Aadhaar-PAN Synthetic Profile Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: HIGH | View Full Scam Details

Aadhaar-PAN Synthetic Profile Scam in India 2026: How Fraudsters Use Your Identity to Steal via UPI and WhatsApp

A new, high-risk scam is rising in India where fraudsters create fake identities by mixing stolen Aadhaar and PAN data to bypass KYC and hawk deceptive loan and welfare offers through WhatsApp.

What Is the Aadhaar-PAN Synthetic Profile Scam?

The Aadhaar-PAN Synthetic Profile Scam involves cybercriminals making fake customer profiles by combining genuine but stolen Aadhaar and PAN details. These details often come from older data leaks or phishing attacks targeting vulnerable Indians. Fraudsters then use these synthetic identities to fool banks, payment apps, and other financial service providers that rely on KYC (Know Your Customer) verification.

This scam mostly targets economically weaker sections who are eager to avail government welfare schemes or easy loans. Victims may be lured with false promises like instant loan approval or cash benefits requiring Aadhaar-PAN linking, especially during times of financial distress. The scam is becoming widespread in many Indian states, with reports to cybercrime cells indicating a worrying surge.

Official bodies like the Reserve Bank of India (RBI), CERT-In, and the Indian Cyber Crime Coordination Centre (I4C) have issued advisories warning citizens about protecting Aadhaar and PAN information. These agencies stress the risks linked with sharing personal details over unsecured platforms like WhatsApp or unfamiliar websites.

How This Scam Works — Step by Step

1. Initial Contact: Fraudsters, sometimes operating through WhatsApp messages or calls, reach out to potential victims with offers such as “Government Welfare Scheme Eligibility” or “Instant Loan Approval with Aadhaar-PAN Linking.”

2. Phishing for Details: In the message or subsequent call, they ask victims to share Aadhaar and PAN details to “verify identity” or “check eligibility.”

3. Data Assembly: Fraudsters combine the stolen Aadhaar and PAN data—possibly obtained in bulk from dark web markets—with the newly phished data to create synthetic profiles. These profiles mimic legitimate KYC documents.

4. KYC Bypass: Using these synthetic identities, fraudsters apply for loans, credit cards, or open new bank accounts through online portals or UPI-linked payment apps. These platforms may not detect the forged profiles because the Aadhaar-PAN combination is valid.

5. Transaction Execution: Once accounts or credit are secured, they conduct fraudulent transactions—often draining money via UPI payments to untraceable accounts or digital wallets.

6. Covering Tracks: The fraudsters may use SIM swaps or multiple number changes to avoid detection. Victims find their accounts suspended or notice unauthorized transactions days later.

Real Warning Signs to Watch For

• Unsolicited WhatsApp messages or calls claiming to offer loans or welfare benefits needing Aadhaar-PAN.
• Requests to share Aadhaar and PAN details through WhatsApp, SMS, or unsecure websites.
• Pressure tactics such as “limited-time offers” or insistence on immediate sharing of personal data.
• Messages containing suspicious links requesting login credentials or OTPs.
• Unfamiliar UPI collect requests or transaction alerts for payments you never initiated.
• Notifications of bank account opening or loan disbursal that you did not apply for.
• Unexpected SIM card disruptions or inability to receive OTPs, which may signal SIM swap attempts.

What Happens to Victims

Victims often suffer financial losses as fraudulent loans or digital payments drain their linked bank accounts or UPI wallets. Since unpaid loans appear on credit records, victims may face difficulty accessing future credit, impacting their financial reputation.

Emotionally, victims report distress and helplessness navigating identity theft and rectifying credit issues. In some cases, SIM swap related fraud leaves them cut off from banking OTPs, complicating account recovery. The complexity of synthetic fraud also means delays in discovering the theft, often only when banks freeze accounts or send legal notices.

What RBI and CERT-In Say

RBI has repeatedly cautioned against sharing sensitive KYC data via insecure channels and urges users to verify the authenticity of loan offers carefully. The regulator emphasizes safeguarding UPI PINs and discourages sharing OTPs or Aadhaar authentication outside official platforms.

CERT-In and I4C advise caution concerning phishing attacks and bulk data trading on dark web forums, highlighting the rise in synthetic identity fraud. Citizens are encouraged to use official Aadhaar and PAN portals for verification and remain vigilant about sharing personal data digitally.

For cybercrime reporting or assistance, the Indian government has set up the national helpline 1930, which provides support for identity theft and fraud complaints.

How to Protect Yourself

1. Never share Aadhaar, PAN, or OTP details via WhatsApp, SMS, phone calls, or outside official government or financial websites.
2. Use official apps and portals (UIDAI for Aadhaar, NSDL for PAN) to verify your KYC and monitor any unauthorized updates.
3. Do not click on suspicious links or download files from unknown WhatsApp contacts.
4. Regularly check your bank and UPI transaction history for unfamiliar activity.
5. Enable mobile SIM lock features offered by telecom providers to protect against SIM swaps.
6. Register for SMS alerts from your bank and financial apps to get immediate updates.
7. Report any suspicious messages or fraudulent transactions promptly to cybercrime.gov.in and your bank.

What to Do If You’ve Been Targeted

1. Immediately inform your bank and block or freeze your bank account and UPI profile to prevent further transactions.
2. Change all passwords and PINs related to your financial apps and Aadhaar-linked services.
3. Report the incident on the national cybercrime portal (cybercrime.gov.in) and call the 1930 helpline for guidance.
4. Lodge a formal complaint with your local police cybercrime cell.
5. Monitor your credit report for any unauthorized loans or accounts opened in your name.
6. Seek help from RBI’s consumer helpline to understand dispute resolution related to bank frauds.

Frequently Asked Questions

Q: How do fraudsters combine Aadhaar and PAN details to create synthetic profiles?
A: They obtain stolen Aadhaar and PAN information from breaches or phishing and mix them to create new, fake identities. These synthetic profiles look authentic enough to pass standard bank KYC checks.

Q: Can synthetic profiles be used for UPI fraud even if the victim has not changed their phone or accounts?
A: Yes, fraudsters use synthetic identities to open new financial accounts unrelated to the victim’s real phone or bank accounts but linked via Aadhaar-PAN data, enabling fraudulent UPI payments.

Q: What are the first steps to take if I receive suspicious WhatsApp messages asking for my Aadhaar or PAN?
A: Do not respond or share any data. Verify the source by contacting the official government or bank helpline directly and report the message to cybercrime.gov.in.

To protect yourself and others, always verify suspicious messages or calls at BharatSecure.app and report fraud to the 1930 helpline for immediate assistance.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.