How Do You Secure Aadhaar and OTP Authentication in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

Which Indian authentication methods are actually weakest?

Rank them by what the attacker can realistically reach. SMS OTP on a ported number is the weakest, because number porting is legal, fast and cheap, and the attacker receives the code on their own handset. Next is any OTP read aloud over a call or read from a screen on a video call, which is exactly what AI voice and video deepfakes now automate. Next is document-based e-KYC, where a reused Aadhaar, PAN or driving licence number can be replayed against a bank form. Password plus TOTP on an authenticator app is materially stronger, because the code never travels over the telecom network. Aadhaar's offline biometric authentication is stronger still, because the match happens on a registered device. The order is the point: the cheapest attack in India is still the phone number.

What does the law actually say about a failed authentication?

The Information Technology Act, 2000 is the operative statute. Section 43 criminalises unauthorised access to a computer, computer system or computer network, and section 66 prescribes the punishment. The Ministry of Electronics and Information Technology has confirmed in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner attracts no liability, so a failed authentication becomes an offence when it is exploited without consent. Separately, CERT-In directions require listed incidents to be reported within 6 hours to incident@cert-in.org.in, on the 1800-11-4949 helpline, with 180 days of logs retained. Failing authentication that turns into a data breach therefore starts a 6-hour reporting clock, not a ticket queue.

How do you stop OTP interception in an Indian business?

Three controls, in order. First, stop treating the mobile number as identity: bind the account to a device-bound credential such as a TOTP app or a passkey, and use SMS only for recovery. Second, harden the recovery path, because that is where the real bypass lives: no new beneficiary, no new phone number and no large transfer on the strength of a single OTP. Require a cooling-off period and a callback on a known number for anything above a threshold. Third, record and watch the authentication telemetry, retaining 180 days of logs as CERT-In requires, and alert on a new device, a new mobile number, a failed OTP attempt burst, or a KYC attempted from an impossible travel location. The Kochi pharmaceutical firm that lost Rs 99 lakh in October 2026 lost the money through a compromised accounts-department phone, not a broken OTP.

Who should test authentication, and how often?

Any organisation that authenticates customers, staff or suppliers should test it at least annually, and immediately after any change to the login, recovery or KYC flow. At AAVETech the work is a focused authentication and account-recovery assessment, usually folded into a broader web application penetration test rather than sold as a separate line. The scope covers OTP generation and expiry, session binding, recovery workflows, KYC reuse, and the abuse cases around them. Fixed-price engagements run at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included. Retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise.

What are the common questions about A?