DigiLocker Document Phishing Scam on WhatsApp

How it looks on WhatsApp, the red flags and what to do.

WhatsApp scams arrive from numbers you do not know, from a friend whose account was taken over, or from a group you were added to without asking. DigiLocker Document Phishing Scam is one of the ways this shows up: Messages say your DigiLocker documents are expiring or need verification. The login page is fake and steals your Aadhaar-linked login and OTP.

What digilocker document phishing scam looks like on WhatsApp

• A message from an unknown number, often with a stock photo of a smiling person.
• A friend or relative asking for urgent money from a new number or a hacked account.
• A group invite promising returns, jobs or prizes.

The scammer builds a page that copies the DigiLocker login screen and sends links through bulk texts, emails or WhatsApp. The message says something your documents need immediate action, such as a Class 10 certificate expiring or a driving licence being flagged. Documents do not expire this way, but the wording feels bureaucratic enough that few people question it.

Red flags to check on the WhatsApp message

• A message says your documents will be deleted or expire.
• The login link is not the official address you type yourself.
• It asks for an OTP and a security PIN on a web page.
• It claims a new certificate is waiting but gives no details.
• A new number says it is someone you know and asks for money; call the real person on the old number first.
• You are added to a group full of people praising profits.

What to do

1. Do not tap the link or enter any OTP.
2. Open DigiLocker only from the official app or by typing its address by hand.
3. Check your issued documents list inside the real app, not through the message.
4. Warn the group or family, and report the number on Sanchar Saathi if it is a scam call or message.
5. Do not click links or open files. Do not send money or codes.
6. Open the chat, tap the contact name and choose Block and report.

Inside WhatsApp use Block and report; for numbers that call or text you, the Sanchar Saathi portal (Chakshu facility) also takes complaints.

If money or a code is already gone

1. If you shared an OTP, change your PIN and mobile-linked passwords at once from the official app.
2. Report on cybercrime.gov.in with screenshots of the message and the page.
3. Watch for SIM, loan or account activity in your name and tell the provider through official channels.
4. If any money left your bank account, call 1930 immediately.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio Sentinel's link check lets you paste the address before opening it and shows lookalike domains or shortened-link signs. The scam check reads the message you share and notes things like urgency, an OTP request and vague authority. The privacy tools include a password exposure check. Safeavio cannot see into your DigiLocker account or confirm whether a document is genuine, so check inside the official app.

Full guide: DigiLocker Document Phishing Scam: how it works, signs and what to do. Other channels: SMS, email.

Questions