A xerox can't receive an OTP or press a fingerprint, so it can't prove the person holding it is you. That's the honest answer to "can someone misuse my aadhar card xerox": the risk is real, but it is smaller and more specific than the WhatsApp forwards suggest.

What can't someone do with your Aadhaar xerox?

A copy can't pass the checks that prove a person is you. OTP authentication needs the code sent to your Aadhaar-linked mobile, and biometric authentication needs your fingerprint, iris or face (UIDAI). A photocopy has neither. It can pass checks that only look at the paper: the QR code on every form of Aadhaar is digitally signed by UIDAI, so scanning it proves the details are genuine, but not that the person holding the copy is you. UIDAI's FAQ says it plainly: "Just, by knowing your Aadhaar number, no one can harm you", and no one can withdraw money just by knowing your Aadhaar number or Aadhaar-linked bank account. Its mythbusters page adds that the number alone can't be used for banking or any other service.

The two places people worry about most have mostly closed the paper route:

  • SIM cards. The Department of Telecommunications ended paper-based KYC for new connections from 1 January 2024, keeping it only for exceptions such as persons with disability (DoT, March 2024). Shops now use Aadhaar e-KYC or digital KYC, where the app takes a live photo of the customer and of the original document.
  • Bank accounts. RBI's KYC directions tell banks to verify Aadhaar offline or through digital KYC, and to use a certified copy (checked against the original by a bank officer) only as a stop-gap (RBI).

What can someone do with an Aadhaar photocopy?

They can use it wherever someone accepts paper without verifying it. UIDAI itself says that agencies which simply accept a physical copy, without biometric or OTP authentication, are not following good practice, and in November 2025 it said it wants to discourage reliance on photocopies because they are a possible reason for fraud. In practice that means:

  • Paper-only "proof". A private rent agreement, a job or admission form, a society register or any counter that glances at a copy and files it. Your name, photo, date of birth and address are all on the page.
  • Pretending to be you. With your details in hand, a caller or a fake "KYC update" message sounds far more convincing.
  • Building a fuller profile. An Aadhaar xerox plus a PAN copy plus a cheque leaf is much more useful to a fraudster than any one of them.

The fix is the same for all three: give less, and make each copy useless for anything but its purpose. Our guide to sharing an Aadhaar copy safely goes recipient by recipient: hotel, landlord, recruiter and print shop.

Fingerprint fraud is a separate risk

The Aadhaar fraud that does empty bank accounts uses a cloned fingerprint together with your Aadhaar number, which a full-number xerox hands over. That's one more reason to give masked copies. The Ministry of Home Affairs told Parliament in 2024 that around 29,000 Aadhaar Enabled Payment System (AePS) frauds had been reported on the cybercrime portal. AePS lets you withdraw cash with your Aadhaar number and a fingerprint, so a cloned fingerprint is what a fraudster needs. A biometric lock stops it: with your biometrics locked, any fingerprint, iris or face authentication fails until you unlock it (UIDAI).

Is keeping an Aadhaar photocopy banned in 2026?

No outright ban has been notified. Here is what actually happened:

What the rules already say is useful at the counter. An entity that verifies you offline must not collect, use or store your Aadhaar number. Agencies that authenticate Aadhaar must mask the first 8 digits before storing a photocopy, and banks must have you black out the number. Offering a masked copy anywhere else follows the spirit of those rules. See masked Aadhaar vs photocopy for how to get one.

How to check if your Aadhaar is being misused

Your authentication history shows every time your Aadhaar was used to authenticate, by any agency or by you, in the last 6 months, up to 50 records at a time (UIDAI). Each record shows the method (OTP, fingerprint and so on), the date and time, the agency's name and whether it succeeded. Open it on myAadhaar or in the Aadhaar app; you need your registered mobile.

Look for authentications you don't remember, especially fingerprint ones from places you've never been. If one wasn't you, UIDAI says to contact that agency for details.

What to do if your Aadhaar xerox was misused

  1. Lock your biometrics in the Aadhaar app or on UIDAI's website. You can unlock for about 15 minutes, or for a single authentication, when you need your fingerprint (UIDAI).
  2. For serious misuse, lock your whole Aadhaar. You need a 16-digit Virtual ID first, and once locked, no authentication works until you unlock it.
  3. Call UIDAI on 1947 or email help@uidai.gov.in, and file a grievance on myAadhaar.
  4. If money moved or a fake account was opened, report it at cybercrime.gov.in or call 1930 (PIB), and tell your bank.
  5. From now on, give masked copies only, with the purpose and date written across them.

What a masked copy and a biometric lock don't do

  • A masked copy still shows your name, photo, date of birth and address.
  • A biometric lock doesn't stop OTP authentication; only the full Aadhaar lock does. Never share an Aadhaar OTP.
  • Neither one takes back copies you have already handed out.

Where NO SUS fits

If someone needs your Aadhaar on their phone, send the masked PDF as a Burn File link from nosus.foo instead of a WhatsApp attachment. It is encrypted in your browser, opens once, and neither of you needs an account. The person who opens it can still save it, so the masking and the purpose note still matter. For printing, see how to print at a xerox shop without logging in.