt the paperwork treated him as a suspect in crimes he had never heard of, let alone committed. This went on for years.

He eventually managed to get an FIR registered that acknowledged his identity had been misused. But getting his name removed from multiple records across different states is still an ongoing process.

This is what identity theft can actually cost a person. Not just money. Years of your life spent proving you are not a criminal for something someone else did using your name.

Source: The420

Frequently Asked Questions

Can someone misuse my Aadhaar just by knowing the number?

Not easily. Just the number on its own is not enough. To actually authenticate anything, they would also need your OTP, biometrics or linked phone number. That said, your Aadhaar number combined with your PAN and date of birth can be enough to get through verification on platforms that do not check as carefully as they should.

How do I check if my Aadhaar has been used somewhere without my knowledge?

Go to myaadhaar.uidai.gov.in and look for the Aadhaar Authentication History section. It shows the last 50 times your Aadhaar was authenticated, where and for what purpose. Worth checking every few months.

What if a loan is taken in my name without my knowledge?

Go to the lending institution directly with a copy of your FIR and tell them what happened. At the same time raise a dispute on the credit bureau’s website. RBI rules require banks to investigate fraud loan complaints within 90 days.

Can I get compensation if a company’s data breach exposed my details?

Yes. Under the Digital Personal Data Protection Act 2023 you can file a complaint with the Data Protection Board of India if a company’s negligence caused your data to be exposed. The company is not off the hook just because it was a hack.

Is identity theft only a financial crime?

Not at all. Someone can create a criminal record in your name, build fake social media profiles, use your health insurance for medical fraud or file taxes using your PAN. The financial damage is just one part of it.