Aadhaar Verification: What It Is and How to Verify an Aadhaar Number

UIDAI has said publicly that any form of Aadhaar (the physical letter, e-Aadhaar, the PVC card, or the mAadhaar app) should be verified, not just accepted at face value, before it’s relied on as proof of identity. In a November 2022 statement, UIDAI urged entities to check Aadhaar using the mAadhaar app or an Aadhaar QR Code Scanner, with the holder’s consent, and asked state governments to direct that this verification step be followed by anyone accepting Aadhaar as ID proof[10].

For India’s banks, NBFCs, and insurers, Aadhaar also carries specific regulatory weight. RBI’s KYC Master Direction lists “proof of possession of Aadhaar number” as one of six Officially Valid Documents (OVDs) accepted for individual customer identification, alongside a passport, driving licence, Voter’s Identity Card, the NREGA job card, and a letter issued by the National Population Register[15].

Cumulative Aadhaar authentication transactions had already crossed 150 billion by the end of April 2025[24].

UIDAI doesn’t offer one single “verify Aadhaar” button. It offers several distinct mechanisms, each answering a different question.

A few methods carry detail worth knowing beyond the table. The Secure QR Code stores the last 4 digits of the Aadhaar number, name, address, gender, date of birth, photograph, and a masked mobile number or email, all digitally signed by UIDAI[8][9]. The Offline e-KYC XML carries the same core demographic fields plus a hash of the registered mobile number and email, and a reference ID with only the last 4 digits of the Aadhaar number, encrypted with a share/passcode phrase the holder sets[4][5][6]; the receiving party can layer on a further OTP or live face-match check[6]. Face Authentication already runs in production across Jeevan Pramaan, the Public Distribution System, scholarship disbursal, farmer welfare schemes, CoWIN, and services offered by banks and telecom operators[14].

UIDAI’s official status-check service is the most direct route:

Generating an Offline e-KYC file is a separate flow, used when you need to hand over verifiable identity data rather than just confirm status:

Offline verification doesn’t need an active connection to UIDAI at the moment of checking, which makes it useful anywhere internet access is unreliable or a live database query isn’t practical[9].

Scanning the Aadhaar Secure QR Code (printed on the Aadhaar letter, e-Aadhaar, PVC card, or shown in the mAadhaar app) through the mAadhaar app or a dedicated QR scanner app checks UIDAI’s digital signature and confirms the document hasn’t been tampered with, without touching UIDAI’s live servers[8][9].

Sharing the Offline e-KYC XML works differently: the holder generates and downloads it themselves, encrypts it with their own passcode, and shares that file directly with the party requesting verification. That party can layer on a further check if needed: an OTP to the registered mobile, or a live face match against the photo already embedded in the XML[4][6].

A status check only tells you whether a number is currently active or deactivated. It’s not a substitute for full authentication, and it doesn’t confirm any of the demographic or biometric data behind the number. Authentication methods (OTP, biometric, offline XML, or QR) retrieve or confirm actual identity data with the holder’s consent; a status check confirms only the number’s state[12].

UIDAI deactivates Aadhaar numbers for defined reasons: the holder’s death, matched against Civil Registration System records; duplicate numbers issued to the same person, where all but one are deactivated; and demographic mismatches against supporting documents. As part of a nationwide clean-up drive, UIDAI had deactivated over two crore (20 million) Aadhaar numbers belonging to deceased individuals as of late November 2025[13].

OTP-based authentication sends a one-time password to the mobile number and/or email address registered against an Aadhaar number in UIDAI’s records. Entering that OTP correctly confirms the person completing the check has access to the registered contact details tied to that Aadhaar number[2].

For BFSI onboarding specifically, Aadhaar OTP e-KYC is treated as a non-face-to-face method[21]. Compliance-industry summaries of RBI’s KYC Master Direction describe accounts opened this way as carrying limits until full Customer Due Diligence is completed, commonly cited as a requirement to complete full CDD within a set period, along with caps on balance and aggregate annual credits in the meantime[21]. The exact current thresholds and timelines vary across the secondary sources reviewed for this piece and should be confirmed against RBI’s current Master Direction text directly rather than treated as fixed here.

Aadhaar’s status as an OVD comes from RBI’s 29 May 2019 amendment to the KYC Master Direction (Notification RBI/2018-19/190), which added “proof of possession of Aadhaar number” to the accepted document list and specified that it may be submitted in any form UIDAI issues[16]. A UIDAI notification from 4 April 2019 recognizes four forms as acceptable for this purpose: the physical Aadhaar letter, downloaded e-Aadhaar, the Aadhaar Secure QR Code, and the Paperless Offline e-KYC XML[17].

Anyone submitting Aadhaar for Customer Due Diligence, other than someone claiming a specific government benefit or subsidy, is required to redact or black out the full Aadhaar number, and regulated entities are expected to store or display only the last four digits in their retained records[18]. Under the same 2019 amendment, banks may voluntarily carry out Aadhaar authentication or offline verification for identification purposes. Where a customer voluntarily submits their Aadhaar number to a bank, authentication is expected to run through UIDAI’s own e-KYC facility, while non-bank regulated entities are expected to rely on offline methods (the QR code or the XML) that don’t expose the full Aadhaar number[19].

RBI has also acted on fraud risk in Aadhaar-linked payment rails specifically. Per KPMG India’s coverage of the directive, a measure dated 27 June 2025, effective 1 January 2026, mandates enhanced KYC processes, stricter API controls, grievance-redressal mechanisms, and closer integration with fraud and security monitoring systems for the Aadhaar Enabled Payment System (AePS)[22].

UIDAI’s own guidance is that any form of Aadhaar, the physical letter, e-Aadhaar, the PVC card, or the mAadhaar app, should be verified before it’s accepted as proof of identity[10]. Read next to what the “Verify Aadhaar” status check actually confirms, active or deactivated status only, with no check against the holder’s name, address, photo, or other demographic details[11][12], the two facts point to a gap that’s easy to miss under time pressure: a status check confirms a number hasn’t been deactivated, which is a narrower bar than the one UIDAI itself set for verifying that the Aadhaar in hand matches the person presenting it.

The practical implication is that “we checked Aadhaar” isn’t one unambiguous claim inside an institution’s onboarding file. A status check confirms only the number’s active/deactivated state, while a full authentication (OTP, biometric, Face Authentication, or offline XML/QR) confirms the demographic or biometric data behind the number[12]. For a bank or NBFC using Aadhaar as an Officially Valid Document under RBI’s KYC framework[15], the more defensible reading is that a status check works as a first filter, not as the verification step itself, since it’s the one mechanism that needs no login or registered mobile number and confirms nothing about who the number actually belongs to[11].

Set against the volume UIDAI processes through its systems each month[24], any single institution’s status-check habit is a small piece of a large, live database. This suggests the more useful question for a compliance team is which of UIDAI’s several distinct mechanisms was used to check a given Aadhaar, and whether that choice actually matches what “verified” is meant to mean under both UIDAI’s own guidance and RBI’s OVD rules[10][15].