Aadhaar and AePS fraud: your thumbprint can withdraw your money
Through AePS, cash can be withdrawn from a bank account linked to your Aadhaar with your Aadhaar number and your fingerprint at a micro-ATM, with no card and no OTP. Fingerprints are taken at fake eKYC camps, at dishonest payment counters and from documents that carry them. Lock your biometrics on myAadhaar or in the mAadhaar app, unlock them only when you need them, and give a thumbprint only where you are withdrawing your own money.
How it plays out
The pension eKYC that needed a thumbprint, twice
A message is forwarded into the colony's WhatsApp group: senior citizens with pending pension or ration benefits must complete Aadhaar eKYC by the end of the week, at a camp in the community hall on Saturday. A retired mill worker goes, with his Aadhaar card and his passbook.
The young man at the table has a laptop and a small fingerprint device. He checks the Aadhaar number, asks which bank the pension is paid into, and asks for a thumbprint. The device beeps; it "did not register", so he asks for the thumb again. The second time it works, and the retired man is told his eKYC is done.
Two SMSes arrive from the bank that afternoon. He does not read them, so his daughter sees them only on Sunday: ₹10,000 withdrawn through AePS at 11:42, and the same at 11:44.
There was no eKYC. The first thumbprint authorised one withdrawal at a micro-ATM, and the second authorised another. The "camp" was gone by Saturday evening, and the hall had been booked over the phone.
₹20,000 withdrawn in two AePS transactions, each authorised by a thumbprint he gave for an eKYC that did not exist.
A composite of the AePS fraud patterns described in UIDAI, NPCI and Indian police advisories and in reported cases, including the fake eKYC camp and the repeated-thumbprint withdrawal. No real person, place or case is depicted; the amounts are illustrative.
Where it could have stopped
The second touch, and the device. A fingerprint on a stranger's device can authorise a cash withdrawal, so a thumbprint belongs only where you are withdrawing your own money and can see the amount. With his biometrics locked on myAadhaar, both touches would have authorised nothing.
SuspiciousWhat EnfoldAI does here
Scam checker
The forwarded "eKYC camp" message can be pasted into EnfoldAI. The checker flags a benefit that needs your thumbprint on a stranger's device, which is the step this version cannot do without. A fingerprint copied from a document is beyond any app, which is why the biometric lock matters.
Paste any message, link or app.
Auto-check with EnfoldAIHow this scam works
The order is the explanation. Find where your own experience stops in this list. That is how far along the script has run.
- AePS, the Aadhaar Enabled Payment System, lets a business correspondent withdraw cash from your bank account at a micro-ATM using three things: your Aadhaar number, the name of your bank and your fingerprint. It was built for people without cards or smartphones, and it asks for no PIN and no OTP.
- So the fingerprint is the key, and the fake eKYC camp collects it: a "camp" for pensions, ration cards, scholarships, gas subsidy or a new government scheme, where the "verification" is a thumbprint on a device that is really a micro-ATM.
- At a dishonest counter, the operator says the fingerprint "did not register" and asks for it again. The first touch was a balance enquiry or a withdrawal; the second is another withdrawal.
- Fingerprints are also lifted from documents that carry them, such as registered property and sale papers, and copied onto silicone or film. A copied print withdraws money without you being anywhere near the counter.
- Separately, a copy of your Aadhaar is used to get SIM cards in your name, and an "Aadhaar update" SMS or call is used to collect your number, OTP or bank details. A caller who says your Aadhaar is linked to a crime and that you must pay to clear it is running the digital arrest script.
- Many people find out late, because the SMS alert goes to an old number or is never read, and the amounts are small enough that repeated withdrawals over days are common.
If it has already happened
In order, and the order matters. The first step is the one that can still get the money held, so it comes before everything else.
- Lock your Aadhaar biometrics now, on myAadhaar or in the mAadhaar app, with the OTP sent to your Aadhaar-linked mobile. A locked fingerprint cannot authorise another withdrawal.
- Call your bank on the number in your passbook, report each AePS withdrawal as unauthorised, and ask for an AePS fraud dispute to be raised. Get the complaint number and date in writing; RBI's rules tie what you are liable for to how quickly the bank is told.
- Report on 1930 or at cybercrime.gov.in with the dates, times and amounts from the SMS alerts or your statement.
- Check your Aadhaar authentication history on myAadhaar, which lists when and how your Aadhaar was used. Screenshot the entries you did not make; they belong in the complaint.
- Check Sanchar Saathi for mobile connections issued in your name, and report any you do not recognise.
- Make sure the account sends SMS alerts to a number you read. For help with Aadhaar itself, UIDAI's helpline is 1947.
Aadhaar and AePS fraud: common questions
The questions people actually ask about this one, answered in a line or two each.
Can someone withdraw money with just my Aadhaar card?
Aadhaar biometric lock kaise kare?
Can someone misuse a photocopy of my Aadhaar?
Where do I complain about Aadhaar or AePS fraud?
Check before you trust
Paste any SMS, link or app and get a verdict before money moves. Auto-scan flags scam messages the moment they arrive.
Suspicious message? Check it free →