Fraud cases involving ‘misuse’ of Aadhaar data on rise, Kolkata Police urges caution

“People must lock their biometric impression by installing the M-Adhaar application,” said Goyal. “A series of recent scams have exposed the vulnerabilities of the Aadhaar Enabled Payment System (AEPS) and how cyber criminals are exploiting loopholes in the system to defraud unsuspecting customers,” said a police officer with the cyber cell.

To protect people from being duped, police also recently issued an advisory aimed at curbing cyber crimes using biometric technology asking people not to share their unmasked Aadhaar number in physical form or as a Know Your Customer (KYC) document and not to provide biometric data to any unauthorised person or at any such place.

Allegations have also surfaced that fraudsters are stealing data, including thumb prints, from land registries on the West Bengal Government’s land records website. According to sources in the Kolkata Police, several of the victims are those who have recently done dealings related to properties.

Sourajeet Majumdar, an independent cyber security researcher, said, “It is being claimed that thumb impressions are being stolen from the land registration office. I checked the website. There is an option to download a digital copy of deed if someone wants to, but it is difficult because it requires several details such as deed number etc. There is another option to download your deed through AIN as a legitimate user if you go to the website and you try to download the copy of the deed, they issue an AIN number so that in future if you want to download some. It’s a 16-digit number . I tried all possible combinations, I could find out the valid 16-digit number and thus in two minutes I could download 100 deeds. They use the 16-digit number to download the deed and they clone the fingerprints and they use the same [data] as the biometric impression to siphon off money. In a country like India where a large section of the people don’t have a lot of technological knowledge and many don’t even have smartphones, it is a tough ask to get people to lock their fingerprints. The AEDS system has loopholes also. Also, the state government should have masked the fingerprints in the land deed before it’s uploaded on the website, thus making the data safer.”

As per police records, a Garfa resident recently lost more than Rs 60,000 without receiving any alert on the generation of OTP or from the bank about the amount having been debited from the account. Tapas Manna ported his mobile number from one service provider to another days before the incident and had to give his thumb impression to complete the formalities. Later, his thumb impression was allegedly misused to transfer money from his account to another account without any OTP. A probe is on, police said.

Also, in July, two residents of the port area suffered losses when fraudsters allegedly withdrew Rs 10,000 each from their bank accounts via the AEPS facility. The cases were investigated by the cyber cell of the Kolkata Police Port Division which ensured full recovery of the lost money for both the victims. A sum of Rs 30,000 was siphoned off by fraudsters from a person’s account in three transactions through the AEPS facility. Due to the cyber cell’s efforts and guidance, the total amount was successfully recovered.

On June 15, a complainant received an SMS about a ‘successful generation’ of mini slip AePS transaction from his savings account with a bank in Garden Reach area. The complainant checked with the bank and found that Rs 10,000 had been debited from his account for an AePS transaction. He then filed a complaint with the cyber crime cell of the Port Division where the officer concerned gave him a patient hearing and advised him to block biometric Aadhar card. On July 19, the money was returned in the account.

The Indian Express also contacted another recent victim of such an instance of fraud, model and actor Mousumi Sanyal Dasgupta, who said she recently lost Rs, 10,000 from one of her accounts and attempts were made to siphon off money from her other bank accounts.

“On September 6 evening, I received an SMS that Rs 10,000 had been withdrawn from my bank account, I checked with the bank and found out that someone had used biometric data to siphon off the money. I froze the bank account and soon started receiving messages that aadhaar authentication for my other accounts were aslo successful. I pay EMI with one of the accounts so couldn’t freeze it and the bank insisted on locking my biometric data. I have now locked my biometric information, filed complaints.The cyber police asked me if I had recently done any property dealings. I bought an apartment in January so they told me that fraudsters are using information from these sites.

I am yet to receive my money back as the matter is still in process. I request everyone to lock their biometric,” Dasgupta said.