Aadhaar and OTP authentication in India breaks through SIM porting, device takeover and reused e-KYC. What fails, what the IT Act says, and the fixes.
Authentication proves a user is who they claim to be. In India that means an Aadhaar-backed e-KYC check, a one-time password sent to a registered mobile number, or a password plus OTP. It fails in three recurring ways: the OTP is read or intercepted, the mobile number is ported to the attacker, or an identity document is reused against a stolen biometric or a forged video. Aadhaar's own OTP is a six-digit code delivered to the registered mobile. Section 43 of the Information Technology Act, 2000 makes unauthorised access a criminal offence.
Rank them by what the attacker can realistically reach. SMS OTP on a ported number is the weakest, because number porting is legal, fast and cheap, and the attacker receives the code on their own handset. Next is any OTP read aloud over a call or read from a screen on a video call, which is exactly what AI voice and video deepfakes now automate. Next is document-based e-KYC, where a reused Aadhaar, PAN or driving licence number can be replayed against a bank form. Password plus TOTP on an authenticator app is materially stronger, because the code never travels over the telecom network. Aadhaar's offline biometric authentication is stronger still, because the match happens on a registered device. The order is the point: the cheapest attack in India is still the phone number.
The Information Technology Act, 2000 is the operative statute. Section 43 criminalises unauthorised access to a computer, computer system or computer network, and section 66 prescribes the punishment. The Ministry of Electronics and Information Technology has confirmed in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner attracts no liability, so a failed authentication becomes an offence when it is exploited without consent. Separately, CERT-In directions require listed incidents to be reported within 6 hours to incident@cert-in.org.in, on the 1800-11-4949 helpline, with 180 days of logs retained. Failing authentication that turns into a data breach therefore starts a 6-hour reporting clock, not a ticket queue.
Three controls, in order. First, stop treating the mobile number as identity: bind the account to a device-bound credential such as a TOTP app or a passkey, and use SMS only for recovery. Second, harden the recovery path, because that is where the real bypass lives: no new beneficiary, no new phone number and no large transfer on the strength of a single OTP. Require a cooling-off period and a callback on a known number for anything above a threshold. Third, record and watch the authentication telemetry, retaining 180 days of logs as CERT-In requires, and alert on a new device, a new mobile number, a failed OTP attempt burst, or a KYC attempted from an impossible travel location. The Kochi pharmaceutical firm that lost Rs 99 lakh in October 2026 lost the money through a compromised accounts-department phone, not a broken OTP.
Any organisation that authenticates customers, staff or suppliers should test it at least annually, and immediately after any change to the login, recovery or KYC flow. At AAVETech the work is a focused authentication and account-recovery assessment, usually folded into a broader web application penetration test rather than sold as a separate line. The scope covers OTP generation and expiry, session binding, recovery workflows, KYC reuse, and the abuse cases around them. Fixed-price engagements run at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included. Retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise.
| Method | Weakest link | Attacker effort | Recommended use |
|---|---|---|---|
| SMS OTP on a mobile number | SIM porting / message interception | Low | Recovery only, never primary |
| Password plus TOTP app | Phished credentials | Medium | Primary for staff and customers |
| Aadhaar offline biometric auth | Device compromise | High | High-value actions |
| Video KYC / liveness check | Deepfake and morphing | Medium-High | Treat as one factor, not two |
| Passkey or certificate on device | Endpoint malware | High | Preferred where the base allows it |
Authentication proves a user is who they claim to be. In India that means an Aadhaar-backed e-KYC check, a one-time password sent to a registered mobile number, or a password plus OTP. It fails in three recurring ways: the OTP is read or intercepted, the mobile number is ported to the attacker, or an identity document is reused against a stolen biometric or a forged video. Aadhaar's own OTP is a six-digit code delivered to the registered mobile. Section 43 of the Information Technology Act, 2000 makes unauthorised access a criminal offence.
It is safe enough to use as one factor, provided you never treat it as the only one. The OTP is delivered to a registered mobile number, so a ported number defeats it, and the I4C warned in June 2026 that deepfake video can defeat facial authentication and video-based KYC. Pair it with device-bound second factor and treat the account-recovery path as the real authentication surface.
At least annually, and immediately after any change to login, recovery or KYC flows. A focused authentication and account-recovery assessment at AAVETech runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included.
Report it on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline immediately, because reporting speed is what freezes a fraudulent account. Then call the issuing bank's 24-hour fraud number, and file a complaint on the Money Restoration Portal if money has moved. In parallel, CERT-In's 6-hour reporting window applies once the incident touches a listed system.
Not on its own, but if the failure leads to unauthorised access of a computer, computer system or computer network it engages section 43 of the Information Technology Act, 2000. Once a listed incident is involved, CERT-In requires reporting within 6 hours to incident@cert-in.org.in with 180 days of logs retained.
Yes. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner attracts no liability under the Information Technology Act, 2000. Written authorisation and a signed rules-of-engagement document are still required before any testing begins.
Read the full guide on AAVETech: How Do You Secure Aadhaar and OTP Authentication in India?.
Send us your login, recovery and KYC flow diagrams and we will return a written scope, a fixed price and a rules-of-engagement document for signature.
Talk to an analyst about this.