How to Report AePS Biometric Fraud in India: Step-by-Step Guide

1. What Is AePS Biometric Fraud?

AePS (Aadhaar Enabled Payment System) is managed by the National Payments Corporation of India (NPCI). It enables cash withdrawals from micro-ATMs and Business Correspondents (BCs) simply by entering an Aadhaar number and scanning a fingerprint.

How the Fraud Works:

• Fingerprint Harvesting: Scammers obtain your Aadhaar number and fingerprint impressions. These are frequently leaked from government land registration portals, online property deeds, or local registry databases where physical copies of deeds are uploaded.
• Silicone Cloning: The fraudsters use high-resolution printers and liquid silicone to create a physical replica of your fingerprint.
• Unauthorized Withdrawal: They take this silicone mold to a local micro-ATM or Business Correspondent outlet. By entering your Aadhaar number and pressing the silicone mold onto the biometric scanner, they successfully bypass authentication and withdraw money directly from your linked bank account. No card is swiped, and no SMS OTP is generated.

2. Immediate Action Checklist (Within 24 Hours)

If you receive debit alerts for transactions you did not authorize, execute these steps immediately:

Step 1: Lock Your Aadhaar Biometrics

This blocks all fingerprint verification requests nationwide.

• Visit the official myAadhaar portal (myaadhaar.uidai.gov.in) or open the mAadhaar app.
• Log in using your Aadhaar number and OTP.
• Select the Lock/Unlock Biometrics option and enable the lock.
• *Note: Once locked, you cannot withdraw money using AePS or verify fingerprint biometrics until you temporarily unlock it via the portal.*

Step 2: Notify Your Bank to Disable AePS

• Call your bank's official customer care helpline or visit your nearest branch.
• Submit a written request to disable the AePS facility on your savings bank account entirely.

Step 3: Call the Cyber Crime Helpline

• Dial the national helpline 1930 immediately. Give details of the fraud transactions (date, time, UTR/Transaction ID, bank name, amount).
• Fast reporting increases the chances that the police can freeze the stolen money in the recipient's bank account.

3. Step-by-Step Reporting & Refund Process

To claim a refund under Indian banking regulations, follow this structured process:

Step 1: File an Online Cyber Complaint

• Register a detailed cybercrime complaint on the official portal cybercrime.gov.in.
• Write down the 15-digit Acknowledgement Number generated by the portal. Download the PDF copy of the complaint.

Step 2: Submit a Written Dispute to Your Bank (Within 3 Days)

Under the Reserve Bank of India (RBI) Master Circular on Customer Liability (dated July 6, 2017):

• If you report the unauthorized transaction to your bank within 3 working days, your liability is zero, and the bank is legally mandated to credit the disputed amount back to your account within 10 working days.
• Go to your bank branch and submit:

1. A formal Written Transaction Dispute Letter stating that the withdrawal was an unauthorized AePS biometric transaction.

2. A copy of the Cyber Crime Complaint Acknowledgement.

3. A copy of your bank statement highlighting the fraudulent debits.

• Request a Complaint Reference Number: Do not leave the branch without obtaining an official stamped receipt or grievance ticket number.

Step 3: Escalate to the RBI Integrated Ombudsman

If the bank rejects your dispute, fails to resolve the issue, or does not credit the funds within 30 days:

• Visit the official RBI Complaint Management System (CMS) portal at cms.rbi.org.in.
• File an online complaint against your bank.
• Attach your initial transaction dispute letter, the bank's stamped acknowledgment, and the cyber crime report. The RBI Ombudsman will review the case under the Customer Liability guidelines.

4. Required Evidence Checklist

When filing your disputes, keep the following documents ready:

5. Common Mistakes to Avoid

• Delaying the Bank Report: If you report the fraud *after* 3 days, your liability increases. If you delay past 7 working days, the refund eligibility depends entirely on your bank's discretionary board policies. Report within 72 hours.
• Believing That Aadhaar Sharing Is Dangerous: Simply sharing your 12-digit Aadhaar number does not allow withdrawals. The fraud only happens if they clone your biometric fingerprint. Lock your biometrics to remain 100% safe.
• Paying Recovery Agents: No legitimate police or bank official will charge money to recover your funds. Block any callers asking for payment or OTPs to "clear" your biometric dispute.

Official Sources

• Reserve Bank of India (RBI) Customer Liability Circular: rbi.org.in
• UIDAI MyAadhaar Portal: myaadhaar.uidai.gov.in
• National Cyber Crime Reporting Portal: cybercrime.gov.in
• RBI Complaint Management System: cms.rbi.org.in