New Delhi: Sharing documents such as PAN cards, Aadhaar cards and bank statements over WhatsApp has become common for services including bank loans, credit cards, rental agreements, hotel check-ins and other verification processes. Agents and dealers often ask customers to send documents through messaging apps for convenience. However, sending sensitive identity and financial documents to a personal number without verification can expose individuals to identity theft, financial fraud and unauthorised data use.
A document sent as a PDF, photograph or other file through WhatsApp may not remain limited to the recipient’s chat. The recipient can download and store it on a phone, laptop or computer. The file could also be copied to private cloud storage, email accounts or backup systems. Once shared, the sender may have very little control over how many copies are created, where they are stored or who eventually gets access to them.
Even when the recipient is genuine and has no immediate intention of committing fraud, the risk does not disappear. A phone or computer could later be compromised, a cloud account could be hacked, or the document could be forwarded to another person. Information contained in PAN cards, Aadhaar cards and bank statements can potentially be misused for identity verification, financial transactions or other fraudulent activities.
The risk becomes greater when an agent asks customers to send documents to a personal WhatsApp number instead of using the company’s official system. Banks and financial institutions work with large networks of Direct Selling Agents (DSAs) for loans and credit cards. If documents are collected through private devices, sensitive customer information may move outside the organisation’s controlled security environment. Multiple copies may also be created and stored across different devices.
Renowned cybercrime expert and former IPS officer Prof. Triveni Singh said people should not share identity documents with private numbers merely for convenience. According to him, misuse of digital identity documents can allow criminals to exploit personal information for further fraud or identity theft. He advised people to verify both the identity of the person requesting the documents and the organisation they claim to represent before sharing any sensitive information.
The safer option is to ask the bank, financial institution, hotel or service provider for an official document-upload link or secure digital portal. Where available, users should prefer DigiLocker or authorised digital identity verification systems. Such platforms provide a more controlled process for sharing and verifying documents and can reduce unnecessary circulation of copies.
If sending a document through WhatsApp is unavoidable, users should first verify that the recipient is genuinely associated with the concerned organisation. It is also advisable to add a clear purpose-based watermark to the document, such as “For XYZ Loan Verification Only.” This can help establish the intended purpose of the document and discourage its use for unrelated activities.
Sensitive PDF files can also be protected with a password where technically feasible. The password should not be sent in the same WhatsApp message as the document. Instead, it can be communicated through a separate and trusted channel. Users should also avoid sending additional copies of PAN cards, Aadhaar cards or bank statements to multiple people unless there is a genuine requirement.
The Digital Personal Data Protection framework also places emphasis on responsible handling and protection of personal data for specified purposes. This makes it important for organisations to provide secure digital channels for collecting customer documents rather than relying excessively on personal messaging accounts.
Experts say PAN cards, Aadhaar cards and bank statements should not be treated as ordinary paperwork. They contain sensitive information connected to a person’s identity and finances. Before sending any document through WhatsApp, users should ask three basic questions: Who is requesting it, why is it required, and is there an official and safer way to submit it?
A few minutes of verification can prevent sensitive personal information from spreading across unknown devices and potentially becoming a tool for financial fraud or identity theft.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
