Casino Asking for Aadhaar, PAN, and Selfie: Is This Normal and Safe?

The first time you see a casino asking for three documents at once, the instinct is to pause. You have probably submitted a passport or Aadhaar at other sites and that was enough. Now a casino wants your Aadhaar, your PAN card, and a selfie holding one of them. It looks like more than it used to be. And given what you know about Aadhaar data breaches and PAN fraud in India, the question of whether to comply feels genuinely important.

The good news is that this kind of request is normal. The concerning news is that normal does not automatically mean safe. The difference between a KYC request that protects you and one that exposes you comes down to which site is asking, how you prepare the documents, and what you do after submitting. This guide walks through all of it.

Casino Asking for Aadhaar, PAN, and Selfie: Is This Normal and Safe?

You built up a decent balance. You requested your first withdrawal. Then the verification screen appeared and asked you to upload your Aadhaar card front and back, your PAN card, and take a selfie holding the Aadhaar next to your face. Maybe this is your first time seeing all three requested at once. Maybe you have done KYC at other casinos before and this feels more demanding than what you remember.

Both reactions are understandable. The question this guide answers is not just whether this is normal but whether it is safe for you specifically, given the fraud environment Indian players are navigating in 2026, and given that your PAN and Aadhaar together represent two of the most exploitable documents in your financial life.

Why Are They Asking for Three Documents? What Each One Does?

The first thing to understand is that each of the three documents serves a distinct verification purpose. Casinos do not ask for all three because they want as much of your personal information as possible. They ask for all three because each one answers a different compliance question.

What Aadhaar verifies?

Your Aadhaar card is India’s biometric identity document. It confirms your legal name, date of birth, address, and links to your registered photograph and biometric data. For a casino, Aadhaar is the primary identity proof. It tells them you are a real, identifiable person rather than a fictional account created to abuse bonuses or launder money. It also confirms your address, which is required for AML purposes in most licensed jurisdictions.

What PAN verifies?

Your PAN card is your financial identity document. It is the number the Income Tax Department uses to track all taxable financial activity in your name. When a casino processes a large withdrawal back to an Indian player, they need to satisfy AML reporting requirements that connect that payout to a specific taxpayer. Your PAN is how they do that. Without a PAN on file, processing significant payouts through legitimate channels becomes complicated for the platform’s compliance team.

This is not a casino invention. It mirrors what banks do. Any significant transfer involving an Indian beneficiary requires a linked PAN for AML and tax reporting purposes. The casino is applying the same logic.

What does the selfie verify?

The selfie component is the one most people have the most questions about, and it is also the one that has become significantly more common since 2023.

When you hold your Aadhaar card next to your face and take a photograph, you are completing a liveness check. The casino’s verification system cross-references the face in the selfie with the photograph on the document. This confirms that the person submitting the KYC is the same person named on the document. It is a defence against synthetic identity fraud, which became a major problem in the Indian digital lending and gaming space after AI tools made it easier to create convincing fake identity documents using stolen data.

Some platforms have upgraded this to a short video rather than a static selfie. The principle is the same. Liveness verification is now considered standard practice rather than an unusual security measure at well-regulated international casino platforms.

Is This Normal? How KYC Requirements Have Changed?

For Indian players who used offshore casinos five or six years ago, the process was often minimal. You uploaded a passport scan, waited 24 hours, and withdrawals were processed. That era is gone, and it changed for reasons that affect everyone.

Testing by casino review platforms found that traditional KYC processes at casinos serving Indian players now average 2.4 days for account approval, with some players in major cities reporting waits of up to five days during busy periods.

The increase in document requirements reflects a broader tightening of AML compliance across the international gaming industry since 2022. Several high-profile cases of money laundering through offshore casino platforms prompted licensing authorities in Malta, Gibraltar, and Curaçao to require more rigorous identity verification. At the same time, a surge in synthetic identity fraud using AI-generated documents pushed operators toward liveness verification as a standard step.

What this means practically is that a casino asking for all three documents together is not doing something unusual. They are applying what is now considered basic due diligence for a platform with a meaningful licence. A casino that asks for only an email address and lets you withdraw thousands of rupees without any verification is the more unusual and potentially concerning option.

The Real Risks: What Can Go Wrong With Each Document?

Understanding that a KYC request is normal and understanding the risks of complying with it are two separate things. The process is standard. The data you hand over is still sensitive. Here is an honest look at what each document exposes.

Aadhaar risk profile

Your Aadhaar number, combined with your photograph and address, is the highest-value piece of identity data you hold. It links to your bank accounts, mobile numbers, tax records, and biometric data. India has experienced multiple large-scale Aadhaar data exposures, with a 2023 incident involving the records of approximately 815 million Indian citizens being the most widely documented.

The specific risks from a compromised Aadhaar scan are biometric eKYC-based loan fraud, fraudulent SIM card activation, and mule bank account creation. Critically, the biometric component of Aadhaar can be locked, which stops the most dangerous misuse even if the document itself is compromised.

PAN card risk profile

Your PAN is your financial fingerprint. Documented cases of PAN misuse in India include shell company registration, loan fraud via lenders that use PAN-based verification without biometric confirmation, and tax fraud. A particularly stark example involved a grocery store owner in Bulandshahr who received a tax notice for sales of over Rs 141 crore in 2025, after his PAN had been used to register six companies in Delhi that he knew nothing about. Victims of PAN fraud frequently discover it only when they receive unexpected tax notices or loan recovery calls months after the fraud occurred.

Unlike Aadhaar, there is no biometric lock for your PAN. The primary protective tool is a watermarked scan, which renders the document less usable as a forgeable standalone identity proof.

The combined risk of all three together

This is where Indian casino KYC becomes meaningfully different from the same process in Europe or Australia. Your Aadhaar, PAN, and a clear selfie together create a complete identity package. A fraudster with all three documents has your full legal name, address, date of birth, face photo, tax identity number, and the biometric linkage that connects them. That combination is enough for someone to attempt eKYC-based loans at digital lenders, create shell companies in your name, activate fraudulent SIM cards, and open mule bank accounts.

The 2025 synthetic identity cases in Bengaluru involved a fraud ring that created over 200 synthetic identities using AI tools. Having a real face photograph as part of the dataset makes the compositing process significantly more effective than working from stolen document scans alone.

None of this means you should never submit these documents. It means you should only submit them to casinos that have earned a reasonable level of trust, and that you should take protective steps regardless of how trustworthy the casino appears.

How to Protect Yourself Before Submitting Anything?

The good news is that the protective steps are straightforward, and most of them take under fifteen minutes combined. Here is the full checklist of what experienced players do before and during casino KYC.

Step 1: Vet the casino properly

Spending twenty minutes checking a casino’s reputation before submitting sensitive documents is the single most important step, and it is the one most players skip. The two best sources for this are AskGamblers and Casino Guru. Both publish verified player complaints and maintain ratings based on unresolved issues. What you are looking for specifically:

• Pattern of KYC-related complaints- If multiple players report submitting documents and then having withdrawals refused, that pattern is your warning.
• Safety index rating- Casino Guru assigns a numerical safety index. Sites rated above 7 out of 10 have a meaningful record of fair dealing. Below 5 warrants serious caution.
• Operating history- A casino that has been actively reviewing and paying out Indian players for three or more years has more accountability than one that appeared six months ago with aggressive bonus offers.
• Response to complaints- How a casino handles public complaints tells you more than its marketing does. A platform that responds to AskGamblers complaints within 48 hours and resolves them is demonstrating accountability. One that ignores complaints entirely is showing you something important.

Step 2: Use Masked Aadhaar, not a full scan

This is the most important document-level protection available to Indian casino players, and it is one that the majority of first-time KYC submitters do not know about. Masked Aadhaar is an official UIDAI-issued variant of your Aadhaar card that replaces the first eight digits of your twelve-digit Aadhaar number with Xs, showing only the last four. Everything else remains visible and the document is legally recognised for KYC purposes.

How to download your Masked Aadhaar?

1. Visit myaadhaar.uidai.gov.in
2. Log in using your registered mobile number and OTP.
3. Select Download Aadhaar
4. Choose the Masked Aadhaar option before downloading.
5. The resulting PDF is your official UIDAI-issued document, free and ready to submit.

Most legitimate casino platforms accept Masked Aadhaar for identity verification. If a casino specifically insists on your full twelve-digit number and refuses a masked version, treat that as a meaningful red flag.

Step 3: Watermark your PAN scan

A watermarked document is much less useful to anyone who obtains it without your consent, because it cannot be passed off as a clean, unmodified identity document. The method is simple. Before uploading your PAN scan, add text across the image that includes the casino name and the current date. Something like: For [Casino Name] KYC only — June 2026.

You can do this with any basic image editor, including the free tools built into most smartphones. The text does not need to obscure your details. It just needs to be clearly visible across the document face. A scan with specific casino attribution and a date is practically useless for forging a standalone identity document, while remaining completely valid for KYC purposes.

Some players also apply a similar watermark to their Aadhaar selfie, writing the casino name and date on a piece of paper and holding it alongside the document in the photograph. This is optional but adds another layer of protection.

Step 4: Selfie preparation

The selfie matters more than most players realise because it is the component that makes the other documents biometrically usable. A few things worth keeping in mind when taking the verification photo:

• Use good, even lighting so the photo and the document face are equally clear. Blurry submissions get rejected and require resubmission, which extends the process unnecessarily.
• Do not use a photo editing app that applies filters or adjustments. Automated verification systems can flag altered images.
• Hold the document steady and at a natural angle. Some systems use the angle and shadow patterns to detect printed screenshots rather than real documents.
• Take the photo against a plain background where possible. A busy background occasionally causes automated cropping issues that trigger manual review.

KYC Stalling: Recognising the Pattern Before It Costs You

KYC stalling deserves its own section because it is more common than many players realise, and it exploits a specific psychological dynamic. Players who have submitted sensitive documents to a casino and are waiting for a withdrawal are in an uncomfortable position. They want the money, they want to believe the platform is legitimate, and they are reluctant to escalate publicly because doing so feels like an admission that something is wrong. Operators who use KYC as a stalling tactic count on exactly that reluctance.

The pattern typically follows a recognisable sequence. The casino asks for documents. You submit them. The casino verifies the account. You request a withdrawal. The casino asks for additional documents. You submit those. The casino asks for more. Each new request is framed as a routine compliance check. The timeline keeps extending. Your money stays locked.

The protective response to suspected stalling is not to keep submitting documents. It is to ask for written regulatory justification and to file a public complaint if that justification is not provided within a reasonable timeframe. As Suresh’s experience shows, public complaints on AskGamblers and Casino Guru are significantly more effective than private support tickets when a casino is delayed in bad faith.

What to Do After Submitting Your Documents?

Completing casino KYC does not mean your job is done. The documents you submitted are now stored on a third-party server in a foreign jurisdiction, and taking protective steps after submission costs nothing and closes the most serious avenues of potential misuse.

1. Lock your Aadhaar biometrics- Go to myaadhaar.uidai.gov.in and enable the biometric lock under Account Settings. This prevents anyone from using your fingerprint or iris scan for Aadhaar authentication, including eKYC loan applications. It takes under two minutes. You can temporarily unlock it when you need biometric authentication somewhere and re-lock immediately afterwards.
2. Check your CIBIL and credit reports- Pull your credit report from CIBIL, Experian, CRIF, or Equifax within 30 days of submitting KYC. A hard credit inquiry you did not authorise indicates someone ran a credit check in your name. An unknown loan account is more serious. Both should be disputed immediately.
3. Check the Sanchar Saathi portal- Visit sancharsaathi.gov.in to see all mobile numbers registered under your Aadhaar. Any number you did not personally activate should be reported and deactivated. This step surprises many people because they find numbers they had no idea existed.
4. Monitor your Income Tax portal- Log into the Income Tax e-filing portal at incometax.gov.in and check whether any new entities, returns, or unusual activity appear under your PAN. PAN misuse for shell company registration occasionally surfaces here before anywhere else.
5. Enable mAadhaar authentication alerts- The mAadhaar app can be set to notify you whenever your Aadhaar number is used for authentication anywhere. This gives you real-time visibility without requiring you to manually check periodically.
6. Send a data deletion request to the casino- Under India’s Digital Personal Data Protection Act 2023, you have a legal right to request deletion of your personal data. Once your KYC is complete and your withdrawal processed, send a written request to the casino’s support email asking them to delete your identity documents from their records. Create a timestamped copy of the request. Whether they comply is uncertain, but the paper trail matters if fraud surfaces later.

FAQs

1. Is it safe to send PAN to an offshore casino?

Sending a watermarked PAN scan to a well-established casino with a clean complaint history is a manageable risk. PAN on its own is less dangerous than PAN combined with Aadhaar and a selfie. The combination of all three in an unwatermarked format, submitted to an unknown casino with no complaint history, is where the risk becomes meaningful. The protective steps described in this guide reduce the combined risk to an acceptable level for most legitimate KYC situations.

2. What exactly does the selfie with the document prove?

The selfie is a liveness check. It confirms that the person submitting the KYC application is the same person named on the document, rather than someone who found or stole the document, and rather than a synthetic identity created using stolen document data. Automated systems compare the face in the selfie with the photograph on the Aadhaar card. More advanced systems look for signs that the photo was taken of a printed document rather than a real physical ID held by a real person.

3. Can I refuse to submit a selfie and still get my withdrawal?

That depends on the casino’s specific KYC policy. Some platforms allow passport-based verification that does not require a liveness selfie, particularly for smaller withdrawal amounts. If you are uncomfortable with the selfie requirement, contact the casino’s support before submitting and ask whether alternative verification options are available. A casino that has no flexibility at all on this point and insists on a selfie for a small withdrawal might be worth reconsidering.

4. How long should KYC verification take?

Standard KYC verification at offshore casinos now averages around 2.4 days, with straightforward cases often cleared within 24 hours. If you have submitted all requested documents and verification is still pending after five business days with no communication from the casino, contact support and ask for a status update with a clear timeline. Beyond five business days without a coherent explanation, begin treating the delay as a potential compliance issue rather than a normal processing time.

5. The casino verified my account but is now asking for more documents before my withdrawal. Is that normal?

It can be, in specific circumstances. Enhanced Due Diligence, which may include source of funds documentation, is a real AML process that legitimate casinos apply to high-risk accounts, unusually large transactions, or players from higher-risk jurisdictions. What is not normal is EDD being applied to ordinary-sized withdrawals from accounts with no unusual activity, without a clear explanation of what triggered it. Ask the casino in writing to specify which regulation requires the additional documents and for a resolution timeline. A legitimate compliance team can answer that question clearly.

6. What does watermarking a PAN scan actually protect against?

A watermarked scan prevents the document from being used as a standalone forgeable identity proof. If someone obtains your PAN scan and tries to use it to register a company or open an account elsewhere, the watermark text identifying the casino and the date makes the document visually implausible as a genuine unmodified identity submission. It does not prevent the casino itself from storing your information, but it significantly limits the downstream usability of the document if their data is ever compromised.

7. If the casino gets blocked by the government, what happens to my documents?

This is a genuinely important question with an unsatisfying answer. When the Indian government blocks an offshore casino under the Online Gaming Act 2025, it cuts off access from Indian IP addresses but does not require the operator to delete player data. Your documents remain on their servers under whatever security they maintain. This is why the post-KYC steps described above, particularly the biometric lock and credit monitoring, matter regardless of how trustworthy the casino appeared when you submitted.

 

Relevant news