Aadhaar, India’s biometric authentication number, is often touted to be the ‘most trusted ID’ in the country. One of the arguments made in favour of Aadhaar is that it is more reliable compared to other IDs which can be easily faked or forged.
In the ongoing Supreme Court hearings, the Indian government and the Unique Identification Authority of India (UIDAI), the agency implementing the Aadhaar project, have repeatedly argued that Aadhaar will help curb ills like terrorism and banking fraud by ensuring that only “genuine” persons get access to mobiles, and banking services.
Keeping aside the fact that such arguments suggest a complete misunderstanding (or perhaps intentional misrepresentation) of what causes terrorism and banking frauds, a question remains: is Aadhaar as reliable and infallible as it is claimed to be? Contrary to the claims of curbing fraud, there have been various news reports which suggest that fake and forged Aadhaar details have facilitated frauds and unscrupulous activities. That Aadhaar could open the door to identity fraud and identity theft is something that has not been fully understood yet.
In the absence of any official data on this issue, a Google search was done for four sets of keywords – ‘fake Aadhaar’, ‘forged Aadhaar’, ‘Aadhaar fraud’ and ‘Aadhaar scam’ – to explore this vulnerability further.
The aim of the search was to get a better sense of the extent to which Aadhaar was being used for frauds and what made such use possible.
About 100 different cases (31 of which are from 2018) from all over the country were found where fake or forged Aadhaar was used. The full list can be accessed here.
A snippet of the online search for Aadhaar fraud. Credit: The Wire
Even this number is quite likely to be an underestimate as the search was restricted to only English media outlets. It is important to note that these cases are not meant to be exhaustive nor representative, but instead, seek to bring to light an issue that has not received much attention.
A long list of frauds
The search reveals that Aadhaar has been used for a wide range of purposes – carrying out land transfers, procuring passports, getting loans, casting votes, obtaining other IDs, siphoning off ration grains, etc. These include cases of ‘identity theft’ – Aadhaar details of persons have been altered, or Aadhaar details have been forged by changing the photographs and names and taking scans. The genuine holders of Aadhaar have subsequently found themselves in a soup when they were told that loans in their name were not honoured or land transfers in their name were carried out without consent. Such instances are especially striking given that identity theft is precisely what Aadhaar was supposed to fix.
While most of the cases involved a single or few persons indulging in petty frauds, a third of the cases were related to rackets where fake or forged Aadhaar were being mass-produced. The methods involved in these cases varied – the two most common were Aadhaar numbers being issued based on fake or forged documents, and details like name, photographs being forged using rudimentary editing techniques and printers. There have also been instances of biometric and/or demographic details (fingerprints, photographs, names and addresses) being altered at the stage of enrollment. In a few cases, sophisticated methods were used to exploit loopholes in the enrollment process to generate fake Aadhaar numbers. The most prominent of these was the case of a gang in Uttar Pradesh that was caught generating Aadhaar for fictitious persons by cloning the fingerprints of Aadhaar enrollment operators.
A man goes through the process of eye scanning for the Unique Identification database system, also known as Aadhaar, at a registration centre in New Delhi, India, January 17, 2018. Picture taken January 17, 2018. Credit: Reuters/Saumya Khandelwal – RC1F67907F80
The usual official response has been to discredit such reports by stating that no authentic Aadhaar numbers were generated in these cases – that they were simply instances of forgery. Going by the various methods of fraud employed, this justification is only partly correct. In 45 cases, either valid Aadhaar numbers were generated (for instance using fake/forged documents) or the Aadhaar details in the database altered (for instance, using the online detail updating facility).
Moreover, this UIDAI argument misses a key point: irrespective of the method involved, Aadhaar seems to have become extremely easy to fake or forge in paper form and use as ID for a range of services including to obtain SIM cards, open bank accounts, obtain loans, book hotel rooms, get married in court, prove identity for air and train travel, etc. That many of these instances did not involve UIDAI issuing an authentic Aadhaar number does not change the fact that fake or forged Aadhaar details have been used to carry out fraud.
In addition to the cases of forgery and fakes, 17 cases of Aadhaar-enabled banking frauds were compiled by Vipul Paikra, an independent researcher (also available here). In a country with low financial and technological literacy, it is easy for people to fall prey to various types of frauds, especially phishing scams.
A member of parliament recently lost Rs 27,000 after revealing an Aadhaar one-time-password (OTP) to fraudsters over the phone. In another instance, con-men tricked persons on the pretext of linking their Aadhaar to their PAN (issued by the income-tax department for tracking financial transactions) into revealing an OTP which was then used to change the linked-mobile number in the Aadhaar database. Such instances highlight the need for authorities to raise awareness about how to use Aadhaar and clarify what information is not supposed to be shared.
On the latter, unfortunately, the UIDAI has itself spoken with a forked tongue – they have claimed that Aadhaar numbers are not supposed to be confidential every time data leaks have been identified, while at the same time issuing notices urging people to be careful when sharing Aadhaar numbers.
It is worth recalling that Aadhaar is designed to be a number, not a card. In fact, the word ‘card’ does not figure even once in the Aadhaar Act. Aadhaar is supposed to be an identification number to establish the identity of a person using their biometrics. Since Aadhaar cards are often simply Aadhaar details printed on normal paper using standard printers, the ‘card’ does not come with any security features. While the QR code allows checking for authenticity, these checks are rarely ever performed. Further, a recent press release by the UIDAI cautioned persons against getting their Aadhaar laminated or obtaining Aadhaar ‘smart cards’, stating that the QR code on them often cannot be used. Despite this serious lack of credibility, the paper-based Aadhaar ‘card’ continues to be accepted as a valid proof of identity for a range of services.
Neither Aadhaar ‘card’ reliable, nor Aadhaar-based biometric authentication
As its scale and use has expanded, several aspects of Aadhaar have created cause for worry. Regular reports of data leaks have raised doubts about the reliability of the data-security infrastructure. Most recently, a security researcher identified an online dashboard of the Andhra Pradesh government that was publicly displaying Aadhaar numbers linked to large amounts of personal information including addresses and bank details which were compiled through Aadhaar. Moreover, the fact that the dashboard allowed households to be precisely geo-located by caste and religion highlights the grave implications of Aadhaar on privacy.
Importantly, recent evidence has raised serious concerns about the reliability of Aadhaar even for biometric authentication – the feature that makes Aadhaar more reliable than other identification documents. Mandatory biometric authentication to receive welfare benefits has led to increased transaction costs and serious exclusion problems. According to a recent submission to the Supreme Court by the UIDAI itself, authentication failure rates are as high as 6% for fingerprints and 8.5% for iris. A related Supreme Court presentation by the CEO of UIDAI suggests that recent failures are even higher (about 12%) for ‘government services’. It is worrying that biometric authentication remains mandatory for welfare programmes in various states despite evidence of such high failure rates.
To add to these serious concerns, the results from the online search suggest that contrary to its proponents’ claims, Aadhaar has facilitated a range of frauds. They also highlight the urgent need for closely monitoring the rapidly expanding use of Aadhaar ‘cards’ and increasing awareness about Aadhaar usage and vulnerabilities.
Further research is however needed to better understand both, the role of Aadhaar in curbing fraud, and the extent to which it enables fraud.
Anmol Somanchi (anmol.somanchi94@gmail.com) is a graduate of Development Studies from TISS, Mumbai and is currently with a development consultancy based in New Delhi. Views expressed here are personal.