Is It Safe to Send Your Aadhaar Card to an Offshore Gambling Site?

Somewhere in the middle of signing up for an online casino, you hit a screen that asks for your Aadhaar card front and back plus a selfie holding it. Your withdrawal is locked until you comply. The casino looks legitimate enough. The bonus was good. Now you are staring at a form asking for India’s most sensitive identity document and wondering whether this is normal, whether it is safe, and what exactly happens to that photo once you send it.

These are the right questions to be asking. Most players either send the documents without thinking or abandon the withdrawal entirely out of fear. Both extremes are avoidable. What you actually need is a clear understanding of why this is being asked, what the risks genuinely are, and how to protect yourself whether you decide to comply or not.

Why Do Offshore Casinos Ask for Your Aadhaar at All?

Before anything else, it is worth understanding that KYC verification is not unique to shady operators. It is an industry-wide standard that every licensed gambling platform in the world follows, required by their licensing authorities as part of Anti-Money Laundering and Know Your Customer regulations.

The process exists for three main reasons. First, casinos need to confirm you are who you say you are and that you are of legal age. Second, they need to comply with AML rules that require them to verify the source of funds for large transactions. Third, they need to prevent one player from running multiple accounts to abuse bonuses or manipulate games.

For Indian players, Aadhaar has become the de facto identity document because it is universally held, government-issued, and links to your biometrics, address, and financial identity simultaneously. An international passport works too, as does a PAN card for tax-linked verification. The fact that a casino asks for Aadhaar does not by itself make it suspicious. What matters is how they ask, what they plan to do with it, and whether they have a track record of handling it responsibly.

What Are the Real Risks of Sending Aadhaar to an Offshore Site?

This is where the honest answer gets complicated, because there is a significant difference between the theoretical risk and the practical risk depending on which site you are dealing with.

India’s Aadhaar data breach history is not reassuring

The scale of documented Aadhaar data exposure in India is genuinely alarming. In 2023, a cybersecurity firm discovered that the personally identifiable information of approximately 815 million Indian citizens including Aadhaar and passport details was being sold on dark web forums, with the entire dataset offered for $80,000.

This was not an isolated incident. There were significant Aadhaar-linked data exposures in 2018, 2019, 2022, and 2023, making India one of the countries with the highest volume of breached identity records globally. The WEF’s Global Risk Report identified India’s Aadhaar system as the site of the world’s largest data breach in 2018, with records potentially affecting over one billion citizens.

In April 2025, authorities uncovered a fraud ring that had compromised the Aadhaar system itself, illegally updating biometric data for over 1,500 individuals by using cloned credentials and silicone fingerprints. That same year, a Bengaluru engineer demonstrated that AI tools could generate near-indistinguishable fake Aadhaar cards using just a name and a photo, raising the stakes for anyone whose face, name and Aadhaar number appear together in a database.

None of this means your data is definitely unsafe with a specific casino. It does mean that Aadhaar data, once held by an insecure third party, has real-world criminal demand and a documented track record of exploitation.

What can a fraudster actually do with your Aadhaar?

This is the question most players want a direct answer to. Here is what Indian fraud records show is actually done with stolen Aadhaar data.

The risk that concerns cybersecurity professionals most is not the Aadhaar number alone. It is the combination of your Aadhaar number, your face photograph and your address, all three of which a casino KYC submission typically provides together. That combination is sufficient for someone to attempt a biometric eKYC-based loan application at digital NBFCs that still rely on image verification rather than live biometrics.

What happens to your documents when a casino site gets blocked?

This question does not get asked often enough. When the Indian government blocks an offshore casino under the Online Gaming Act 2025, it cuts off access from Indian IP addresses. It does not seize the casino’s servers. It does not force them to delete player data. It does not trigger any regulatory audit of their data storage practices.

The blocked site’s database, which contains your Aadhaar scan, selfie, address and phone number, remains wherever it was stored on servers in Curaçao, Cyprus, Malta, or wherever the operator is registered. Those servers are now subject to zero Indian regulatory oversight. If the operator was careless about data security before the block, they are equally careless after it, with no one checking.

This is why the blocked-site scenario deserves its own section in this guide. Sending Aadhaar to a casino that subsequently gets shut down is not just a theoretical concern. Over 8,000 Indian-facing gambling sites were blocked in early 2026. Every one of those sites had players who submitted KYC documents.

How to Assess Whether a Casino Is Safe Enough for KYC?

Not all offshore casinos handle data the same way. The question is not simply whether to comply with KYC for large withdrawals at established platforms it may well be worth it. The question is how to evaluate the specific site in front of you before you hand over your most sensitive document.

Here are the checks that experienced players run before submitting anything.

• Check the casino’s complaint history- AskGamblers and Casino Guru both publish player complaint records. Look for patterns of unresolved complaints, data concerns, or non-payment after KYC submission. A single complaint can be a one-off; five complaints about the same issue are a pattern.
• Verify the licence and jurisdiction- A Malta Gaming Authority (MGA) licence or UK Gambling Commission licence means the operator is held to stringent data protection standards. A Curaçao e-Gaming licence, while common, is the lowest regulatory tier and has minimal data security requirements. This does not automatically make a Curaçao-licensed casino unsafe, but it means their data practices are self-regulated.
• Check how long the site has been operating- A casino that has been paying out Indian players for three or more years without complaint has at minimum a track record. A site that launched six months ago and is aggressively targeting Indian players with high bonuses carries more uncertainty.
• Look for a privacy policy that mentions GDPR or the DPDPA- Any serious operator serving European players will have GDPR obligations, which include data encryption requirements and right-to-deletion clauses. This does not guarantee perfect practice but indicates some baseline accountability.
• Test with a passport first- If the casino accepts your passport or driving licence for initial KYC, use that instead of Aadhaar. Your passport does not link to your biometrics, bank accounts and telecom identity the way Aadhaar does. It is a lower-risk document for offshore verification purposes.

What to Send Instead of a Full Aadhaar Scan?

This is the most practical piece of this entire guide. There is a legal, UIDAI-recognised alternative to submitting your full Aadhaar card that most players do not know about. It is called Masked Aadhaar, and it changes the risk calculation of casino KYC significantly.

Masked Aadhaar: what it is and how to get it

Masked Aadhaar is an official variant of your Aadhaar card issued by UIDAI, the body that manages the Aadhaar system. It shows only the last four digits of your 12-digit Aadhaar number, with the first eight digits replaced by Xs. Everything else, your name, date of birth, address and photograph, remains visible and legally valid for identity verification purposes.

The document is recognised as a valid ID for KYC across India and is accepted by most legitimate international casino platforms. Using it means that even if a casino’s database is breached or their servers are later compromised, a fraudster who finds your document has only a partial Aadhaar number, not the full 12-digit identifier needed to make authentication attempts.

How to download your Masked Aadhaar?

• Step 1: Go to myaadhaar.uidai.gov.in
• Step 2: Log in with your registered mobile number (OTP verification).
• Step 3: Select ‘Download Aadhaar’ and choose the ‘Masked Aadhaar’ option.
• Step 4: Download the PDF. This is your official UIDAI-issued document.

It is free, takes under five minutes, and the document is identical in appearance to your regular Aadhaar with only the first eight digits obscured.

Other alternatives worth knowing about

• Passport- An international passport works for offshore casino KYC at virtually all legitimate platforms. It does not link to your biometrics, bank accounts, or telecom identity, making it a lower-risk document for offshore submission. The downside is that not everyone has one.
• Driving licence- Many casinos accept a driving licence as identity verification. Like a passport, it does not carry the same ecosystem-wide exposure that Aadhaar does.
• PAN car- A PAN card verifies your tax identity but does not include biometric data or your address. It is a lower-risk submission than Aadhaar if the casino is collecting it purely for AML purposes.
• DigiLocker documents- Some casino platforms now accept DigiLocker-verified documents, which allow the casino to verify your identity through an official government portal without you sending any physical scan at all. This is the safest option where available.

One more practical note: if a casino refuses to accept Masked Aadhaar and insists specifically on a full scan of your physical Aadhaar card, that inflexibility is itself a yellow flag. Legitimate operators understand and accept the masked version. Platforms that insist on the full number are either unaware of UIDAI’s official guidance or have reasons for wanting the complete identifier.

What to Do If You Already Sent Your Full Aadhaar?

If you submitted your full Aadhaar scan to an offshore casino, the most useful thing to do is stop worrying about what you cannot change and take the protective steps that are within your control. Here is exactly what those steps are.

Step 1: Lock your Aadhaar biometrics right now

This is the single most important thing you can do and the one most people have never heard of. UIDAI allows you to lock your biometric data, which means no one can use your fingerprints or iris scan for Aadhaar authentication while the lock is active. This blocks the most dangerous form of misuse: biometric eKYC-based loan fraud.

To lock your Aadhaar biometrics-

Visit myaadhaar.uidai.gov.in → Log in → Select ‘Biometric Settings’ → Enable the biometric lock.

Alternatively, use the mAadhaar app. Takes under two minutes. You can temporarily unlock it when you need biometric authentication and re-lock immediately afterwards.

Step 2: Check your credit reports immediately

Pull your credit report from CIBIL, Experian, CRIF, or Equifax. All four are free for an annual report and some offer free checks through third-party apps. Look for any loan accounts, credit cards, or hard inquiry records you do not recognise. A hard inquiry you did not authorise means someone ran a credit check in your name, which is the precursor to taking a loan.

If you find anything unfamiliar, do not assume it is a system error. Raise a dispute with the credit bureau and file a complaint with the RBI ombudsman. The resolution process takes time, but starting it immediately is important, the longer fraudulent accounts sit on your credit file, the more damage accumulates.

Step 3: Check SIM cards registered under your Aadhaar

Visit sancharsaathi.gov.in, the government’s official portal for managing telecom connections. Log in and check how many mobile numbers are registered under your identity. Any number you did not personally activate should be reported and deactivated immediately.

This step surprises many people. As Deepa’s scenario showed, SIM cards linked to stolen Aadhaar details can exist without the victim’s knowledge for months. Criminals use these SIMs to intercept OTPs, run scams and create mule bank accounts. An unauthorised SIM in your name is not just someone else’s problem, it can implicate you in fraud investigations.

Step 4: Enable authentication alerts

The mAadhaar app allows you to set up notifications for every time your Aadhaar number is used for authentication. This means if someone attempts to verify your identity using your Aadhaar anywhere, you receive an alert. It does not prevent the authentication in itself that is what the biometric lock does but it gives you real-time visibility into how your identity is being used.

Step 5: Send a data deletion request to the casino

Under India’s Digital Personal Data Protection Act 2023 and, where applicable, GDPR (for EU-registered operators), you have a legal right to request deletion of your personal data. Send a formal written email to the casino’s data protection or support contact stating that you are requesting deletion of all personal data including identity documents, under the applicable data protection regulations.

Whether they comply is uncertain, especially for blocked sites. However, the timestamped request matters if fraud occurs later. It establishes that you took active steps to protect your data, which is relevant in any police complaint or credit dispute resolution.

FAQs

1. Is it ever actually safe to send Aadhaar to an offshore casino?

Yes, with conditions. Sending Masked Aadhaar not a full scan to a well-established casino with a documented track record of responsible KYC handling and a meaningful gambling licence is a significantly different risk calculation than sending a full scan to a site you found through an affiliate link three days ago. Reputation, licence quality and the version of the document you submit are the three variables that matter most.

2. What is the actual difference between Masked Aadhaar and a regular Aadhaar scan?

Masked Aadhaar shows only the last four digits of your Aadhaar number. The full scan shows all twelve. If a database containing your masked Aadhaar is later breached, a fraudster has your name, address and photo but only a partial Aadhaar number, not enough to complete most authentication processes. The full scan gives them everything needed for eKYC loan attempts, SIM activation and bank account opening.

3. My casino only accepts a full Aadhaar scan and refuses the masked version. What should I do?

A casino that specifically insists on a full Aadhaar number when a legally recognised masked version is available is worth treating with considerable caution. You can try submitting your passport or driving licence instead. If the casino insists on only a full Aadhaar scan and no alternative, that is a reason to reconsider whether you want to complete KYC with them at all.

4. I sent my Aadhaar to a site that has since been blocked. What are the chances my data has been misused?

There is no way to calculate this precisely. Most players who submitted KYC to later-blocked sites will not experience fraud; the majority of offshore casino operators are not data criminals even when they are running businesses that are now illegal under Indian law. However, that probability does not eliminate the risk and the protective steps described above, particularly the biometric lock and credit check, cost you nothing and provide real protection regardless of what the actual probability is.

5. Can I sue or file a legal complaint if my Aadhaar is misused after casino KYC?

If your Aadhaar is misused for fraud that you can trace to a specific data leak, you can file an FIR with the cybercrime cell and a complaint with UIDAI’s official grievance portal. Proving the chain of causation to a specific casino is difficult in practice, but documenting everything including your deletion request, your CIBIL checks and any authentication alerts creates the evidentiary base needed for a complaint.

6. Does locking my Aadhaar biometrics affect anything else in my life?

While the biometric lock is active, you cannot use your fingerprints or iris scan for Aadhaar-based authentication anywhere. This means biometric attendance at your workplace, biometric KYC at a bank branch and similar processes will not work until you temporarily unlock it. Unlocking takes about two minutes and you can re-lock immediately afterwards. For most people this is a minor inconvenience and a worthwhile trade-off.

7. What is the Sanchar Saathi portal and how does it help?

Sanchar Saathi at sancharsaathi.gov.in is a government portal that shows all mobile numbers currently registered under your identity documents. You can check how many SIM cards are linked to your Aadhaar, identify any you did not activate, and request their deactivation directly through the portal. It takes under five minutes and has been instrumental in uncovering fraud for thousands of Indians who had no idea SIM cards existed in their names.

Relevant news