Somewhere between filling out forms all day, most of us stop noticing what we hand over. A school admission form, a job application, a loan enquiry, each one asks for a little more: your Aadhaar, your PAN, your bank account. After a while it feels routine.
Here is the short version. Most of these are fine to share when the request is genuine, your Aadhaar for a bank's KYC, or your account number and IFSC code so someone can pay you. What actually puts you at risk is a shorter list: your Aadhaar OTP, card PIN, CVV, or UPI PIN, nobody genuine ever needs those. Know that one line, and you can share everything else with confidence.
What is fine to share, and what to keep locked away
Three kinds of details come up again and again: your Aadhaar, your PAN, and your bank details.
Your Aadhaar
Aadhaar is meant to be used, like your PAN or bank account number, for KYC or proving who you are. The real caution is not to broadcast it: never post it on social media, and never hand it to someone you cannot verify.
- If only your identity needs checking, share a masked Aadhaar, showing only the last 4 digits, free from myaadhaar.uidai.gov.in.
- For extra safety, generate a Virtual ID (VID), a temporary 16-digit number in place of your Aadhaar, on the UIDAI portal or by SMS "GVID" plus your last 4 digits to 1947.
- Lock your biometrics when not in use, free on the UIDAI Aadhaar app, and unlock only for the minute you need it.
- Never share your Aadhaar OTP, even with someone claiming to call from UIDAI or your bank. They never ask for it.
Your PAN
Your PAN only needs to be quoted for specific transactions: opening a bank account, a credit or debit card, or a demat account, buying a car, large cash payments at a hotel or on travel, and filing your tax return. Outside these, there is rarely a reason to hand it over. Misused with a few other details, it can help open a fake account or a loan in your name, which can even hit your credit score later.
Your bank and card details
Your account number, IFSC code, and UPI ID are safe to give out so someone can pay you. These are printed on every cheque leaf, and nobody can pull money out with just these.
- Never share: your OTP, card PIN, CVV, UPI PIN, or net banking password, with anyone, for any reason.
- Never share your full card number with its expiry and CVV together, that combination alone is enough to misuse a card online.
- Remember the rule: a real bank never asks for your OTP, PIN, or CVV. If someone asks, that request is the scam.
Why a small slip can cost you real money and time
Losing money to a scam is bad enough. What follows is often worse: hours with your bank, a police complaint, and weeks cleaning up a credit report or a fake account in your name. India's DPDP Act gives you the right to know, correct, and erase your data, though the rules are still rolling out. Being careful with your own details is still the first line of defence.
A few habits that keep you safe
- Look for https and the lock icon before entering any detail on a website.
- Know who is asking, and why. A school form asking for your Aadhaar makes sense, a random WhatsApp link asking the same does not.
- Upload ID or financial documents only on official portals, such as uidai.gov.in, incometax.gov.in, or your bank's own app, never a link sent by SMS or WhatsApp.
- Share only what the purpose needs. A gym form does not need your PAN, a loan form does not need your UPI PIN.
- Never say your OTP, PIN, or CVV out loud, or type them anywhere except your own banking app when you are paying.
- Check your bank statement and credit report every few months, and verify anything unusual directly with the bank's official number, not the one in the message.
Three things people get wrong about sharing these details
"Never share your Aadhaar with anyone." Not quite right. Everyday use, like KYC at a bank, is exactly what Aadhaar is for. The rule is not to post it publicly or hand it to someone you cannot verify.
"If someone has my account number, they can empty my account." They cannot. Account number and IFSC alone cannot move money out, that needs your OTP, PIN, or CVV.
"A message asking me to scan a QR code for a refund is genuine, it knows my order details." A PIN or QR scan pays money out, it never receives money, so this is always a scam.
A refund that took money instead of giving it
Meena returned a dress she had ordered online, expecting a refund. A message arrived: "Your refund of Rs 1,200 is ready, tap to accept." She tapped, and her UPI app asked for her PIN to "receive" the money.
She entered it, and Rs 1,200 left her account instead of arriving. A real refund never needs a PIN, it simply lands in the account. Report anything like this fast: call 1930, the cybercrime helpline, or file at cybercrime.gov.in. Reporting within 3 working days also protects you under RBI's zero liability rule.
If you collect documents from people
All of this cuts both ways. If you collect Aadhaar, PAN, or ID copies, hiring for a small business, running a school's admissions, or screening candidates, ask only for what the role genuinely needs, and collect it in one clean, organised way instead of scattered emails and WhatsApp forwards.
SurveyHeart's Job Application Form sets up fields for name, contact, education, experience, and a resume upload, so every applicant's details land in one place instead of your inbox. It is free, and the person filling it does not need to log in. Use the Job Application Form.
Share what is needed, keep the rest close
Almost everything you are asked for, your Aadhaar, your PAN, your account number, is fine to share with someone genuine. It comes down to a short list that should never leave your hands: your OTP, your PIN, your CVV, and your net banking password. Guard those four, use a masked Aadhaar or Virtual ID when you can, and check who is asking before you type anything in.
This explains the idea simply and is not official advice. For your own situation, check the UIDAI, Income Tax, or your bank's own website.
Copy Link
