AI-Made Fake Aadhaar and PAN: Check the Signature, Not the Looks

A photo or scan of an Aadhaar or PAN card proves very little now. Image tools can produce a card with the right layout, fonts, photo placement and a plausible number, and you can't tell it apart by looking. What a generator can't produce is UIDAI's digital signature or a match in the PAN database. So check the card against the issuer's own record, not against your memory of what a real card looks like.

For Aadhaar, that means scanning the Secure QR code with UIDAI's app or checking the digital signature on the e-Aadhaar PDF. For PAN, it means the free Verify PAN Status service on the Income Tax e-Filing portal. Each check takes a minute or two.

Why looking at the card no longer works

The visual cues people relied on are the easiest things to copy: the layout, the Ashoka emblem, the font, the photo position, a QR code in the corner and a number in the right format. A generated card can carry all of them. A QR code can also be faked. It will hold made-up text or nothing useful, but it looks the same until it is scanned by an app that checks UIDAI's signature.

What holds up is a check that depends on a secret or a database only the issuer controls:

• UIDAI's digital signature, on the Secure QR code and on the e-Aadhaar PDF. Producing a valid one needs UIDAI's private signing key.
• The PAN database, queried through the e-Filing portal.
• The Aadhaar database, queried through myAadhaar's Verify Aadhaar service.

Checking an Aadhaar card

1. Scan the Secure QR code

The QR code on the Aadhaar letter, the e-Aadhaar and the PVC card holds the holder's details and photograph, digitally signed by UIDAI. Scan it with UIDAI's Aadhaar QR Scanner app (published by UIDAI on Android and iOS), not a general QR reader. A general reader shows whatever text is in the code. UIDAI's app checks the signature and shows the signed details and photo.

Then compare three things: the details the app shows, the details printed on the card, and the person in front of you. A generated card fails one of these. Its QR code doesn't verify, or it verifies and shows someone else's details.

2. Check the e-Aadhaar PDF signature

If someone sends an Aadhaar digitally, ask for the e-Aadhaar PDF downloaded from UIDAI, not a photo or screenshot. The PDF carries UIDAI's digital signature, and any edit after signing breaks it.

1. Open the free e-Aadhaar signature check.
2. Select the PDF and enter its password: the first four letters of the name in capitals followed by the year of birth (for example, SURE1990).
3. Read the result. Valid means the file is exactly as UIDAI signed it. Invalid, or no signature at all, means don't rely on it.

The PDF is checked in your browser and isn't uploaded. The tool fetches only the public issuer certificates it needs to complete the chain.

A JPEG or PNG of a card has no signature to check, so it can't pass this test. Is this e-Aadhaar real? compares the PDF, QR and live-app checks side by side.

3. Verify the Aadhaar number

On myAadhaar's Verify Aadhaar page, enter the 12-digit number and the captcha. A real, active number returns its age band, gender, state and the last three digits of the linked mobile. This catches made-up numbers. It won't catch a fake card that reuses a real person's number, which is why the QR or PDF check matters more.

Checking a PAN card

A PAN card's printed details are easy to copy onto a fake. The simplest official check is the PAN database itself, through the e-Filing portal.

1. Go to the Income Tax e-Filing portal home page. No login is needed.
2. Under Quick Links, click Verify PAN Status.
3. Enter the PAN, the full name, the date of birth and a mobile number you can access, then click Continue.
4. Enter the 6-digit OTP sent to that mobile and click Validate.
5. Read the status. It tells you whether the PAN is active and whether the name and date of birth you entered match it.

This confirms the PAN, name and date of birth go together. It can't confirm that the person who gave you the card is the PAN holder, because the portal shows no photo. If you received an e-PAN as a PDF, check it for a digital signature with the PDF signature verifier. A signature that shows as valid means the file hasn't been altered since it was signed.

A worked example: a landlord checking a tenant

A landlord receives two images on WhatsApp: an Aadhaar card and a PAN card. Both look normal.

1. She asks the tenant for the e-Aadhaar PDF instead. The tenant downloads it from myAadhaar and sends it with the password. The signature check shows it valid, and the photo matches the person she met.
2. She runs Verify PAN Status with the PAN, the name as printed and the date of birth from the e-Aadhaar. The portal says the PAN is active and the details match.
3. She keeps the PDF and a note of the check date.

If the tenant had refused to send the PDF, or the details had failed to match, that would have been the moment to stop.

Red flags

• Only a photo or screenshot is offered, and the PDF or physical card is "not available".
• The QR code won't scan in UIDAI's app, or shows different details from the card.
• The e-Aadhaar PDF opens without a password, or has no signature at all.
• The name or date of birth fails the PAN status check, or the person can't say their own date of birth as printed.
• Pressure to skip checks because it's "urgent".

If you've been handed a fake, or your details were misused

Don't use or forward the document. Making or using a forged identity document is a criminal offence under the Bharatiya Nyaya Sanhita, 2023. Report fraud to the local police or on the National Cyber Crime Reporting Portal (helpline 1930).

If you think your own Aadhaar number is being used on fake cards, UIDAI's Aadhaar app and the myAadhaar portal let you lock your biometrics and see your authentication history. Unusual activity there is worth taking to UIDAI.

FAQ

Can a fake Aadhaar card have a QR code that scans?

A generated QR code can scan in a general QR reader and show any text. In UIDAI's QR scanner app it either fails the signature check or shows the signed details of whoever's real Aadhaar was copied. That's why you compare the app's result with both the card and the person.

Is a masked Aadhaar enough?

A masked e-Aadhaar hides the first eight digits of the number but is still signed by UIDAI, so its PDF signature and QR code can be checked the same way. Whether a masked copy is enough for your purpose depends on why you need the Aadhaar.

Does Verify PAN Status need the PAN holder's mobile?

No. The e-Filing portal sends the OTP to the mobile number you enter, which can be your own. You need the PAN, the full name and the date of birth.

Is the yellow question mark on an e-Aadhaar PDF a sign of a fake?

No. It usually means your PDF reader doesn't trust India's CCA root certificate. Check the file with the e-Aadhaar verifier, which validates the chain up to that root. Why e-Aadhaar shows a question mark instead of a green tick explains the cause.

Sources

• Verify PAN Status user manual, Income Tax e-Filing portal
• Verify Aadhaar, myAadhaar (UIDAI)
• Unique Identification Authority of India
• Controller of Certifying Authorities, India
• National Cyber Crime Reporting Portal