Technology

How Aadhaar authentication works, and what UIDAI does not store

Every Aadhaar check is a 1:1 match that returns a signed yes or no, or a signed packet of your KYC data. Here is what travels where, what the law stops UIDAI from recording, what your bank or telco may keep, and where the real fraud risk sits.

Chander Prakash

By Founder & Editor

10 min read

Illustrative cover: How Aadhaar authentication works, and what UIDAI does not store
Illustration: Pointales

Aadhaar authentication is a question, not a lookup. A bank, telco or government portal sends your Aadhaar number (or a Virtual ID) plus one proof that you are present, such as a fingerprint, a face scan or an OTP, to UIDAI’s database. The database compares it with your own record only and answers with a digitally signed “Yes” or “No”, or, if you consented to e-KYC, a signed copy of your name, address, date of birth, gender and photo. The law bars UIDAI from recording why you were checked, and its transaction data is deleted after six months. What your bank keeps is governed separately.

What “authentication” means in law

The Aadhaar Act, 2016 defines authentication as submitting an Aadhaar number, with demographic or biometric information, to the Central Identities Data Repository (CIDR), which “verifies the correctness, or the lack thereof” (section 2(c)). Because the number is always sent, every check is a 1:1 match against one record, never a search (regulation 9(4) of the Authentication Regulations).

Between you and the CIDR sit an Authentication User Agency (AUA), the bank, telco or department asking the question; a KYC User Agency (KUA), an AUA also licensed to receive e-KYC data; and an Authentication Service Agency (ASA), which runs the secure line to UIDAI. UIDAI’s dashboard listed 511 AUAs, 35 ASAs and 18,563.58 crore cumulative authentications when last updated on 28 September 2026; November 2025 alone saw 231 crore, including 28.29 crore by face and 47.19 crore e-KYC (PIB, 2 December 2025), on a base of about 134 crore live holders (Lok Sabha reply, 18 March 2026). Where Aadhaar sits beside UPI and DigiLocker is in our guide to India Stack.

The ways you can prove it is you

Mode (regulation 4)What you giveWhat is comparedTypical use
DemographicName, date of birth, gender or address as typedYour demographic record in the CIDRBack-office checks, seeding
OTPA one-time code sent to the mobile or email registered with UIDAIThe OTP UIDAI generatedOnline account opening, e-Sign
Fingerprint or irisA live biometric captured on a registered deviceYour stored biometric templateRation shops, AePS cash withdrawal, SIM issue
FaceA live face image captured by UIDAI’s face softwareYour stored photographPension life certificates, scheme onboarding
Multi-factorTwo or more of the aboveEach in turnHigher-value KYC

Regulation 3 allows two kinds of answer: “Yes/No”, a signed verdict “but no identity information”, and “e-KYC”, a signed, encrypted packet of demographic data and photo that only OTP or biometrics can trigger. Face authentication, launched in 2021, had passed 500 crore transactions across nearly 200 entities by September 2026.

Step by step: what travels where

  1. Information, then consent. The entity must tell you what UIDAI will share, what it is for and that you can identify yourself another way without being refused (regulation 5), then record your consent (regulation 6).
  2. Encrypt on the device. Biometrics are captured only on devices registered with UIDAI (regulation 7). The software packs your number and the factor into a “PID block” and encrypts it before transmission (regulation 9); the block may be buffered briefly and is deleted after sending (regulation 17).
  3. AUA to ASA to CIDR. The entity’s server validates and digitally signs the request and passes it through its ASA.
  4. A 1:1 match against the single record for that number.
  5. A signed answer. For Yes/No: the verdict, a response code, transaction ID and timestamp. For e-KYC: an encrypted block that the e-KYC API shows carrying name, date of birth, gender, address, photograph and a signed PDF of the Aadhaar letter. Section 8(4) bars core biometrics from any response, and section 29(1) bars sharing them with anyone, for any reason.
  6. A notification to you by SMS or email naming the entity, time, response code, last four digits and purpose (regulation 10); failures must be explained, for example “Biometrics locked”.

What UIDAI keeps, and what it is barred from keeping

Section 32(3) of the Act is the sentence to remember: the Authority “shall not, either by itself or through any entity under its control, collect, keep or maintain any information about the purpose of authentication”. Regulation 26 repeats it: UIDAI stores the request including the PID block, the response and server configuration, and “shall not, in any case, store the purpose of authentication or any meta data (other than process meta data)”. UIDAI knows a bank asked about you at 10:42 on Tuesday and got a Yes; it does not know whether that was a loan, a SIM or a pension, and records no location.

Retention is six months (regulation 27), then deletion, unless a court not below a High Court judge orders otherwise or a dispute is pending; the Supreme Court’s majority judgment of 26 September 2018 imposed that limit in place of the earlier five years. Disclosure under section 33 needs an order of such a court, never including core biometrics, or a Secretary-level national-security direction reviewed by an Oversight Committee.

What your bank or telco keeps

The organisation that asked keeps more, for longer, than UIDAI does.

WhoWhat is keptFor how long
UIDAI (CIDR)Request data, response sent, server configuration; no purpose, no location6 months, then deleted (regulation 27)
Requesting entity (AUA/KUA)Logs of request and response parameters, the purpose disclosed, the consent record; never the PID block2 years, then archived 5 years, then deleted (regulation 18)

The logs may record the purpose disclosed and your consent “but shall not, in any event, retain the PID information” (regulation 18), and section 29(3) limits use of any identity information to the purpose told to you in writing. Under UIDAI’s Circular 1 of 2018, only “Global AUAs”, which a law obliges to use the Aadhaar number, may store it; “Local AUAs” get “limited KYC” with a masked number and a token.

Virtual ID and tokens: why each service sees a different number

Since 2019, “Aadhaar number” includes “any alternative virtual identity” (section 2(a)). The Virtual ID is a 16-digit random number mapped to your Aadhaar number that only you can generate, on the myAadhaar portal, by SMS or in the Aadhaar app; UIDAI’s 2018 circular says the Aadhaar number cannot be derived from it and only one VID is valid at a time. Regulation 4A(4) adds a line many counters ignore: “No entity shall store Virtual ID in its system.”

Going the other way, the CIDR gives each agency a UID token, “a 72-character alphanumeric string generated by the Authority mapped to the Aadhaar number and specific to a requesting entity”. Your wallet app and your insurer get different tokens for the same you, so each recognises a returning customer without holding your Aadhaar number or joining databases on it, the same consent-plus-identifier idea that underlies the Account Aggregator framework.

Offline verification: no call to UIDAI at all

Not every Aadhaar check is an authentication. Section 8A, inserted in 2019, created “offline verification”: proving identity “without authentication”, with nothing reaching the CIDR. Regulation 3A lists the forms: the secure QR code on your Aadhaar letter, card and e-Aadhaar, carrying your demographics and photo signed by UIDAI; the Paperless Offline e-KYC file, a signed XML protected by a share code; and, since 9 December 2025, the “Aadhaar Verifiable Credential”, a signed document with at most the last four digits of your number, shareable “in full or part”. Any may be paired with “offline face verification”, a match of your live face against the photo in your own Aadhaar app. The verifier needs your consent and, under section 8A(4), must not “collect, use, or store an Aadhaar number or biometric information of any individual for any purpose”.

The new Aadhaar app, dedicated on 29 January 2026 in Panaji, is built on this. Its key feature, UIDAI’s chief executive said, is selective credential sharing: a hotel or cinema generates a QR code asking only for the fields it needs, you approve in the app, and “Aadhaar numbers are not stored by verifiers and only digitally signed verifiable credentials are shared” (Goa government release).

The controls you already have

  • Biometric lock (regulation 11): every fingerprint, iris or face authentication fails with a “No” until you unlock temporarily; the unlock lapses when the transaction completes or a UIDAI-set window ends.
  • Aadhaar lock (regulation 11A, added 2024): any request using the number returns “No”; you use your VID instead.
  • Authentication history (regulation 28): your signed records for the past six months, through the portal or app, showing entity and time; never a purpose, because none is stored.
  • Masked Aadhaar: the regulations define e-KYC data as carrying a “full or masked Aadhaar number”; a masked e-Aadhaar shows only the last four digits.

Where fraud actually happens

Reported Aadhaar fraud rarely involves the database. In a Rajya Sabha reply of 30 July 2024, reported by MediaNama, the finance ministry said the RBI had found that frauds in the Aadhaar-enabled Payment System (AePS) are “most often due to compromise of Aadhaar number and fingerprint biometrics from other sources, mainly land/property registration records”. Gujarat Police’s Cyber Centre of Excellence spells out the mechanics in a 2026 advisory: an AePS withdrawal needs only an Aadhaar number and a fingerprint, “no debit card, no PIN, no OTP”; gangs lift thumb impressions from sub-registrar records, make silicone clones and withdraw at a micro-ATM. Citing the cybercrime centre I4C, it puts UPI-and-AePS-linked losses reported in FY2023-24 at ₹459 crore.

UIDAI’s answer is liveness: since February 2023 fingerprint authentication combines the minutiae pattern with the finger image to check for a live finger, and the 2026 face SDK carries “AI/ML-based liveness and anti-spoofing”. Yours is the biometric lock, which makes a cloned finger useless. The other big category is social engineering around OTPs sent to the mobile registered with UIDAI: whoever controls that SIM, or talks you into reading the code out, can pass OTP-based e-KYC in your name, as our guides to SIM-swap fraud and the weaknesses of SMS codes explain. None of this requires breaking into the CIDR.

Who is allowed to ask for your Aadhaar

Section 4(3) says you “may voluntarily use” your Aadhaar number, meaning with informed consent; section 4(7) allows mandatory authentication only “if such authentication is required by a law made by Parliament”; section 7 lets governments require it for subsidies and benefits paid from the Consolidated Fund, with an alternative if you have no Aadhaar. The 2018 majority upheld section 7 and PAN linking, declared unconstitutional the part of section 57 that let “any body corporate or person” use Aadhaar under a contract, and held mandatory mobile linking illegal and bank-account linking disproportionate. Section 57 now reads “Omitted”.

Its replacement is section 4(4), inserted in 2019: an entity may authenticate if UIDAI is satisfied it meets privacy and security standards and either a law of Parliament permits it or the purpose is one the central government prescribes “in the interest of State”. The Good Governance Rules of August 2020 prescribed those purposes (good governance, preventing leakage of welfare benefits, enabling innovation and knowledge) for ministries and departments. The amendment of 31 January 2025 added “promoting ease of living of residents and enabling better access to services for them” and let “any entity other than the Ministry or Department” submit a proposal through the relevant ministry for UIDAI to examine. Critics say this reopens what the court closed; it is untested in court.

Whoever asks must, under section 4(6), offer “alternate and viable means of identification” and not deny service for refusing. Breaches carry civil penalties of up to ₹1 crore per contravention (section 33A). The DPDP Act, 2023 sits on top: section 38 makes it “in addition to and not in derogation of” other laws, prevailing in a conflict, so an entity holding your e-KYC data is also a data fiduciary.

Common misunderstandings

  • “UIDAI can see everything I do.” It sees that an entity asked and what it answered, for six months, with no purpose or location, by statute.
  • “Authentication sends my fingerprint to the bank.” The device encrypts it before it leaves the sensor and the bank may not keep it; the bank gets a Yes or No.
  • “Scanning my QR is authentication.” It is offline verification: the verifier checks UIDAI’s signature, nothing reaches the CIDR, and it may not store your number.
  • “A shop can insist on Aadhaar.” Outside section 7 schemes and laws of Parliament, use is voluntary and an alternative must be offered.

The point: An Aadhaar check sends an encrypted packet to the CIDR and gets back a signed Yes or No, or your KYC fields if you consented; the Act bars UIDAI from recording why, and its data is deleted after six months, while your bank keeps its own logs for two years and may never hold your biometrics. Use a Virtual ID, lock your biometrics so a cloned fingerprint fails, and remember that the real losses have come through cloned prints at micro-ATMs and surrendered OTPs, not through the database.

Sources

Share