Every year, more than a million Indians queue up for a Schengen visa that unlocks entry into 27 European countries. In the five years since the pandemic, that number has more than doubled, powered by rising incomes, a travel boom, and a new generation of Indian tourists fanning out to lesser-known corners. At the centre of almost all those applications is VFS Global, the Zurich-and-Dubai-headquartered visa processing giant that serves as the gateway between India and Europe.
For the first time, questions have been raised on how thisgateway functions after revelations in 150 inspection reports by European authorities covering VFS Global visa centres across 20 EU member states from 2020-2025.
INVESTIGATION — SCHENGEN VISA
Inside VFS Global: Data leaks, fake slots, and visa shopping
150 inspection reports from 20 EU states reveal how India's biggest Schengen visa gateway has been operating — and what auditors found wrong.
DATA SECURITY
Biometric data moved on unencrypted CDs and open email
Luxembourg Embassy inspections found that VFS Global was saving applicants' fingerprints and biometric identifiers on unencrypted compact discs for transfer to consulates. When errors occurred during collection, biometric data was sent over open, unencrypted email. CDs containing application data older than 18 months were recovered, despite a shredder being available on the premises.
150
Inspection reports reviewed
20
EU member states covered
1M+
Indians apply for Schengen visas every year
"The growing reliance by Member States on External Service Providers to handle parts of the visa process calls for improved quality control and monitoring."
— European Commission, responding to Lighthouse Reports investigation
A 2024 Luxembourg Embassy inspection of VFS's New Delhi operations flagged a significant increase in fake VFS appointments, described as being sold by unscrupulous travel agents. From June 2024, the same agents began selling fake employment contract letters to applicants seeking national work visas. The Embassy considered fake appointments outside VFS's direct responsibility but noted the sharp 2024 surge.
★
Fake appointment slots
Fraudulent VFS appointment bookings sold by travel agents, with a notable spike recorded in 2024 at the New Delhi centre.
◆
Fake employment letters (from June 2024)
Forged employment contract letters sold to applicants to fraudulently support national work visa applications — flagged by the Luxembourg Embassy.
⚖
VFS not held directly responsible
Auditors pointed to travel agents as the source of fraud, not VFS India, though the Embassy noted the issue is worsening.
VISA SHOPPING
Files routed through Luxembourg to reach a different EU country
VFS monthly reports consistently flagged high no-show rates at centres in Ahmedabad, Chandigarh and Jalandhar — sometimes exceeding 50%. Auditors found applications being created to fit Luxembourg as the declared destination when the real intended destination was clearly another EU member state. This practice, known as visa shopping, exploits member states that offer faster or easier approval.
50%+
No-show rates in Ahmedabad, Chandigarh & Jalandhar
27
Countries accessible via a single Schengen visa
→
How visa shopping works
Agents apply via an EU nation offering faster approvals (e.g. Luxembourg), even when the applicant's real destination is another member state — exploiting Schengen's free movement rules.
●
Travel agents blamed, not VFS
The Luxembourg Embassy noted VFS Global is not directly responsible for visa shopping — the practice is driven by travel agents gaming the system.
These reports were obtained by Lighthouse Reports, a non-profit investigative newsroom based in Utrecht, The Netherlands, through more than 40 Freedom of Information (FOI) requests to the EU Commission, the UK and individual EU member states. These were collaboratively investigated by media partners across 11 countries, including The Indian Express in India, Der Spiegel in Germany and Le Monde in France. FOI is a legal framework similar to Right To Information (RTI) Act in India.
The Indian Express scrutinised all inspection reports, tracked the financial footprint of VFS Global, and interviewed nearly 150 applicants at its visa centres in Delhi and Mumbai. Records reveal that EU member states, in their inspections that included a field visit to India, flagged a range of concerns: how applicants’ personal and biometric data is stored on unencrypted discs, its transport and handling; widespread “visa shopping”, mainly by travel agents, in which Schengen visas were obtained from an EU nation, which typically offers faster approval, to reach another member state; and, unclear communication, even “lapses,” in informing applicants that value-added services (VAS), such as premium lounge access, are optional and have no link to visa approval.
People wait in a queue in front of the Trade Centre building where the office of VFS Global is located. (Express photo by Sankhadeep Banerjee)
Responding to queries from Lighthouse Reports, the European Commission said it has announced in the recently adopted EU Visa Policy Strategy that the “growing reliance by Member States on ESPs (External Service Providers) to handle parts of the visa process calls for improved quality control and monitoring”.
The key findings of the investigation:
Fake VFS appointments were found to be sold by travel agents, alongside fake employment contract letters used to support national work visa applications.
At the Swiss mission in New Delhi, passports that were sent back in 2020 were still found with VFS.
Fee reimbursements to applicants incorrectly charged by VFS were found to be mishandled — so much so that Swiss auditors wrote: “This does not work at all.”
A 2024 Schengen evaluation of VFS Global’s India operations, with Germany and Poland, noted that the company’s services were not compliant with EU’s GDPR (General Data Protection Regulation) which govern security of data including tax and financial details.
The reports also note remedial measures undertaken by VFS Global in several cases.
Story continues below this ad
Luxembourg: Insecure data, fake appointments
The Embassy of Luxembourg, which works with 13 visa application centres across India, all operated by VFS Global, raised some of the most detailed concerns. The Embassy, however, also disclosed that it had signed a new three-year contract with VFS for 2024 to 2027, in which the only update from the previous agreement related to personal data protection rules.
Inspection findings from 2022, published in an implementation report in 2023, flagged that the biometric identifiers of applicants were being saved on unencrypted compact discs for transfer from VFS offices to consulates, while scanned application documents were saved on a separate disc. VFS was also found to be sending biometric data over open, unencrypted email when errors occurred during collection or transmission.
Auditors found that compact discs containing scanned applications, supporting documents and biometric data were not being destroyed frequently enough, despite a CD shredder being available on the premises. CDs with application data older than 18 months were recovered.
A 2024 New Delhi inspection report underlined problems of fake VFS appointments and “visa shopping”, mainly by travel agents. On fake appointments, the Embassy considered the matter outside VFS India’s direct responsibility but noted a significant increase in 2024. The inspection report stated: “These fake appointments are usually sold by unscrupulous travel agents. Simultaneously, from June 2024 onwards, the Embassy has observed a considerable increase in fake employment contract letters that agents are selling to applicants in order to apply for a national work visa.”
Story continues below this ad
On visa shopping, the report said, “VFS monthly reports consistently reveal high rates of no-shows, particularly in Ahmedabad, Chandigarh and Jalandhar (sometimes 50% and above) and the Embassy still detects files created to fit Luxembourg as a destination when the real main destination is clearly another MS (Member State).” It pointed the finger at travel agents, saying VFS Global was not to blame directly for this practice.
The Swedish mission’s spot-check of the VFS office in Mumbai in 2023 produced a 19-page report raising two concerns. The first was that Vasco, another visa services company, was found to be operating on the same floor. Auditors noted that “VFS have been informed that they need to take further measures to separate them from Vasco and make clear for applicants that Vasco is an independent company, not related to VFS”. Vasco has since shifted out.
The second observation concerned applicant privacy. The application counters were linked together and separated only by low dividers, meaning that while applicants could not see each other’s documents, their conversations with VFS staff were not private, the report noted.
By 2025, the Swedish mission’s inspection of the Mumbai office found compliance across 14 of 15 assessed categories. The single failing was on value-added services (VAS). The 24-page report stated: “VFS must mention VAS services as optional and this information must be clearly visible to the applicant. VFS must mention that their service is optional and not an obligation. Information must also be updated on their website.”
Story continues below this ad
The seven VAS categories listed were: prime time, premium lounge, extended hours passport collection, hub city passport collection, call-back service, courier fees and SMS. When auditors asked whether it was clear to applicants that these services were optional, the response was: “The information is visible however it is not displayed clearly. A suggestion from the mission is to have a disclaimer outside the premium lounge about the same.”
Switzerland: Passports from 2020, fee refund glitch
The Swiss mission’s 2023 inspection of VFS’s New Delhi office produced a compliance table covering 33 areas of operations. VFS was found non-compliant in six. Among the shortfalls: VFS had not made available the factsheet on “Schengen and personal data” at application counters or on its website, and had not submitted an annual list of additional services it provides, such as photocopies and courier services, nor verified whether the charges for these were in line with local rates.
The inspection also found passports at the VFS office that had been sent back in 2020 but never returned. The report was blunt: “We do not think that there are enough safes for the high season. It is also observed that the passports which were sent back as long as in 2020 were still with VFS.”
A 2025 report from the Hungarian consulate referenced a 2021 on-site inspection of VFS Global in New Delhi, during which auditors found that applicant data older than one month was still accessible in the VFS system.
Story continues below this ad
Under the Schengen visa code, such data must be deleted no later than seven days after transmission. VFS staff were reminded of this requirement during the inspection. The report notes that the problem was subsequently resolved with assistance from Hungary’s IT team, and that “data retention rules are fully respected now”.
With Sarasvati Thuppadolla, investigative reporter at lighthouse reports
Ritu Sarin is Executive Editor (News and Investigations) at The Indian Express group. Her areas of specialisation include internal security, money laundering and corruption.
Sarin is one of India’s most renowned reporters and has a career in journalism of over four decades. She is a member of the International Consortium of Investigative Journalists (ICIJ) since 1999 and since early 2023, a member of its Board of Directors. She has also been a founder member of the ICIJ Network Committee (INC). She has, to begin with, alone, and later led teams which have worked on ICIJ’s Offshore Leaks, Swiss Leaks, the Pulitzer Prize winning Panama Papers, Paradise Papers, Implant Files, Fincen Files, Pandora Papers, the Uber Files and Deforestation Inc. She has conducted investigative journalism workshops and addressed investigative journalism conferences with a specialisation on collaborative journalism in several countries. ... Read More
Nirbhay Thakur is a Senior Correspondent with The Indian Express who primarily covers district courts in Delhi and has reported on the trials of many high-profile cases since 2023.
Professional Background
Education: Nirbhay is an economics graduate from Delhi University.
Beats: His reporting spans the trial courts, and he occasionally interviews ambassadors and has a keen interest in doing data stories.
Specializations: He has a specific interest in data stories related to courts.
Core Strength: Nirbhay is known for tracking long-running legal sagas and providing meticulous updates on high-profile criminal trials.
Recent notable articles
In 2025, he has written long form articles and two investigations. Along with breaking many court stories, he has also done various exclusive stories.
1) A long form on Surender Koli, accused in the Nithari serial killings of 2006. He was acquitted after spending 2 decades in jail. was a branded man. Deemed the “cannibal" who allegedly lured children to his employer’s house in Noida, murdered them, and “ate their flesh” – his actions cited were cited as evidence of human depravity at its worst. However, the SC acquitted him finding various lapses in the investigation. The Indian Express spoke to his lawyers and traced the 2 decades journey.
2) For decades, the Jawaharlal Nehru University (JNU) has been at the forefront of the Government’s national rankings, placed at No. 2 over the past two years alone. It has also been the crucible of campus activism, its protests often spilling into national debates, its student leaders going on to become the faces and voices of political parties of all hues and thoughts. The Indian Express looked at all court cases spanning over two decades and did an investigation.
3) Investigation on the 700 Delhi riots cases. The Indian Express found that in 17 of 93 acquittals (which amounted to 85% of the decided cases) in Delhi riots cases, courts red-flag ‘fabricated’ evidence and pulled up the police.
Signature Style
Nirbhay’s writing is characterized by its procedural depth. He excels at summarizing 400-page chargesheets and complex court orders into digestible news for the general public.
X (Twitter): @Nirbhaya99 ... Read More
People wait in a queue in front of the Trade Centre building where the office of VFS Global is located. (Express photo by Sankhadeep Banerjee)
