The scam quietly spreading through India in 2026 is one of the more unsettling ones. Fake Aadhaar-based loan app scams don't just steal your money. They steal your identity, take out loans in your name, and leave you explaining yourself to lenders and police. And the worst part? You might not find out until a recovery agent calls your family.
An Ahmedabad gang busted earlier this year did exactly this. They scraped photos from public social media profiles, fed them into AI tools including, reportedly, Google Gemini, and generated convincing deepfake videos that bypassed face-match verification on loan apps. No OTP needed. No physical presence. Loans of ₹5,000 to ₹50,000 disbursed into mule accounts, with your Aadhaar number attached as the borrower on record.
What this scam actually is
This isn't the standard click-this-link, enter-your-OTP fraud. It's more sophisticated. Fraudsters are combining publicly available Aadhaar details with AI-generated face authentication to apply for instant loans through fake or rogue loan apps. And the bit that should genuinely alarm you: they don't need your OTP at all.
India Today reported that the Ahmedabad gang pulled photos directly from Instagram and Facebook profiles to create deepfake liveness videos. These are short clips where the victim appears to blink and turn their head slightly, designed to pass the liveness detection checks that loan apps use to confirm a real person is applying. Multiple gangs running this scam have been busted in 2025 and 2026. NDTV confirmed an interstate operation was taken down by police earlier this year. These aren't isolated incidents, and I think most people still have no idea this kind of scam is even possible.
How the Aadhaar loan fraud works, step by step
- They get your Aadhaar number. This comes from data leaks, fake KYC forms, phishing links in SMS, or physical photocopies you handed to a shop, rental agency, or clinic. Aadhaar numbers are widely shared for routine purposes. They aren't secret the way a PIN is.
- They find your face online. Your public profile pictures on Instagram, Facebook, or LinkedIn are the raw material. One clear, front-facing photo is enough. The Ahmedabad case used publicly visible profile photos, nothing that required any hacking or data breach.
- They generate a deepfake liveness video. AI tools create a short clip where you appear to blink, nod, or turn your head slightly. This passes the liveness detection checks that many loan apps rely on to confirm the applicant is physically present and real.
- They apply on a fake or rogue loan app. These apps copy the branding of real NBFCs registered with RBI. The app runs its own face authentication check, the deepfake clears it, and the application goes through without any human review.
- The loan is disbursed to a mule account. The money moves within hours, through multiple accounts. You're left holding a debt on paper you never agreed to, and your credit score suffers when repayments don't come.
Why Aadhaar biometric verification is being exploited this way
UIDAI's official biometric authentication system is secure when it's implemented properly. Banks, post offices, and government offices that use UIDAI's official API are not the weak point here. The problem is third-party loan apps that skip UIDAI's API entirely and run their own in-app face-match or selfie KYC. That's what deepfakes can fool.
UIDAI has been taking the fraud problem seriously. In 2026, they deactivated over 2.5 crore Aadhaar IDs belonging to deceased persons specifically to prevent misuse, as reported by the Times of India and Business Standard. That's real preventive action. But the gap in third-party app verification is exactly where this scam lives (annoying, I know), and it hasn't been fully closed yet.
CERT-In has flagged AI-enabled identity fraud as a growing threat in its published advisories, consistently warning against sharing Aadhaar-linked data through any channel outside official government or RBI-registered lender interfaces. Their advisory archive at cert-in.org.in has the technical detail if you want to go deeper.
RBI introduced stronger two-factor authentication rules effective April 1, 2026. These help secure banking transactions. But many predatory instant loan apps operate in regulatory gaps where these rules don't yet reach, and that's the window fraudsters are currently exploiting.
Warning signs you've been targeted
Some of these are obvious in hindsight. Most people miss them at the time, especially if they aren't keeping an eye on their credit profile regularly.
- A loan approval SMS or email for something you never applied for
- An EMI reminder or default notice for an account you don't recognise
- Your CIBIL or Experian credit score drops suddenly, with an inquiry or new account you didn't open
- A recovery agent calls about a loan default you've never heard of
- Someone asks you to verify your Aadhaar for KYC over WhatsApp, through an unsolicited app, or on a cold call
- An unfamiliar loan app appears on your phone after you clicked a link from an SMS or WhatsApp message
If any of these happen, don't wait to see if it resolves itself. Act the same day.
How to protect yourself from fake Aadhaar loan apps
The single most effective thing you can do takes about two minutes. Lock your Aadhaar biometrics. On myAadhaar at myaadhaar.uidai.gov.in, or in the mAadhaar app, there's a Lock/Unlock Biometrics option. When locked, nobody can authenticate with your fingerprint or face data until you unlock it yourself. You can temporarily unlock for official use at a real bank or government office and relock right after.
Basically, with biometrics locked, a deepfake video of your face is useless to anyone trying to borrow in your name. That's it. That's the whole protection. We cover the full biometric lock process in our Aadhaar fingerprint security guide. Short version: log into myAadhaar, find the biometrics section, lock it.
A few other steps worth doing right now:
- Use a masked Aadhaar when sharing your ID with anyone who doesn't strictly need your full number. Download it from myaadhaar.uidai.gov.in under Download Aadhaar. It hides the first eight digits while staying valid for most verification purposes.
- Verify any lender before entering your details. Check RBI's DIGITA portal and the registered NBFC list at rbi.org.in before using any loan app. Our DIGITA lender verification walkthrough takes you through it step by step.
- Set your social media profiles to private or friends-only. The Ahmedabad gang needed nothing more than publicly visible Instagram and Facebook photos. Basic privacy settings cut off that data source entirely.
- Check your CIBIL score at least once a year. Free annual report from cibil.com. Any unrecognised inquiry or new account should be disputed straight away, not ignored.
- Only install loan apps from the official Play Store or App Store. Never from an APK link in an SMS or WhatsApp message. Check the developer name before installing even from official stores, and look for the app on RBI's regulated entity list first.
For a full checklist on spotting predatory loan apps before they cause damage, read our guide to fake loan app scams in India.
What to do if a loan has already been taken in your name
Move fast. The window for limiting damage is short, and every hour that passes makes fund recovery harder.
File a complaint at cybercrime.gov.in, the National Cyber Crime Reporting Portal. Select Financial Fraud and include everything you have: the loan SMS, the app name, any account or reference numbers mentioned. This creates the official record you'll need for every step that follows.
Call 1930, the national cyber helpline, as soon as possible. Funds can sometimes be frozen before they've moved through all the mule accounts, but only if you report early. This helpline has helped recover money in time-sensitive fraud cases. Don't put it off.
Write to UIDAI at help@uidai.gov.in with your Aadhaar number and a description of the fraudulent use. They can flag your ID in their system. Then raise a formal dispute with the credit bureau involved, CIBIL or Experian, using your cybercrime complaint number as reference. If a specific NBFC or lender name appears in the loan documents, file an additional complaint with RBI at rbi.org.in/complaints.
Document everything from the start: screenshots, timestamps, SMS records, any call recordings. A well-documented complaint moves significantly faster through the system than a vague one. In my experience, people who come in with organised records get much further much faster.
Where things actually stand
Four people arrested in the Ahmedabad case. An interstate gang taken down in another. These are the operations that got caught. The AI tools these groups used aren't expensive or hard to get anymore. Deepfake software is available for a few hundred rupees, sometimes free, and public social media profiles full of clear face photos are still the most common data source for building them.
UIDAI, RBI, and CERT-In are all working on this problem. The 2.5 crore deactivated Aadhaar IDs, the stronger authentication rules from April 2026, the updated CERT-In advisories: all of it matters. But the specific gap these scams exploit is unregulated loan apps running their own face verification outside UIDAI's official API, and that hasn't been fully closed by regulation yet. Honestly, I'm not sure exactly when it will be.
You can't wait for the system to catch up entirely. Lock your biometrics today. It's free. It takes two minutes. And it makes the deepfake of you completely useless to anyone trying to apply for a loan in your name.
