Sharing identity documents via WhatsApp may be quick and convenient, but experts warn it significantly increases the risk of data leaks and misuse, prompting calls for safer, authorised sharing methods in India’s growing digital economy.
WhatsApp may be the quickest way to send a PAN card, Aadhaar copy or bank statement, but it is also one of the easiest ways to lose control of highly sensitive data. According to NDTV, the risk is not only deliberate misuse: once a document is sent to a loan agent, broker or hotel desk on a personal phone number, it can be downloaded, copied, synced to cloud storage or left sitting on a device for years. Abhinav Parashar, co-founder and chief executive of Digio, told NDTV that many people believe they are sending information to a company, when in fact they are handing it to an individual’s personal device.
That matters because identity documents are often collected outside formal systems. The problem is especially acute in financial services, where direct selling agents frequently handle customer onboarding. Industry tools such as Secure ID Masker and MaskAadhaar have emerged to help users redact Aadhaar and PAN details locally in the browser before sharing, reflecting growing concern about unnecessary exposure of full documents. The broader point is that each extra copy of a file widens the attack surface and increases the chance of leaks, hacks or misuse.
India’s fraud problem gives that warning real weight. The Reserve Bank of India’s annual report for 2024-25 recorded 23,953 banking fraud cases involving Rs 36,014 crore. The country’s Digital Personal Data Protection framework also places greater emphasis on purpose limitation and responsible handling of personal information, making it harder to justify casual collection through an employee’s phone. Some legal commentary, including analysis from Sakshya, argues that sending Aadhaar documents over WhatsApp can create compliance exposure for organisations, although the exact consequences depend on context and enforcement.
The safer approach is to insist on an official upload link, a company-owned portal or a verified digital system such as DigiLocker or UIDAI’s offline verification framework. If a document absolutely must be shared, a password-protected file with the password sent separately is preferable to a plain attachment. Cybersecurity warnings from Digit and F-Secure also underline a wider rule: never trust urgent WhatsApp requests for identity or banking data without checking the source first. Once personal documents leave your control, recovering them is far harder than sending them.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
