Secure your fingerprints and iris data. Learn how to use the UIDAI portal and mAadhaar app to lock your biometrics and prevent unauthorized Aadhaar authentication.
You are sitting in a lecture or hanging out at a cafe when your phone buzzes. It is an SMS from UIDAI: "Authentication successful for Aadhaar number XXXX-XXXX-1234 using Biometrics." Your heart drops because your Aadhaar card is tucked safely in your wallet, and you definitely haven't touched a fingerprint scanner all day.
In the last few years, cases of "biometric cloning" have spiked across India. Scammers use silicon thumbprints created from registry documents or property papers to withdraw money from bank accounts linked to Aadhaar (AePS fraud). By the time you realize your data has been leaked, your bank account could be empty. This is not just about privacy; it is about your hard-earned money and your legal identity. The good news? You have a digital "kill switch" for your fingerprints and iris scans. It is called Biometric Locking, and if you are not using it, you are leaving your digital front door wide open.
Your Aadhaar data is not just a random number; it is protected by the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. Under Section 28 of this Act, the Unique Identification Authority of India (UIDAI) is legally mandated to ensure the security and confidentiality of your identity information.
More importantly, the Aadhaar (Authentication) Regulations, 2016, specifically Regulation 11, gives you the right to "lock" your biometrics. When you enable this lock, any attempt to authenticate using your fingerprints or iris will result in a specific error code (Error Code "330"), and the authentication will fail. This remains in place until you—and only you—temporarily unlock it or disable the lock entirely.
If someone does manage to misuse your Aadhaar because of a security lapse, Section 29 of the Aadhaar Act strictly prohibits the sharing or use of your core biometrics for any purpose other than Aadhaar generation and authentication. If a private entity or official leaks your data, they can face imprisonment for up to 3 years or a fine of up to ₹1 lakh (or both) under Section 37 of the Act.
However, the law is a "reactive" tool. To be "proactive," you need to use the technical safeguards provided by the UIDAI. If you suspect your data has already been breached or used for a crime, you should immediately use the Cyber Crime reporting portal to log a complaint. If the police are hesitant to take your case regarding financial fraud via Aadhaar, remember the Lalita Kumari vs. Govt. of UP (2014) Supreme Court judgment, which makes it mandatory for police to register an FIR if a cognizable offence is disclosed. You can read more on How to file an FIR (and what to do if police refuse) to understand your rights at the police station.
Before you start, there is one non-negotiable requirement: Your mobile number must be linked to your Aadhaar. You cannot lock or unlock biometrics without an OTP (One-Time Password). If your number isn't linked, you must visit an Aadhaar Seva Kendra in person to update it.
Since 2018, UIDAI has moved away from using your actual 12-digit Aadhaar number for everything. A Virtual ID (VID) is a temporary, revocable 16-digit number mapped to your Aadhaar. You need a VID to use the locking features on the portal.
This is the most reliable way to ensure your fingerprints and iris scans cannot be used by anyone.
If you are someone who frequently needs to use Aadhaar (for example, for a new SIM card or bank KYC), the app is faster than the website.
If you are worried that someone has already tried to use your data, you can check the last 50 authentications.
If your history shows successful biometric authentication that wasn't you:
The system is designed to be secure, but Indian tech infrastructure often hits a wall. Here is where you will likely get stuck and how to bypass the frustration:
The "OTP Loop of Death": You try to lock your biometrics, but the OTP never arrives. This usually happens because of heavy traffic on UIDAI servers or issues with your telecom provider.
The "Request Failed" Error: You enter everything correctly, but the portal throws a generic "Technical Error" or "Request Failed" message.
The "Locked Out" Panic: You are at a bank or a SIM card shop, and they need your fingerprint, but you forgot you locked your biometrics. You try to unlock it on the spot, but the internet is slow.
AePS Fraud already happened: If you are reading this because money is already gone from your account via the Aadhaar Enabled Payment System (AePS), locking your biometrics now won't bring the money back.
Offline Authentication: Some private kiosks might claim they don't need your "online" biometric lock to be open.
Copy, fill in the [highlighted] bits, and send.
If you suspect your biometrics are being misused or the portal isn't letting you lock them, call 1947. Use this script:
"Namaste, my name is [Your Name]. I am calling to report a potential misuse of my Aadhaar biometrics. I am unable to lock my biometrics through the MyAadhaar portal due to [mention error: e.g., OTP not arriving/Technical error]. My Aadhaar number ends in [last 4 digits]. Please check if there have been any failed or successful authentication attempts in the last 24 hours and guide me on how to freeze my biometric authentication immediately."
If money was withdrawn using your Aadhaar biometrics without your consent, send this to your bank’s branch manager and the Nodal Officer.
Subject: Urgent: Unauthorized AePS Transaction - [Your Account Number] - Dispute Claim
Body: Dear Sir/Madam,
I am writing to report [Number of transactions] unauthorized transactions from my account [Account Number] totaling ₹[Amount]. These transactions occurred on [Date] via the Aadhaar Enabled Payment System (AePS).
I state that I did not authorize these transactions, nor was I physically present at any banking point to provide my biometrics. This appears to be a case of identity theft/biometric cloning.
As per RBI Circular (RBI/2017-18/15 DBR.No.Leg.BC.78/09.07.005/2017-18), I am reporting this within [Number of days] days. I request you to:
I have also filed a complaint on the National Cyber Crime Reporting Portal (Acknowledgement No: [Number]).
Regards, [Your Name] [Your Phone Number]
When filing on cybercrime.gov.in, use this concise format: "I am reporting unauthorized biometric authentication of my Aadhaar ([Last 4 digits]). On [Date/Time], I received an SMS stating successful authentication, but I did not perform this action. I suspect my biometrics have been cloned. I have now locked my biometrics via the UIDAI portal. I request an investigation into the merchant/Point of Sale (PoS) device used for this fraud under the Information Technology Act and the Aadhaar Act."
No. Biometric locking only stops authentications that require your fingerprint or iris scan (like AePS withdrawals or getting a new SIM). It does **not** affect OTP-based logins, UPI transactions, or your physical ATM card usage.
No, this service is completely free on the official UIDAI website and the mAadhaar app. If a third-party app or a "Cyber Cafe" asks for money to do this, they are likely trying to scam you or steal your data.
This is a tricky spot. Since you need an OTP to unlock your biometrics, you must first get a duplicate SIM card from your telecom provider. If you cannot get a SIM because you need Aadhaar authentication to get one, you must visit an Aadhaar Seva Kendra with your physical Aadhaar card or other ID proofs to update your mobile number or unlock your biometrics via manual verification.
By default, a temporary unlock lasts for 10 minutes. After 10 minutes, the UIDAI system automatically re-locks your biometrics. You don't need to log back in to lock them again.
Yes. Locking biometrics only stops the *digital* scanning of your fingerprints/eyes. Your physical Aadhaar card or the e-Aadhaar PDF remains a perfectly valid identity proof for visual verification at airports, hotels, or exam centres.
RTI templates, FIR scripts, real escalation ladders — the same kind of thing you just read. Sundays only. No spam.
We don't share your email. Unsubscribe any time.
Know your legal protections as an LGBTQ+ person in India. From self-identifying gender under NALSA to reporting discrimination, here is your actionable legal playbook.
Applying for JEE, NEET, or a government job? Here is how to get your SC, ST, OBC-NCL, or EWS certificate without the bureaucratic headache, including a state-wise checklist.
Turn the PM's monthly radio broadcast into local action. Learn how to track the June 2026 highlights, find government schemes, and use the MyGov portal for civic impact.
Want to accept international donations for your social project? Learn how to navigate the FCRA 2010 rules, open the mandatory SBI account, and get your NGO registered.