Aadhaar Biometric Theft: How Hackers Bypass OTP for Fraud

A cybercrime ring in Bihar has uncovered a new way to steal money from bank accounts without requiring OTPs or phone calls. 

Hackers exploited Aadhaar biometric data, specifically fingerprints, obtained from government land records to conduct unauthorized transactions using the Aadhaar Enabled Payment System (AePS).
 
In Purnia district, in Bihar, cybercriminals accessed land documents dated June 25, 2024, extracting Aadhaar details and fingerprints. 

They then cloned thumb impressions to impersonate victims and withdraw money via Aadhaar Enabled Payment System (AePS), which does not require OTP authentication. The Bihar Police arrested eight individuals linked to the scam and are actively investigating others involved.

While AePS is designed to facilitate transactions in areas with poor internet connectivity, its reliance on biometric authentication makes it vulnerable to misuse. 

Cybercriminals can replicate fingerprints, allowing them to commit fraud without the victim’s knowledge.

To prevent AePS fraud, Aadhaar users should conceal their Aadhaar number, use a Virtual ID for transactions, and ensure their mobile number and email receive alerts. Victims should report incidents to the National Cybercrime Reporting Portal.

Simultaneously, another cyber scam is emerging, where criminals send fake banking links via messages. 

These links, disguised as legitimate bank alerts, trick victims into clicking them, leading to instant fund withdrawals without OTP verification.

Scammers obtain personal data from sources like online registrations and e-commerce platforms. 

They use this information to craft deceptive messages about recent purchases or transactions. 

Once a victim clicks the link, their bank account is compromised.

With cyber frauds evolving rapidly, users must stay vigilant, avoid clicking on unsolicited links, and verify transactions directly via official banking apps or websites.