Start with the page you trust

For an Aadhaar service, type the official UIDAI or myAadhaar address yourself, or use a bookmark you created from the official website. Pause if a message pressures you to upload identity documents immediately through an unfamiliar link.

A lock icon in the browser shows an encrypted connection; it does not by itself prove that a website belongs to UIDAI. Read the address as carefully as the page title.

Treat each OTP as a decision

Read what the message says the code is for. Enter it only in the service you chose to use. Do not read it aloud to an unexpected caller, forward it over chat, or share your screen while the code is visible. Government Aadhaar-safety guidance specifically cautions against sharing OTPs with callers or other people. Official safety guidance

If you did not start a request, do not approve it merely because someone says it is a “verification” or “cancellation” step.

Share only what the task needs

Before sending a document, ask why it is needed and whether a masked copy is suitable. Check the recipient and attachment twice. Keep a note of where you submitted it, especially when dealing with an organisation for the first time.

Avoid posting Aadhaar details on social media or public support forums. UIDAI recommends the same everyday care you would use with other identity documents. UIDAI usage guidance

Keep your device tidy

Use a screen lock, install updates, and remove identity-document downloads from shared devices when finished. Be mindful of automatic photo backups and shared albums. A screenshot taken to solve a small problem can accidentally become a widely shared copy.

When something seems wrong

Stop interacting with the suspicious page. Save the message and relevant details privately. Open UIDAI independently for help; if the issue involves your bank, contact the bank through its own verified channel.

Our biometric-lock guide explains an additional control you can consider. Keep using Aadhaar thoughtfully: the aim is to understand and authorise each request, rather than respond to pressure.

Source check: 16 October 2026.