PAN is meant to be quoted, not posted. Your Permanent Account Number is how the Income Tax Department ties big transactions to you, so banks, employers and sellers are supposed to ask for it. Whether sharing it is safe depends on who is asking and what you send.

Is it safe to share your PAN card number?

The number on its own, yes, with anyone who needs it for a real transaction. The tax rules have long made PAN compulsory for a list of transactions so that they can be reported against your name (PIB). A PAN can't move money by itself: there is no PIN or OTP attached to it.

The card is a different matter. A PAN card copy also shows your photo, your date of birth, your parent's name and your signature. Sent together with an Aadhaar copy, a selfie and a cancelled cheque, it's most of what a fraudster needs to try a loan in your name with a lender that doesn't verify properly. That combination, not the number, is what to guard.

Who can genuinely ask for your PAN?

Under the old Rule 114B, the list of transactions that need PAN included (PIB 2016, PIB 2015):

  • opening a bank account (other than a basic or Jan Dhan account), or a time deposit over ₹50,000 (or more than ₹5 lakh in a year)
  • depositing more than ₹50,000 in cash at a bank in one day
  • paying more than ₹50,000 in cash for a hotel or restaurant bill at one time
  • buying or selling property worth more than ₹10 lakh
  • buying or selling anything worth more than ₹2 lakh, however you pay

Employers, mutual funds and stockbrokers usually ask for it too. A new Income-tax Act took over from the 1961 Act on 1 April 2026, with new rules, so some limits may have changed. Check the current list on the e-filing portal before you argue at a counter.

Who has no need for your PAN: a recruiter before an interview, a delivery agent, a "customer care" caller, a lottery or prize message, or a loan agent who isn't working from a lender's own app.

How to share your PAN card safely online

  1. Send the e-PAN PDF, not a phone photo. The e-PAN is the official digital card. If you applied through Protean, it can be emailed to you; it is free up to three times within 30 days of allotment or an update, and ₹8.26 after that (Protean). If you don't have a PAN yet, the e-filing portal's Instant e-PAN is free if your Aadhaar has a linked mobile and you can use DigiLocker.
  2. Write the purpose and date on it. "For KYC with [bank], [date] only", running across the photo edge. Our PDF watermark guide shows how on a phone, and for a photo of the card, our free masking tool adds it in your browser.
  3. Use the requester's channel. Their portal or an email address on their official domain, not a personal WhatsApp number.
  4. Send only what's asked. Don't attach PAN, Aadhaar and a cheque together unless the form asks for all three.
  5. Never post it. Not in a group, not in a public comment asking for help with a refund.

There is no official masked PAN that we could find, unlike masked Aadhaar, so the purpose note is your main protection. PAN 2.0, approved in 2024, adds a dynamic QR code; its FAQ mentions no masked PAN, and existing holders don't need a new PAN (PIB).

How to check if your PAN has been misused

Your Annual Information Statement. Log in to the income tax e-filing portal and open AIS. It is the department's "comprehensive view of information" reported against your PAN: interest, dividends, large purchases and more. Form 26AS on TRACES now shows only tax deducted or collected at source. If AIS shows something that isn't yours, you can give feedback on that entry.

Your credit report. Every credit bureau must give you one free full credit report, with your score, each calendar year. Each bureau gives its own, so you can spread them across the year. Look for loans, cards or enquiries you don't recognise. Since 2024, RBI also requires credit bureaus to send you an SMS or email when a lender pulls your report, so an unexpected "your credit report was accessed" alert is worth acting on.

Banks themselves must verify identity documents against the original or through digital checks, not just file a copy (RBI KYC directions). The alerts and the free reports are there because not every lender is that careful.

What to do if your PAN is misused

  1. Report it to the police or cyber cell first: file at cybercrime.gov.in or call 1930 (PIB). If your income tax e-filing account was misused, the department's misuse page says to report to the police first and attach that complaint when you write to it.
  2. Contact the lender named on your credit report, in writing, and say the loan isn't yours.
  3. Raise a dispute with the credit bureau that shows it.
  4. Change your e-filing portal password and check its registered mobile and email.
  5. Keep copies of every complaint and reply.

What these steps don't do

  • A purpose note on a copy discourages reuse; it can't stop someone determined to forge.
  • AIS and credit reports show misuse after it happens. They don't block it.
  • Nothing recalls a PAN copy you have already sent.

Where NO SUS fits

When an employer or landlord needs the e-PAN on their phone, send it as a Burn File link from nosus.foo instead of a chat attachment. It is encrypted in your browser, opens once, and needs no account for either of you, so it doesn't sit in a WhatsApp chat for years. The person who opens it can still save it, so write the purpose on it first. For Aadhaar, the companion guide is how to share an Aadhaar copy safely.