How to Watermark Your Aadhaar Card Copy and Prevent Identity Fraud

Aadhaar is the most requested document in India and the least carefully handled. Photocopies sit in shop drawers, in hotel registers, in property brokers' WhatsApp groups and in the inbox of every fintech app you ever tried once. A single copy is enough to look like you across dozens of services.

The good news is that you have more tools here than in most countries — UIDAI itself provides a masked version of the card, a temporary substitute number, and a biometric lock. The trouble is that almost nobody uses them. This guide covers what to use and when, what to write on the watermark, and how to mark a copy in about a minute without the image ever leaving your phone.

Why an Aadhaar copy is worth so much to a fraudster

A photocopy of an Aadhaar card carries your name, your Aadhaar number, your date of birth, your address and your photograph on a single page. That combination is accepted as proof of identity almost everywhere in the country, which is precisely what makes a stray copy dangerous.

• SIM cards issued in your name. A SIM obtained on a copied Aadhaar and then used for fraud puts your identity on the trail. You can check what is registered against your number on the government's TAFCOP portal, and most people who do are surprised by at least one entry.
• Loans and credit applications. Instant-loan apps have very light onboarding. A clean Aadhaar image plus a PAN card is often the whole requirement, and the first sign of trouble is a recovery call or a damaged credit score.
• KYC reuse across fintech platforms. The same image that satisfied one wallet will satisfy the next one. A copy that verifies anywhere is a copy worth stealing.
• AEPS withdrawals. The Aadhaar-enabled payment system lets money be withdrawn using an Aadhaar number and a fingerprint. Fingerprints have been lifted from documents that bear thumb impressions, including registered property records that are publicly accessible in some states. This is the risk that biometric locking exists to close.
• Mule accounts and shell registrations. Accounts and business registrations opened on someone else's identity, with the consequences landing on the name attached.

What all of these need is a clean, unmarked, complete copy. That is the thing worth denying them.

Start with Masked Aadhaar — UIDAI made it for this

Before you watermark anything, download the right version of the card. Masked Aadhaar is an official e-Aadhaar in which the first eight digits of your number are replaced with X and only the last four remain visible. Your name, photograph, address and the secure QR code all stay intact, so it still functions as identity proof wherever full authentication is not required.

You get it from the myAadhaar portal: choose Download Aadhaar, and tick the masked option before generating the PDF. The file opens with the standard password format UIDAI uses for e-Aadhaar.

A point of clarification, because it circulates in garbled form: UIDAI published a press release in 2022 advising people not to share Aadhaar photocopies with unlicensed private entities, and recommending Masked Aadhaar. It withdrew that release days later, saying it risked being misinterpreted and asking people to exercise normal prudence instead. So it is not accurate to say "UIDAI has banned sharing photocopies". What remains true is that UIDAI builds and offers Masked Aadhaar, VID and offline verification precisely so that you do not have to hand over full details by default.

Two more things worth switching on

These take five minutes once and protect you regardless of how careful you are with copies afterwards.

• Virtual ID (VID). A temporary, revocable 16-digit number that maps to your Aadhaar and can be used in its place for authentication and e-KYC. Generate it from myAadhaar or by SMS, and regenerate it whenever you like — the previous one stops working. Where a service accepts a VID, the recipient never learns your real Aadhaar number at all.
• Biometric lock. From myAadhaar or the mAadhaar app, lock your biometrics. Authentication against your fingerprints and iris then fails until you temporarily unlock it, which is the direct countermeasure to AEPS withdrawal fraud. Also review your Aadhaar authentication history while you are there — it shows where your number has actually been used.

Also worth knowing: for most services, Aadhaar is one of several officially valid documents, not the only one. A passport, voter ID or driving licence can usually be used instead for a bank account or a SIM. If an entity insists on Aadhaar and offers no offline alternative, it is fair to ask which rule requires it.

What to write on the watermark

Masked Aadhaar hides eight digits. It does not stop the copy being reused — your name, photograph, address and last four digits are still a usable identity package for anything that does not verify the full number. That is the gap a watermark closes.

Three elements: the recipient, the purpose, and the date.

• Weak: "COPY". True of every photocopy ever made. Names nobody, limits nothing, never expires.
• Weak: "Self-attested" alone. Standard practice, but it authenticates the copy rather than restricting where it may be used.
• Strong: "For HDFC Bank account KYC only — 17 Aug 2026". One organisation, one purpose, one date.

The recipient makes the copy conspicuously wrong anywhere else, and tells you which submission leaked if it resurfaces. The purpose narrows a general-purpose identity document to one transaction. The date ages the file, so an old copy raises a question that a clean one never would.

If you are self-attesting anyway, you can combine the two: sign as usual, and add the purpose-bound watermark across the whole page. They do different jobs.

How to watermark your Aadhaar copy

The safest way to handle an identity document online is to never put it online. ImageMarker runs entirely inside your browser — the image is processed on your own device and is never uploaded to any server. For Aadhaar in particular, uploading the file to a random free tool in order to protect it would defeat the whole exercise.

1. Download Masked Aadhaar first from myAadhaar, if the recipient does not need the full number.
2. Open imagemarker.app/en/ on your phone or laptop. No install, no account.
3. Add the image. It stays on your device throughout.
4. Type the recipient, purpose and date — "For [company] KYC only — [date]".
5. Turn on tiled / repeat mode so the text covers the whole card. A mark in one corner is one crop away from gone.
6. Set opacity to about 40–60% and keep the text clear of the photograph and the QR code, so both still scan and read.
7. Download and share the marked copy only, then delete the clean original from your gallery.

A quick way to test any tool for this: switch on flight mode first. If it still works, processing really is happening on your device.

Scenario by scenario

KYC verification on apps and platforms

Prefer the platform's official in-app flow, and prefer offline verification or VID where it is offered — both avoid handing over an image entirely. Where an image is unavoidable, use Masked Aadhaar with a watermark naming the platform.

Be aware of one practical limit: automated KYC often reads the document with OCR and may reject a heavy watermark. Keep it light, keep it off the QR code, and if an official uploader rejects the file, submit the clean copy through that same official flow rather than emailing it to someone instead. The in-app route is the controlled one.

Getting a SIM card

Telecom retail is where the largest number of loose Aadhaar copies live. Use an official store rather than a small reseller where you can, and watermark with the operator name and "SIM registration only".

Then check TAFCOP occasionally to see which mobile connections are registered against your Aadhaar. Reporting an unknown connection there is straightforward, and it is the single highest-value five minutes in this whole article.

Opening a bank account

Banks operate under PMLA rules and must identify you from an officially valid document, so a copy is genuinely required. What you can choose is which document, and whether the number is masked. Ask whether offline e-KYC or the secure QR code on your e-Aadhaar is acceptable — both let the bank verify cryptographically without you handing over anything reusable.

If a photocopy is required, watermark it with the bank name, branch and "account opening KYC only".

Rental agreements and brokers

This is the loosest link in the chain. Copies get passed between owner, broker, society office and a WhatsApp group, and nobody ever deletes anything. Masked Aadhaar is usually perfectly adequate here, since the landlord is confirming who you are, not running an authentication.

Watermark with the owner or agency name, "rental agreement only", and the date. If a broker asks for a copy before you have even seen the property, that is a collection exercise, not a verification one.

Beyond the watermark

• Mask anything the recipient does not need. Use a mosaic or a solid block, not a light blur — digits survive weak blurring surprisingly well.
• Strip the EXIF data. A phone photo of your Aadhaar usually carries GPS coordinates and a timestamp. Your address is already on the card; the metadata adds precise coordinates of wherever you took the picture. Clear it with the EXIF cleaner.
• Never share the OTP. No genuine verification ever requires you to read an Aadhaar OTP out to a caller. This is the most common fraud script in circulation.
• Watch WhatsApp auto-save. An image sent in chat lands in two galleries and two cloud backups within seconds.
• Review authentication history periodically. The myAadhaar portal shows where your number has been used. Unfamiliar entries are worth following up.

FAQ

Q: What is Masked Aadhaar and how do I get it?
A: It is an official version of your e-Aadhaar in which the first eight digits are replaced with X and only the last four remain visible. Name, photograph, address and the secure QR code stay intact. Download it from the myAadhaar portal by ticking the masked option on the Download Aadhaar screen.

Q: Did UIDAI tell people not to share Aadhaar photocopies?
A: UIDAI issued such a press release in 2022, then withdrew it days later because it risked being misinterpreted, asking people to exercise normal prudence instead. Masked Aadhaar remains available and is still the safer thing to hand over when full digits are not genuinely needed.

Q: Can a private company insist on Aadhaar as the only ID?
A: Generally no. For a bank account or a SIM, Aadhaar is one of several officially valid documents — a passport, voter ID or driving licence can usually be used instead, and offline verification methods exist. If an entity insists on Aadhaar with no alternative, it is fair to ask which rule requires it.

Q: What is a Virtual ID and when should I use it?
A: A VID is a temporary, revocable 16-digit number that maps to your Aadhaar and can be used in its place for authentication and e-KYC. Generate it from myAadhaar or by SMS and regenerate it whenever you want. Where a service accepts a VID, the recipient never learns your actual Aadhaar number.

Q: How do I stop someone using my fingerprints for AEPS withdrawals?
A: Lock your biometrics from the myAadhaar portal or the mAadhaar app. Biometric authentication then fails until you temporarily unlock it, which blocks the withdrawals that rely on a captured or cloned fingerprint. Reviewing your authentication history is worth doing at the same time.

Masked, marked, and metadata-free

Aadhaar will keep being asked for — that is not going to change. What you control is the version you hand over. Download Masked Aadhaar instead of a full copy, use a VID where it is accepted, lock your biometrics once and leave them locked, write the recipient, purpose and date across the whole image, and strip the metadata before sending.

For the general case of marking any identity document before submission, see watermarking your ID before sending it for KYC.