How Does Aadhaar (Aadhar) Authentication Work? OTP, Fingerprint, Iris, Face and Offline e-KYC Explained

What are the ways to authenticate with Aadhaar?

Authentication means an agency checks something you give (an OTP, a fingerprint, your eye, your face or your details) against your Aadhaar record. UIDAI lists five ways. From age 5, your Aadhaar holds a photo, all 10 fingerprints and both irises; children under 5 give only a photo. Scroll sideways on a phone.

Children under 5 have no fingerprints or iris on record. Their fingerprints and iris are added at the mandatory update at age 5–7.

Your authentication failed: which kind?

Pick what happened to see the most likely fix.

What should you do when your fingerprint fails?

The usual advice: retry, try other fingers, and clean the finger and the scanner. If that doesn't work, UIDAI says agencies must offer another way, such as OTP, iris or face. If it keeps failing, update your biometrics.

• Elderly people and manual workers often face repeated failures, as reported for ration, MGNREGA and pensions. See Aadhaar help for elderly and disabled people.
• Children: the mandatory updates at 5–7 and 15–17 are free. A biometric update for ages 7–15 is free until 30 Sep 2027. Other biometric updates cost ₹125.
• Full guide by place (bank, ration, LPG, EPFO): Fingerprint not matching. The update visit itself: Photo & biometric update.

How does face authentication work, and why does it fail?

Face authentication is a one-to-one match of your live face with the photo stored in your Aadhaar, using the Face RD app. The new Aadhaar App uses it when you register and when you update your mobile number. Reports say new EPFO UANs (since 1 Aug 2025) are allotted or activated only through UMANG with face authentication. News reports say UIDAI launched a Face Authentication SDK in September 2026 so banks can build face checks into their own apps.

• Use good light. The Aadhaar App asks for good light for its face check.
• Old photo? Users report face matches failing for people enrolled as children. A biometric update (₹125) records a new photo.
• Error codes: users report Face RD errors 9609 and 9724. We don't know their official meaning, so we don't explain them here.
• No smartphone? In our experience people do the EPFO face check on someone else's smartphone, such as a family member's.
• Still failing? Ask the agency for OTP or fingerprint instead. For a mobile update, an Aadhaar centre can do it.

More about the app: the new Aadhaar App.

What should you check when OTP authentication fails?

The OTP is a 6-digit code sent by SMS to the mobile registered with your Aadhaar. It is valid only for a short time. Without that SIM, OTP authentication can't work.

• Don't keep pressing "send OTP". UIDAI blocks OTP generation for 30 minutes after too many requests.
• Not sure which number is linked? At our counter we use Verify Email/Mobile Number on myAadhaar / uidai.gov.in: enter the Aadhaar number and the mobile number to check.
• Lost the number? Update it at an Aadhaar centre for ₹75. In our experience any centre can do it the same day with no document, and OTPs start arriving on the new number within 1–2 days. See Update mobile number.
• SMS never arrives although the number is right? UIDAI says to contact your mobile operator.
• A family member's number (for example a father's or son's) can be linked; in our experience this works without problems. OTPs then go to that phone.

How do you check your authentication history?

Your authentication history lists the times your Aadhaar was used to authenticate. UIDAI shows the last 6 months, with up to 50 records per view. Each record shows:

• the type of authentication (OTP, fingerprint, iris, face or demographic);
• the date and time;
• the agency that asked for it (the AUA, such as a bank);
• the transaction ID, the response code and any error.

The authentication history is one of the features UIDAI lists for the new Aadhaar App. UIDAI also says each authentication sends an email notice. Such a notice can only reach you if an email address is linked to your Aadhaar, so check the history in the app as well.

1. Open the Aadhaar App

   Use UIDAI's new Aadhaar App (Android 9+ or iOS 16+). Registering needs your Aadhaar number, an OTP, a face check (in good light) and a 6-digit PIN.

2. Read each record

   Look at the type, time and agency. A fingerprint check at a bank you never visited is a warning sign.

   You'll know it worked when you see a list of your recent authentications with their dates and agencies.

3. Act on anything strange

   Lock your biometrics, share only masked copies, and read Aadhaar fraud and scams. If money was taken, report it on 1930 or cybercrime.gov.in as fast as you can.

We don't give menu names for the history screen, because UIDAI's app menus change. If you can't find it, call 1947.

What is the difference between authentication, e-KYC, offline e-KYC and the QR code?

These words get mixed up. The key point: online authentication needs your OTP, biometrics or details at that moment, while offline e-KYC and the secure QR are signed data you share, which can be checked without them.

• Get the offline e-KYC file only from UIDAI's own page, and share it only with someone you trust.
• Businesses that verify customers can register as an offline verification entity (OVSE) and use the app instead of keeping photocopies.
• How to check a QR, XML file or e-Aadhaar PDF: Verify an Aadhaar.

Can you use a VID instead of your Aadhaar number?

Yes. A Virtual ID (VID) is a 16-digit number linked to your Aadhaar. You can give it instead of your 12-digit number. UIDAI says:

• only you can generate it, and it is free; you need your registered mobile;
• only one VID is valid at a time; a new one cancels the old one at once, and you can make a new one after at least one day;
• it has no expiry;
• agencies must not store your VID, and your consent is needed for VID authentication;
• you can download e-Aadhaar with it, and you need your latest VID to unlock a locked Aadhaar number.

What do the biometric lock and the Aadhaar (UID) lock block?

There are two different locks. Most people need only the first one.

• A biometric lock is the safer everyday choice. It stops fingerprint misuse such as AePS fraud, and OTP keeps working.
• Before a fingerprint check at a bank, ration shop or gas agency, unlock your biometrics. Lock them again afterwards. Users report banks refusing KYC while biometrics are locked.
• UID lock facts (UIDAI): a VID is a must before locking; the lock has no expiry; there is no single-use unlock, so it stays unlocked until you lock again; it is free; you need your registered mobile.
• Biometric SMS commands don't work while your Aadhaar number (UID) is locked.

Example numbers above: Aadhaar ending 1987, OTP 012345. Two family members on one mobile whose Aadhaar numbers end in the same 4 digits? Use the last 8 digits of Aadhaar in SMS 2. For VIDs ending in the same 6 digits, use the last 10 digits of the VID. These longer forms go only in SMS 2, never in GETOTP. All 1947 SMS formats: SMS command generator (1947).

How does AePS fraud happen, and how do you stop it?

AePS lets people withdraw cash at a micro-ATM with their Aadhaar number and fingerprint. Fraudsters misuse this. As reported by Gujarat's cyber-crime police:

• they take the Aadhaar number from photocopies;
• they lift the fingerprint from property documents or make a silicone clone;
• they withdraw cash at a micro-ATM. No OTP is involved, so you get no warning code.

Protect yourself: lock your biometrics, share only masked copies of Aadhaar (last 4 digits), and check your authentication history. If money is taken, call 1930 or report on cybercrime.gov.in within the "golden hour", as fast as you can.

More scam types and what to do: Aadhaar fraud and scams.

Who may ask you to authenticate with Aadhaar?

• Government benefits and subsidies: as reported, the Supreme Court's 2018 judgment (Puttaswamy) allows Aadhaar to be required for subsidies and benefits under section 7 of the Aadhaar Act. For example, biometric Aadhaar authentication is needed to book subsidised LPG from 1 Oct 2026. In our experience gas agencies ask all customers.
• Private companies: under the Good Governance Amendment Rules of 31 Jan 2025, a private entity may use Aadhaar authentication only with approval from MeitY (the IT ministry).
• PAN and income-tax returns: as reported, the same judgment upheld the Aadhaar requirement for PAN (section 139AA of the Income-tax Act). Linking is done with an OTP on your Aadhaar mobile; a PAN that must be linked but isn't becomes inoperative.
• Not mandatory for opening a bank account, getting a SIM card or school admission, according to reports of the same judgment.

The full legal position: Is Aadhaar mandatory?

What goes wrong with Aadhaar authentication, and how do you fix it?

For a biometric update, go to an authorised Aadhaar centre. Aadhaar Seva Kendras usually open on Sundays too; most work 9:30 am to 5:30 pm; the centre we visited closes for lunch from 1 to 2 pm. Check your centre before you go.

Bottom line

If one way to authenticate fails, ask for another: OTP, iris or face. Error 330 means your biometrics are locked, not that your finger is bad. Lock your biometrics when you don't need them, and check your authentication history now and then. For help, UIDAI's free helpline is 1947.