DigiLocker Document Phishing Scam by SMS

How it looks by SMS, the red flags and what to do.

On SMS the scammer has only a few lines to work with, so they use a deadline, a threat or a prize and a link that must be tapped "now". DigiLocker Document Phishing Scam is one of the ways this shows up: Messages say your DigiLocker documents are expiring or need verification. The login page is fake and steals your Aadhaar-linked login and OTP.

What digilocker document phishing scam looks like by SMS

• Several near-identical messages arriving together from different senders.
• A sender name that resembles a bank, courier, tax or utility, or an ordinary mobile number.
• A very short message with a deadline such as "today" or "within 24 hours".

The scammer builds a page that copies the DigiLocker login screen and sends links through bulk texts, emails or WhatsApp. The message says something your documents need immediate action, such as a Class 10 certificate expiring or a driving licence being flagged. Documents do not expire this way, but the wording feels bureaucratic enough that few people question it.

Red flags to check on the text message

• A message says your documents will be deleted or expire.
• The login link is not the official address you type yourself.
• It asks for an OTP and a security PIN on a web page.
• It claims a new certificate is waiting but gives no details.
• It tells you to install an app from a link instead of the official store.
• The link domain is not the one you type yourself for that organisation.

What to do

1. Do not tap the link or enter any OTP.
2. Open DigiLocker only from the official app or by typing its address by hand.
3. Check your issued documents list inside the real app, not through the message.
4. Report the sender on the Sanchar Saathi portal (Chakshu facility) and block the number.
5. Delete the message and tell family members who may get the same text.
6. Do not reply, do not tap the link and do not call the number in the message.

You can report suspicious SMS and calls on the Sanchar Saathi portal (Chakshu facility) of the Department of Telecommunications.

If money or a code is already gone

1. If you shared an OTP, change your PIN and mobile-linked passwords at once from the official app.
2. Report on cybercrime.gov.in with screenshots of the message and the page.
3. Watch for SIM, loan or account activity in your name and tell the provider through official channels.
4. If any money left your bank account, call 1930 immediately.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio Sentinel's link check lets you paste the address before opening it and shows lookalike domains or shortened-link signs. The scam check reads the message you share and notes things like urgency, an OTP request and vague authority. The privacy tools include a password exposure check. Safeavio cannot see into your DigiLocker account or confirm whether a document is genuine, so check inside the official app.

Full guide: DigiLocker Document Phishing Scam: how it works, signs and what to do. Other channels: email, WhatsApp.

Questions