DigiLocker Document Phishing Scam
Messages say your DigiLocker documents are expiring or need verification. The login page is fake and steals your Aadhaar-linked login and OTP.
A message claims your DigiLocker has a pending verification, a document about to be deleted, or a new issued certificate waiting. It gives a link that looks like a login page. Because DigiLocker holds identity documents such as licence, marksheets and vehicle papers, a stolen login gives a scammer a ready set of proof to impersonate you. The scam works by borrowing trust from a service many people use for convenience.
How the scam works
The scammer builds a page that copies the DigiLocker login screen and sends links through bulk texts, emails or WhatsApp. The message says something your documents need immediate action, such as a Class 10 certificate expiring or a driving licence being flagged. Documents do not expire this way, but the wording feels bureaucratic enough that few people question it.
The fake page asks for your mobile number, then for the OTP, and then sometimes for a security PIN. The scammer enters the same details on the real service in real time. When the real OTP arrives on your phone and you type it into the fake page, they can log in to your real account and see everything stored there.
With access, the scammer downloads your identity documents and uses them for SIM cards, loan applications, rental fraud or to answer identity checks when they call your contacts. Sometimes they remove nothing and you never notice. The harm shows up later, when a lender or a telecom company contacts you about something you never applied for.
An example of what you may see
Example message (invented): 'Your DigiLocker documents are pending verification and will be removed within 24 hours. Login to verify: digilocker-verify-update.example. Enter mobile number and OTP. Digital India Team.' The link is not the official address, the deadline is made up, and a real service would never ask you to type an OTP onto a page you reached through a text. Do not trust the sender name; check inside the real app, which you open yourself, and ignore the message.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- A message says your documents will be deleted or expire.
- The login link is not the official address you type yourself.
- It asks for an OTP and a security PIN on a web page.
- It claims a new certificate is waiting but gives no details.
- The sender is a mobile number or an unknown header.
- The text uses vague signatures like Digital India Team.
What to do right now
- Do not tap the link or enter any OTP.
- Open DigiLocker only from the official app or by typing its address by hand.
- Check your issued documents list inside the real app, not through the message.
- Change your DigiLocker security PIN if you shared any detail.
- Report the number on Sanchar Saathi.
If you already paid or shared a code
- If you shared an OTP, change your PIN and mobile-linked passwords at once from the official app.
- Report on cybercrime.gov.in with screenshots of the message and the page.
- Watch for SIM, loan or account activity in your name and tell the provider through official channels.
- If any money left your bank account, call 1930 immediately.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
Safeavio Sentinel's link check lets you paste the address before opening it and shows lookalike domains or shortened-link signs. The scam check reads the message you share and notes things like urgency, an OTP request and vague authority. The privacy tools include a password exposure check. Safeavio cannot see into your DigiLocker account or confirm whether a document is genuine, so check inside the official app.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
Do DigiLocker documents expire if I do not verify?
Issued documents are not removed because you ignored a text. If a message says so and gives a link, treat it as suspicious. Open the official app yourself and check what is actually listed under your account.
Why would a scammer want my DigiLocker?
It can hold identity documents that make other fraud easier, such as a SIM or loan request in your name. That makes your login more valuable than a single card number. Protect it with a strong PIN.
Is it safe to share a DigiLocker document link?
Share links only with people and organisations you know, for a clear reason. Remember that anyone with the file can reuse it. Prefer sending only what is needed and check expiry on shared links where available.