Aadhaar is one of India's most widely used identity systems. People use it to establish their identity while accessing government services, completing KYC formalities and verifying their details with authorised organisations. The Unique Identification Authority of India (UIDAI) manages this system and establishes safeguards for Aadhaar identity information and authentication.
UIDAI's responsibilities go beyond issuing Aadhaar numbers. It manages enrolment and updates, operates the central identity database, sets authentication standards and regulates organisations that use Aadhaar verification. It also establishes security requirements to protect residents' identity information and biometric data.
However, Aadhaar authentication and complete protection against fraud are not the same thing. Verifying someone's identity does not establish that a business, investment, payment request or service is genuine. Understanding what UIDAI protects, how Aadhaar verification works and what information organisations can access helps residents use Aadhaar more safely.
What Is UIDAI?
UIDAI stands for the Unique Identification Authority of India. It is a statutory authority established by the Government of India under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016.
The Government formally established UIDAI as a statutory authority on 12 July 2016. It functions under the Ministry of Electronics and Information Technology (MeitY).
UIDAI's history goes back further. The Government initially created the authority in 2009 to implement the Aadhaar project. The Aadhaar Act, 2016 subsequently provided the statutory framework for its powers, responsibilities and operations.
The authority's primary objective is to issue a unique identification number to residents and make that identity verifiable through secure and reliable methods. Its responsibilities include:
- Managing Aadhaar enrolment and updating processes.
- Issuing Aadhaar numbers and maintaining their lifecycle.
- Operating and managing the Central Identities Data Repository (CIDR).
- Providing Aadhaar authentication facilities.
- Establishing standards for online authentication and offline verification.
- Protecting identity information and authentication records.
- Regulating and monitoring organisations participating in the Aadhaar ecosystem.
- Providing grievance-redressal and support facilities to Aadhaar holders.
You can learn more about the authority through the official UIDAI overview and its legal framework.
How Does UIDAI Protect the Integrity of Aadhaar Identity Records?
A reliable identity system must ensure that one individual does not obtain multiple Aadhaar identities through duplicate or fraudulent enrolment. It must also maintain accurate records so that authorised organisations can verify an individual's identity.
UIDAI supports these objectives through biometric deduplication, document verification, enrolment standards and procedures for updating Aadhaar information.
1. Preventing Duplicate Aadhaar Enrolments
UIDAI uses biometric deduplication to identify possible duplicate enrolments. During this process, the system compares biometric information submitted during a new enrolment or update against existing records to identify potential matches.
This process supports Aadhaar's uniqueness principle. The Aadhaar Act also provides that an Aadhaar number issued to an individual cannot be reassigned to another person.
In February 2026, the Government announced that UIDAI had deployed an AI-enabled biometric deduplication and document-verification platform. The initiative aims to improve the accuracy of enrolment and update checks through advanced data processing and verification.
These technologies strengthen the process of identifying duplicate records and suspicious documents. They reduce the possibility of fraudulent enrolment but do not mean that every fraudulent attempt can be detected automatically.
2. Maintaining Accurate Aadhaar Information
Aadhaar records may require updates when a person's address or other demographic details change. Biometric information may also need updating in accordance with UIDAI's prescribed requirements.
UIDAI establishes procedures for submitting update requests, verifying supporting documents and maintaining the quality of Aadhaar records. These procedures help prevent unauthorised or unsupported changes to identity information.
Residents can use the official Aadhaar update services to understand the available update facilities and applicable requirements.
Maintaining accurate records is important because incorrect or outdated information can create difficulties during identity verification and service delivery.
How Does UIDAI Protect Aadhaar Data?
UIDAI manages sensitive identity information, including demographic and biometric details. The Aadhaar Act therefore places specific responsibilities on the authority to protect this information from unauthorised access, use and disclosure.
The Central Identities Data Repository (CIDR) is the central database used for Aadhaar-related identity records and authentication. UIDAI establishes technical and organisational safeguards to protect the information maintained within its systems.
1. Protecting Core Biometric Information
Core biometric information includes an individual's fingerprints, iris scans and other biometric information covered by the Aadhaar Act. This information receives specific legal protection.
Under Section 29 of the Aadhaar Act, core biometric information cannot be shared with anyone for any reason. It can be used only for generating Aadhaar numbers and performing authentication as permitted under the Act.
UIDAI also establishes technical requirements for handling biometric information during authentication. For example, biometric data must be protected through prescribed encryption and security procedures before transmission.
These safeguards are intended to prevent unauthorised access, disclosure and misuse of biometric information.
2. Securing Identity Information and Authentication Records
UIDAI must protect more than biometric information. The authority also has responsibilities for maintaining the confidentiality and security of identity information and authentication records.
Section 28 of the Aadhaar Act requires UIDAI to adopt appropriate technical and organisational security measures. The law also requires safeguards against unauthorised access, use or disclosure and against accidental or intentional destruction, loss or damage.
The Aadhaar Data Security Regulations, 2016 provide a framework for information-security policies and related safeguards.
These measures include security controls relating to access management, encryption, network protection, monitoring, vulnerability management and security audits. They help protect the systems and information used in the Aadhaar ecosystem.
3. Limiting Access to Sensitive Information
Not every organisation that accepts Aadhaar can access the central database. Organisations must operate through the verification arrangements permitted under the Aadhaar framework and meet the applicable authorisation and security requirements.
UIDAI establishes technical and operational conditions for participating entities. These requirements help restrict access to authorised systems and ensure that organisations handle Aadhaar information only within the permitted framework.
Security also depends on the organisations receiving identity information. A service provider must protect the information it collects and cannot use or disclose it for unrelated purposes merely because a person has provided Aadhaar details.
What Information Does UIDAI Receive During Aadhaar Authentication?
One common concern is whether UIDAI receives information about every service or transaction in which a person uses Aadhaar. The Aadhaar Act establishes an important distinction between identity verification and the purpose for which a person uses a service.
When an authorised organisation requests Aadhaar authentication, it submits the required identity information through the prescribed system. Depending on the authentication method, the request may involve demographic information, an OTP or biometric information.
UIDAI processes the request and provides the authentication response permitted under the relevant method. A standard Yes/No authentication response confirms whether the submitted information matches the Aadhaar record.
UIDAI does not receive a person's bank account balance, purchase details, investment portfolio or the underlying details of a financial transaction simply because an organisation uses Aadhaar for identity verification.
Section 32(3) of the Aadhaar Act specifically prohibits UIDAI from collecting, keeping or maintaining information about the purpose of authentication.
UIDAI explains this distinction in its official Aadhaar Mythbusters section. It clarifies that Aadhaar authentication does not provide the authority with a person's banking or investment details.
However, authentication records and information held by the requesting organisation are subject to their own legal and regulatory requirements. The organisation must also follow the applicable rules governing consent, purpose and information handling.
How Does Aadhaar Authentication Work?
Aadhaar authentication is an electronic process through which an authorised organisation verifies an individual's identity against information maintained by UIDAI.
The process helps organisations establish identity without relying entirely on physical documents. UIDAI defines the technical standards and procedures that participating entities must follow.
Depending on the service and permitted verification method, Aadhaar authentication can use different types of information.
1. Demographic Authentication
Demographic authentication uses details such as an individual's name, date of birth or other permitted demographic information. The submitted information is checked against the corresponding Aadhaar record.
The authentication system returns a response according to the prescribed process. A successful response indicates a match for the submitted information; it does not certify the purpose or legitimacy of the service being provided.
2. OTP-Based Authentication
OTP-based authentication uses a one-time password sent through the registered communication channel. The individual enters the OTP to complete the verification process.
Residents should never share an OTP with an unknown caller, message sender or person claiming to represent UIDAI. An OTP should be entered only when the individual has personally initiated a legitimate verification process and understands why it is required.
3. Biometric Authentication
Biometric authentication uses a permitted biometric method, such as fingerprint, iris or face authentication, to verify identity.
UIDAI establishes requirements for biometric devices and the secure handling of authentication data. Registered biometric devices use prescribed security mechanisms to protect captured information and prevent unauthorised manipulation.
These safeguards include device identification, digital signing and encryption requirements. UIDAI's biometric-device information explains the standards applicable to devices used within the Aadhaar ecosystem.
4. e-KYC Authentication
e-KYC allows an authorised organisation to obtain permitted identity information electronically after completing the required authentication and consent process.
Depending on the applicable arrangement, the response may contain details such as the individual's name, address and photograph. This is different from a basic Yes/No authentication response.
e-KYC is subject to the legal and regulatory conditions governing the requesting entity, including requirements relating to consent, permitted use and information security.
What Is Aadhaar Offline Verification?
Aadhaar offline verification allows an individual to establish identity without requiring the verifying organisation to perform an online authentication request against the CIDR for that verification.
UIDAI provides methods such as Aadhaar Paperless Offline e-KYC, which allows residents to generate a digitally signed document containing permitted identity information.
The verifying organisation can check the digital signature and verify whether the information has been altered. This provides an alternative to sharing a photocopy of the Aadhaar letter.
UIDAI explains this facility through its Aadhaar Paperless Offline e-KYC service.
Offline verification can offer privacy benefits because the Aadhaar holder can share the prescribed information directly with the verifying organisation. The organisation must still follow the applicable consent and information-handling requirements.
How Does UIDAI Regulate Consent and Aadhaar Information Sharing?
Consent is an important part of Aadhaar authentication and offline verification. The Aadhaar Act and supporting regulations establish conditions that organisations must follow before collecting or using identity information through these processes.
For authentication, Section 8 of the Aadhaar Act requires a requesting entity to obtain the individual's consent, unless the law provides otherwise. The entity must also explain the purpose for which the identity information is being submitted.
For offline verification, Section 8A establishes consent and disclosure requirements. The verification-seeking entity must inform the individual about the information that may be shared, how it will be used and the available alternatives, if any.
Section 29 also restricts how organisations can use or disclose identity information. Information collected during authentication or offline verification cannot be used for an unrelated purpose or disclosed beyond the permitted conditions.
Providing Aadhaar information for one verification does not give an organisation unrestricted permission to use it for unrelated activities.
The relevant legal provisions are available in the Aadhaar Act, 2016 and the updated UIDAI regulations.
How Does UIDAI Monitor Organisations in the Aadhaar Ecosystem?
UIDAI's responsibilities extend beyond its own database and infrastructure. Several types of organisations participate in Aadhaar enrolment, authentication and offline verification.
These organisations must follow the applicable technical, operational and security requirements. UIDAI establishes regulations and compliance conditions to ensure that participating entities handle Aadhaar information responsibly.
1. Regulating Authentication and Offline Verification Entities
Organisations that perform Aadhaar authentication or offline verification must comply with the applicable regulatory framework. Their responsibilities may include obtaining consent, explaining the purpose of verification, protecting identity information and maintaining required records.
The Aadhaar (Authentication and Offline Verification) Regulations, 2021, as updated, establish important requirements for these entities.
2. Audits and Compliance Monitoring
UIDAI's regulatory framework provides for audits and compliance checks covering participating entities. These checks can examine their systems, infrastructure, procedures and information-security arrangements.
Audits help identify gaps in compliance and security practices. Where the applicable provisions are not followed, UIDAI can take action under the relevant legal and regulatory framework.
3. Corrective and Regulatory Action
Depending on the nature of the violation and the applicable provisions, UIDAI can require corrective measures and take prescribed action against entities that fail to meet their obligations.
Such action may include applicable disincentives, suspension or discontinuation of participation in the Aadhaar ecosystem, subject to the relevant procedures.
UIDAI publishes its regulations and regulatory updates to provide the legal framework governing enrolment, authentication, information sharing and other Aadhaar-related activities.
What Aadhaar Security Features Can Residents Use?
UIDAI provides several facilities that allow Aadhaar holders to manage their identity information and reduce the risk of unauthorised authentication. Residents should understand these features and use them where appropriate.
1. Biometric Locking and Unlocking
Biometric locking allows an Aadhaar holder to prevent biometric authentication using the locked biometric modalities. This can help reduce the risk of unauthorised fingerprint, iris or face-based authentication.
When biometrics remain locked, an organisation cannot complete biometric authentication using those locked modalities. The Aadhaar holder can temporarily unlock the biometrics when a legitimate biometric verification is required.
Residents can access the facility through UIDAI's official website or supported Aadhaar services. A registered mobile number is generally required for online access to these facilities.
Visit the UIDAI authentication section to find the available biometric security facilities.
2. Aadhaar Authentication History
UIDAI allows Aadhaar holders to check their authentication history. This facility helps residents review authentication transactions recorded against their Aadhaar number.
Checking authentication history can help identify unfamiliar or unexpected verification attempts. If a resident notices suspicious activity, they should take appropriate security steps and contact UIDAI or the concerned organisation.
UIDAI provides authentication-history access through its official online services. The facility requires the registered mobile number and displays records available within the permitted date range.
For instructions and current availability, visit the official authentication information page.
3. Virtual ID (VID)
A Virtual ID, commonly called VID, is a temporary, revocable 16-digit number that an Aadhaar holder can use instead of sharing the actual Aadhaar number in supported authentication services.
It provides an alternative identifier for verification and helps reduce the need to disclose the Aadhaar number repeatedly.
Residents can generate or retrieve their VID through UIDAI's official services, subject to the applicable requirements. However, VID does not replace every Aadhaar-related document or verification method. Its use depends on whether the concerned service supports it.
4. Masked Aadhaar
Masked Aadhaar is an Aadhaar document in which the first eight digits of the Aadhaar number are concealed, leaving only the last four digits visible.
It can help reduce unnecessary exposure of the full Aadhaar number when an organisation accepts masked Aadhaar for the intended purpose.
Residents should prefer masked Aadhaar where a full Aadhaar number is not required and the receiving organisation accepts this format.
5. Secure Offline e-KYC
Aadhaar Paperless Offline e-KYC allows residents to share digitally signed identity information with a verifying organisation. The downloaded file is protected using a share phrase, and the verifying organisation can check its digital signature.
This facility can reduce the need to provide photocopies of the Aadhaar letter. It also allows the Aadhaar holder to share the prescribed information directly with the verifying organisation.
Residents can learn more through the official offline e-KYC service.
How Can You Protect Your Aadhaar from Misuse?
UIDAI's security systems protect the Aadhaar infrastructure, but residents also need to handle their identity information carefully. Fraudsters may misuse Aadhaar-related documents, impersonate officials or trick people into sharing OTPs and other confidential information.
Follow these precautions to reduce the risk of Aadhaar-related fraud:
- Never share an OTP with unknown persons: UIDAI or a legitimate service provider should not ask you to disclose an OTP over an unsolicited phone call or message.
- Lock biometrics when appropriate: Use UIDAI's biometric-locking facility if you do not regularly require biometric authentication.
- Check authentication history: Review available records periodically and investigate unfamiliar authentication attempts.
- Use Virtual ID where supported: Avoid sharing your actual Aadhaar number unnecessarily.
- Prefer masked Aadhaar when accepted: Do not disclose the full Aadhaar number when the receiving organisation does not need it.
- Share documents carefully: Provide Aadhaar copies only to legitimate organisations and understand why they need the document.
- Avoid unknown links: Do not open suspicious links claiming to offer Aadhaar updates, verification or account-blocking services.
- Use official UIDAI services: Access Aadhaar facilities through the official UIDAI website and authorised channels.
- Protect your registered mobile number: Keep your mobile number updated and secure because it is used for several Aadhaar-related services.
For more information about online fraud reporting and cybercrime support, read our guide to the National Cyber Crime Reporting Portal and the article explaining the Indian Cybercrime Coordination Centre (I4C).
How Can You Contact UIDAI or Report an Aadhaar-Related Complaint?
UIDAI provides grievance-redressal facilities for residents who face problems with Aadhaar enrolment, updates, authentication or other Aadhaar-related services.
Residents can use the official UIDAI website to submit a grievance, provide feedback and check the status of a complaint.
The main support options include:
- UIDAI toll-free helpline: 1947
- Email: [email protected]
- Online grievance: UIDAI Grievance and Feedback Portal
- Official website: uidai.gov.in
When submitting a complaint, explain the issue clearly and provide the relevant request or complaint reference number, if available. Do not include OTPs, passwords or other confidential authentication details in an email or complaint description.
Important: UIDAI handles Aadhaar-related grievances. If someone uses Aadhaar-related information to commit financial fraud, the victim should also contact the concerned bank or payment service provider and report the incident through the appropriate cybercrime channels. For financial cyber fraud in India, the national helpline is 1930.
You can also read our guide to Sanchar Saathi to understand the Government of India's mobile and telecom safety services.
What Are the Limits of UIDAI's Role in Identity Protection?
UIDAI plays an important role in protecting Aadhaar identity information, but its responsibilities do not cover every aspect of financial security, consumer protection or criminal investigation.
Understanding these limits helps residents identify the right organisation when they face a problem.
- Aadhaar does not prove that a business is genuine: Authentication establishes identity, not the trustworthiness of a company, seller or service provider.
- Aadhaar verification does not guarantee a safe payment: A successful identity check does not confirm that a payment request or financial transaction is legitimate.
- UIDAI does not regulate every organisation that accepts Aadhaar: Banks, telecom companies and other service providers remain responsible for their own regulatory and customer-protection obligations.
- UIDAI does not investigate every cybercrime: Police and designated cybercrime authorities handle criminal investigations and related enforcement.
- Aadhaar security does not eliminate all fraud risks: Social engineering, phishing, document misuse and impersonation can still target individuals and organisations.
For example, if someone impersonates a bank employee and asks for an OTP, the issue is not simply an Aadhaar verification problem. It may involve banking fraud or social engineering and should be reported to the relevant bank and cybercrime authorities.
Similarly, if someone receives a suspicious call claiming that their mobile connection will be disconnected unless they complete Aadhaar verification, they should verify the claim through official telecom channels. Our guide to TRAI rules for consumers, spam calls and telecom complaints explains the relevant consumer-protection framework.
Frequently Asked Questions About UIDAI and Aadhaar Security
Q. What does UIDAI stand for?
Ans. UIDAI stands for the Unique Identification Authority of India. It is the statutory authority responsible for Aadhaar enrolment, authentication, lifecycle management and the security of identity information and authentication records.
Q. When was UIDAI established?
Ans. The Government established UIDAI as a statutory authority on 12 July 2016 under the Aadhaar Act, 2016. The Aadhaar project and the authority's earlier administrative structure date back to 2009.
Q. Which ministry controls UIDAI?
Ans. UIDAI functions under the Ministry of Electronics and Information Technology (MeitY), Government of India.
Q. What is the main role of UIDAI?
Ans. UIDAI manages the Aadhaar system. Its responsibilities include issuing Aadhaar numbers, managing enrolment and updates, providing authentication facilities, establishing verification standards and protecting identity information.
Q. Does UIDAI store bank account details and financial transactions?
Ans. No. UIDAI does not receive a person's bank balance, purchase details or investment information simply because a bank or another organisation uses Aadhaar for identity verification. Section 32(3) of the Aadhaar Act also prohibits UIDAI from collecting or maintaining information about the purpose of authentication.
Q. Can someone withdraw money from my bank account using only my Aadhaar number?
Ans. Knowing an Aadhaar number alone does not provide access to a person's bank account or authorise a withdrawal. However, residents should protect their banking PINs, OTPs and other authentication credentials and report any suspicious banking activity immediately.
Q. Can an organisation access my fingerprints through Aadhaar authentication?
Ans. No. An organisation does not receive access to the fingerprints or iris information stored in the CIDR through ordinary Aadhaar authentication. The Aadhaar Act prohibits sharing core biometric information, and authentication operates through prescribed secure processes.
Q. Does Aadhaar authentication always return only a Yes or No response?
Ans. No. A standard Yes/No authentication response confirms whether the submitted information matches the Aadhaar record. Authorised e-KYC arrangements can provide permitted identity information, such as demographic details and a photograph, subject to the applicable legal and consent requirements.
Q. What is the difference between Aadhaar authentication and offline verification?
Ans. Aadhaar authentication involves an online verification request through UIDAI's authentication system. Offline verification uses prescribed identity information, such as a digitally signed offline e-KYC document, without requiring an online authentication request against the CIDR for that verification.
Q. How can I lock my Aadhaar biometrics?
Ans. You can use UIDAI's biometric-locking facility through its official website or supported Aadhaar services. Once locked, biometric authentication using the locked modalities cannot be completed until you temporarily unlock or disable the lock.
Q. How can I check my Aadhaar authentication history?
Ans. Visit the official UIDAI website and open the authentication-history service. After completing the required verification using your registered mobile number, you can review the available authentication records.
Q. What is Aadhaar Virtual ID?
Ans. Aadhaar Virtual ID (VID) is a temporary, revocable 16-digit number that can be used instead of the actual Aadhaar number for supported authentication services. It helps reduce the need to share the Aadhaar number repeatedly.
Q. Is Aadhaar proof of Indian citizenship?
Ans. No. Section 9 of the Aadhaar Act states that an Aadhaar number or its authentication does not, by itself, confer or establish proof of citizenship or domicile.
Q. Does Aadhaar verification guarantee that a transaction or business is safe?
Ans. No. Aadhaar verification helps establish identity. It does not certify that a business, investment, payment request or transaction is genuine. Individuals should independently verify the organisation and the purpose of any financial transaction.
Q. What is the UIDAI customer care number?
Ans. The UIDAI toll-free helpline is 1947. Residents can also email [email protected] or submit an online complaint through the official UIDAI grievance-redressal portal.