Safety

Is it safe to share a photo of your Aadhaar, PAN or passport?

Sharing an Aadhaar, PAN or passport photo can be part of a legitimate process, but it is never risk-free: verify the recipient, purpose and official submission route first. Where accepted, obtain Masked Aadhaar from UIDAI rather than sending the full number, and share only the document and details actually required.

Dokus teamReviewed on 21 October 2026 · 6 min read · 3 sources

A recruiter wants Aadhaar on WhatsApp, a landlord asks for PAN, or a banking app asks you to photograph your ID. The word “KYC” does not establish that the request is genuine. Check which organisation is collecting the information and which transaction you are actually completing before sending anything.

Choose the right response to the request

Ask whether Aadhaar is necessary or whether the recipient accepts another document or an official verification method. Do not send Aadhaar, PAN and passport together merely because you have them in one folder. Each additional file exposes a different set of information.

Prefer UIDAI's Masked Aadhaar when it is accepted

UIDAI's e-Aadhaar FAQ explains that Masked Aadhaar hides the first eight digits and displays the last four. Obtain it through UIDAI's official service, then confirm it is the version requested. Our Masked Aadhaar download guide walks through preparing the correct file.

Masking the printed number does not make the document anonymous. Name, photograph, address and other identity information can remain available, including through its QR code. Do not put a masked copy on social media or send it to an unverified recipient simply because fewer digits are visible.

Drawing a box over an ordinary Aadhaar photo does not create UIDAI's Masked Aadhaar. If the recipient needs the issuer's electronic document or its verification features, keep and submit the official download unchanged. Ask before editing any document required for KYC; acceptance depends on the actual process.

Prepare a copy only after confirming the requirements

1. Verify the organisation separately. Use its website or a phone number you found yourself. A logo, an employee badge photo or knowledge of your name is insufficient.
2. Ask which fields and document are required. Do not assume a request for “ID proof” also requires PAN, both sides of every card or a selfie holding them.
3. Use the official submission route. Open the app or site independently. Avoid entering through an unexpected message's upload link.
4. Minimise an editable reference copy when accepted. You can redact unnecessary details on a separate copy. Check repeated information on every page and confirm the final export actually hides the intended fields.
5. Review the actual attachment. Confirm the name, pages, recipient and version before sending. Avoid putting the full Aadhaar or PAN number in the filename.
6. Ask about retention. Find out who can access the copy, why it must be stored and when it will be deleted.

If an upload has a size limit and accepts an image-based copy, you can compress the file. These browser tools produce new image pages when processing a PDF; they do not preserve its original digital signature or selectable text. Compression is a formatting step, not a way to hide personal information. Keep the issuer's file for procedures that require it.

What could someone do with an ID photo?

An ID photo brings together details that could support impersonation, false applications or convincing follow-up scams. A passport also exposes travel-document information; PAN identifies a tax record. A photo may help an attempted fraud, but it does not mean every bank account or loan can be opened with that photo alone.

A request becomes more concerning when the person also wants passwords, OTPs, card details or remote control of your phone. Keep any legitimate selfie or live verification within the verified service's own flow. Do not email a new selfie holding ID because a stranger says the earlier image was “not clear enough”.

For WhatsApp and email, consider what happens after delivery: the recipient can save, forward or back up the image. Protection during transmission does not control those later copies. A verified upload reduces casual attachment sharing, but you still need to trust how the recipient handles the document.

If you already shared Aadhaar or another ID with a scammer

Stop sending documents, credentials or money. Preserve messages, phone numbers, URLs, transaction references and the time of the request. If you shared account credentials, change them through the genuine service from a trusted device and tell the bank what was exposed.

For suspected financial cyber fraud, contact your bank immediately and call 1930. The Ministry of Home Affairs explains the national reporting portal and helpline; cybercrime can be reported at cybercrime.gov.in. Reporting is a way to seek action, not a guarantee that money will be recovered.

For Aadhaar, review UIDAI's official account and authentication services. UIDAI provides biometric locking, which restricts biometric Aadhaar authentication while enabled. It does not withdraw an already shared image or stop someone using the visible details in a different scam. Understand how to unlock it before a legitimate transaction that needs biometric authentication. For Aadhaar-specific help, use the contact options on UIDAI's official site.

Watch for unfamiliar transactions and verification messages, and raise suspected misuse with the relevant institution and police. Do not pay a “recovery agent” who promises to erase every copy. A leaked image is different from losing the physical document; describe what actually happened rather than automatically reporting a card or passport lost.

Keep the original and your sharing copy distinct

Dokus stores personal documents encrypted on your iPhone, protected by Face ID or Touch ID where supported. It lets you prepare a sharing copy while retaining the original. It does not issue Aadhaar, PAN or passports, conduct UIDAI authentication or turn an edited copy into an official electronic document. You cannot recall an attachment from every recipient by deleting your local copy.

Common questions

Is it safe to send Aadhaar on WhatsApp?

It is not risk-free. Verify the recipient and purpose, prefer the organisation's official submission route and ask whether it accepts UIDAI's Masked Aadhaar or another verification method. The recipient can save or forward a WhatsApp image even if transmission is protected.

Does Masked Aadhaar hide all my information?

No. It hides the first eight digits of the Aadhaar number and leaves the last four visible. Identity details and the QR code remain relevant. Use it only with a verified recipient who accepts it, rather than treating it as anonymous.

Can I black out Aadhaar digits myself for KYC?

Ask the receiving institution first. An edited image is not UIDAI's Masked Aadhaar, and an official verification process may require the issuer's unchanged file or a different method. Obtain the masked version from UIDAI when that is what the recipient accepts.

I sent my Aadhaar photo to a scammer. What should I do?

Stop sharing information, preserve evidence and monitor accounts and verification messages. If financial cyber fraud is involved, contact your bank immediately and call 1930 or report through the national cybercrime portal. Review UIDAI's authentication and biometric-lock services, understanding that they do not recall the leaked image.

Does biometric locking stop every kind of identity fraud?

No. It limits biometric Aadhaar authentication while enabled. It does not remove an image already shared, prevent copying visible details or protect every unrelated service. Follow UIDAI's instructions and retain access to the official unlock process when you need it.