Big network of cyber thugs under the guise of DigiLocker: Fake apps created to steal Aadhaar and PAN cards

Under the Digital India Mission, ‘DigiLocker’ of the Government of India has become the most trusted platform for crores of citizens of the country, where important official documents like Aadhar Card, PAN Card, Driving License, Vehicle RC and educational degrees are kept safe in digital form. But now cyber criminals and international hackers have found a new way to misuse this government identity to steal sensitive documents of innocent citizens. The Ministry of Electronics and Information Technology (MeitY), cyber security agency CERT-In and security researchers have issued an urgent security alert for mobile users across the country.

According to reports, fake apps, clone websites and dangerous APK files that look exactly like the official DigiLocker are being spread rapidly on the internet. The interface, look and logo of these fake apps have been designed exactly like the government DigiLocker, so that common citizens can upload their most confidential government documents in them without any doubt. Even if a person accidentally enters his document information or Aadhaar number on these fake platforms, his entire digital identity data directly reaches the foreign servers of cyber criminals, thereby increasing the risk of identity theft and big financial scams manifold.

Once a citizen’s Aadhaar card, PAN card, birth certificate and driving license goes into the database of these fake apps, cyber criminals use it for many illegal and criminal activities:

• Fake bank accounts and loans: With the help of your stolen PAN card and Aadhaar data, fake documents are prepared and personal loans are taken from online lending platforms. If the loan EMI is not paid, the CIBIL score of the genuine citizen gets ruined and calls from bank recovery agents start coming.

• Mule Bank Accounts: Cyber ​​​​thugs open fake bank accounts on your documents without your knowledge to divert the amount of cyber fraud happening across the country, due to which the real victim gets named as the main accused in the police investigation.

• Issuance of fake SIM card: By misusing your Aadhaar card copy, dozens of illegal SIM cards are activated, which are used in serious cases like organized crime, extortion and terrorist funding.

• Blackmailing and Ransom: Some fake apps work like spyware as soon as they are installed on the phone and start extorting money from the user by stealing the device’s photo gallery and personal files.

It is very easy for any citizen to identify whether the DigiLocker app present in his phone is real or a trap laid by a hacker. Make sure to check these 5 important things while downloading from Google Play Store or Apple App Store:

• Developer Name: Always as a developer below the original DigiLocker app “National eGovernance Division, Government of India” (NeGD) is written. If any private company, person’s name, or any other strange spelling (like Digital Locker Corp, Govt Tech Apps etc.) is written in place of developer, then it is 100% fake app.

• Number of Downloads (Total Downloads): The original DigiLocker app of the Government of India has been downloaded more than 10 crore (100 Million+) times so far. If the app you are looking at has only a few thousand or a few lakh downloads, then understand that it is a recently created clone app.

• Domain of official website (.gov.in): The only authorized and legitimate website of DigiLocker https://www.digilocker.gov.in Is. All official websites of the Government of India invariably end with ‘.gov.in’. If you are asked to login or download the app in the name of DigiLocker on a website with ‘.com’, ‘.org’, ‘.net’, ‘.in’ or any other extension, then that is a fake link.

• Demand for unnecessary permissions: The original DigiLocker app only asks for essential basic permissions. If any app asks you for permission to read your phone’s ‘Accessibility Service’, your entire contacts list, call logs or WhatsApp messages, block it immediately as government apps never require these things.

• Distance from third party APK links: Often such messages come on WhatsApp, Telegram or SMS which say ‘To get the new updated version of DigiLocker, install the app from this link’. The government never asks to download the APK file through any third-party link or chat message.

Hacker gangs extensively resort to ‘Typosquatting’ technique to mislead citizens. In this, they register domains with fake spellings similar to the name of the real website—like digiloker.in, digi-locker-gov.com, or digilockerapp.net.

When a common user quickly searches DigiLocker on a search engine, these hackers run sponsored ads on Google and show their fake website at the top of the search results. The user clicks on that link without checking the URL and enters his Aadhaar number and security PIN on the fake login page there. As soon as the user submits the data, that information gets saved on the servers of cyber thugs and the user’s mobile phone comes on the radar of hackers.

If you have even the slightest suspicion that you have accidentally installed an unauthorized or suspicious DigiLocker app on your phone, then without panic immediately take the following security steps:

• Uninstall the app immediately: First of all, turn off the mobile internet (Mobile Data/Wi-Fi). Go to ‘Settings’ of the phone and clear all the cache and data of that suspicious app from the ‘Apps’ list and uninstall it permanently from the phone.

• Lock Aadhaar biometrics instantly: Activate the greatest defense you know. Official portal of UIDAI myaadhaar.uidai.gov.in Visit or activate your ‘Biometrics Lock’ feature instantly using the official ‘mAadhaar’ app. Once the biometrics are locked, no one will be able to do Aadhaar authentication with your fingerprint or iris data.

• Change actual PIN and password of DigiLocker: Change your 6 digit security PIN and password immediately by visiting the official website (digilocker.gov.in) on a secure computer or any other trusted device.

• Keep an eye on bank accounts and CIBIL reports: Pay attention to your bank account transactions. Inform your bank that your documents are suspected of being tampered with. Also, check your free credit/CIBIL report every month to know whether any unknown loan account has been activated on your PAN number.

• File complaint immediately on cyber portal: Government of India’s National Cyber ​​Crime Reporting Portal to lodge complaints about data theft or suspicious apps cybercrime.gov.in Visit or toll-free helpline number 1930 Call at. Along with this, go to ‘TAFCOP’ module of ‘Sanchar Saathi’ portal and check how many mobile numbers are registered in your name; If you see any unknown number, block it immediately from the portal.