DigiLocker Document Phishing Scam by email

How it looks by email, the red flags and what to do.

Email is slower than SMS, so these scams usually pretend to be a bill, a refund, an account lock or a job offer and ask you to log in or open a file. DigiLocker Document Phishing Scam is one of the ways this shows up: Messages say your DigiLocker documents are expiring or need verification. The login page is fake and steals your Aadhaar-linked login and OTP.

What digilocker document phishing scam looks like by email

• An attachment such as a PDF, ZIP or HTML file you did not expect.
• A generic greeting instead of your name.
• A login page that opens from the email and asks for your password and OTP.

The scammer builds a page that copies the DigiLocker login screen and sends links through bulk texts, emails or WhatsApp. The message says something your documents need immediate action, such as a Class 10 certificate expiring or a driving licence being flagged. Documents do not expire this way, but the wording feels bureaucratic enough that few people question it.

Red flags to check on the email

• A message says your documents will be deleted or expire.
• The login link is not the official address you type yourself.
• It asks for an OTP and a security PIN on a web page.
• It claims a new certificate is waiting but gives no details.
• It carries a surprise invoice, refund or legal notice.
• The sender address has an extra word or letter.

What to do

1. Do not tap the link or enter any OTP.
2. Open DigiLocker only from the official app or by typing its address by hand.
3. Check your issued documents list inside the real app, not through the message.
4. Report it as phishing in your email app and delete it.
5. If you typed a password on the page, change it at once and turn on two-step verification.
6. Do not open the attachment and do not press the button.

Use Report phishing in your email app. If money or accounts are affected, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. If you shared an OTP, change your PIN and mobile-linked passwords at once from the official app.
2. Report on cybercrime.gov.in with screenshots of the message and the page.
3. Watch for SIM, loan or account activity in your name and tell the provider through official channels.
4. If any money left your bank account, call 1930 immediately.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio Sentinel's link check lets you paste the address before opening it and shows lookalike domains or shortened-link signs. The scam check reads the message you share and notes things like urgency, an OTP request and vague authority. The privacy tools include a password exposure check. Safeavio cannot see into your DigiLocker account or confirm whether a document is genuine, so check inside the official app.

Full guide: DigiLocker Document Phishing Scam: how it works, signs and what to do. Other channels: SMS, WhatsApp.

Questions