Discussion on Aadhaar Based Bank Frauds!

[TEUser2K1]

People lose money after conmen steal Aadhaar biometric data in Mangaluru

Lokesh and his wife from Shaktinagar in the city, who lost Rs 10,000 each, filed a complaint that money was siphoned off their Aadhaar-linked bank accounts.

www.newindianexpress.com

Days after a couple applied to register their new property, they lost Rs 10,000 each from their Aadhaar-linked bank accounts. Many others have lost money after their biometrics and Aadhaar Enabled Payment System (AePS) details were taken for property registration at the sub-registrar office here.

 

[BullettuPaandi]

Indian state government fixes website bug that revealed Aadhaar numbers and fingerprints [LINK]​

A security researcher says a bug on an Indian state government website inadvertently revealed documents containing residents’ Aadhaar numbers, identity cards and copies of their fingerprints.

it was possible to obtain land deeds, which contain records about the owners of a piece of land, from the e-District website by guessing sequential deed application numbers.

Using publicly available tools like Burp Suite

Probably one of the oldest bugs in the book, a basic pen-testing would've immediately revealed, which essentially is what the security researcher did. In fact, these are the kind of bugs you wouldn't expect to even reach the testing stage. Only way this hasn't gotten exploited is if malicious actors outsmarted themselves and they're also going "No way!" as they read this with the rest of us.

 

[TEUser2K1]

Rise in Aadhaar biometric fraud keeps cops on their toes

Rise in Aadhaar biometric fraud keeps cops on their toes

www.deccanherald.com

 

[tearphones]

Rise in Aadhaar biometric fraud keeps cops on their toes

Rise in Aadhaar biometric fraud keeps cops on their toes

www.deccanherald.com

I am glad that at least we're getting some more details about the actual operations:

“They place the thumb impression on the registration sheets on the butter paper, place a silicone sheet on it and heat it for around five minutes using ultraviolet lamps,” the officer said. “This transfers the biometric to the silicone sheets.”
Another officer said that the thumb impressions would be transferred to photopolymer sheets through thermal print. “They also use scanners with high-resolution and then take a printout on photographic films. When they try 100 such scans and prints around 10 work.”
The scamsters then use apps like Spice Money, Ezeepay and others, which provide Aadhaar Enabled Payment System (AEPS) services and also withdraw money through micro ATMs.

 

[LinkdJay]

Fellas, just had somebody try to authenticate my aadhaar using fingerprint 4 times today.
Good thing I blocked my biometric.

Whatever the govt. is doing/did, its not working very well.

 

[iosoft]

Fellas, just had somebody try to authenticate my aadhaar using fingerprint 4 times today.
Good thing I blocked my biometric.

View attachment 183720

Whatever the govt. is doing/did, its not working very well.

Did you recently buy any property or Govt. Registration etc. where your fingerprint was taken?

 

[LinkdJay]

Did you recently buy any property or Govt. Registration etc. where your fingerprint was taken?

Nothing recent. But beginning of this year and last year. Gave finger print for property registration.

 

[ibose]

Fellas, just had somebody try to authenticate my aadhaar using fingerprint 4 times today.
Good thing I blocked my biometric.

View attachment 183720

Whatever the govt. is doing/did, its not working very well.

Well, at least that proves that locking the biometric works.

 

[iosoft]

Nothing recent. But beginning of this year and last year. Gave finger print for property registration.

hmmmmm.....

 

[khalil]

The cybercrime wing of the Hyderabad police on Wednesday arrested six persons for allegedly cloning fingerprints of bank account holders and using them to carry out unauthorised transactions. They were members of a gang of eight, which cheated several account holders of ₹10 lakh, the police said.

According to the police, the gang members used Aadhaar-enabled payment system to carry out about 2, 500 transactions.

A investigation was launched after an official of Mumbai-based Fino Payment Bank Limited (FPBL) approached the police and reported that the National Payment Corporation of India in September flagged suspicious transactions linked to one of its merchant terminal ID.

The said terminal was identified as allotted to one K. Srinu, a business correspondent in Hyderabad. The police investigation showed that the accused conspired to make easy money through Aadhaar-enabled payment system.

The gang cloned about 1,000 fingerprints from the soft copies of about 2,500 land registration documents supplied by accused Ch. Narendra. The other arrested are N. Asadharan alias Rupesh, S. Uday Kiran, Md. Iyaz, R. Shiva Krishna and K. Srinu.

Fingerprint cloning racket busted in Hyderabad

Six persons arrested in Hyderabad for cloning fingerprints of bank account holders and using them to carry out unauthorised transactions. Gang cheated several account holders of ₹10 lakh. Used Aadhaar-enabled payment system for 2,500 transactions.

www.thehindu.com

 

[sanketagrawal]

I just went over this thread and realised how vulnerable an unlocked Aadhar is. Btw, have you tried masked aadhar? Govt. was promoting it but I don't think they are accepting it anywhere ( Airports, trains, Airtel /Jio) . I think masked aadhar should become a norm and aadhar biometrics should be locked by default.

 

[TEUser2K1]

@ibose

> Well, at least that proves that locking the biometric works.

Problem is that you have to start unlocking it days ahead, in case you need any work done when required.
Lot of complaints about unlocking.

 

[iosoft]

@ibose

> Well, at least that proves that locking the biometric works.

Problem is that you have to start unlocking it days ahead, in case you need any work done when required.
Lot of complaints about unlocking.

I disagree.
My relative goes to Ratio-Shop. I personally unlock just before 1hr and then re-lock it when done.

 

[Futureized]

@ibose

> Well, at least that proves that locking the biometric works.

Problem is that you have to start unlocking it days ahead, in case you need any work done when required.
Lot of complaints about unlocking.

Does unlocking does not happens instantly? Like locking instantly.

Any idea, how many days or hours it takes approximately to wait for unlock?

 

[sj88]

@ibose

> Well, at least that proves that locking the biometric works.

Problem is that you have to start unlocking it days ahead, in case you need any work done when required.
Lot of complaints about unlocking.

Locking and Unlocking biometric is pain because of their faulty OTP system. BTW for any government employees who have attendance based on the biometrics, aren't they also vulnerable as they can't lock their biometric?

 

[iosoft]

Does unlocking does not happens instantly? Like locking instantly.

Any idea, how many days or hours it takes approximately to wait for unlock?

In my experience, Lock-Unlock is almost instant.
(Still give 10 mins of wait time)

The website itself slows down at random times....

 

[enthusiast29]

Sometime the APIs fail for OTP and other things so it's better to try unlock more than a couple days ahead especially during working days as on weekends API issues don't get resolved.

 

[ibose]

@ibose

> Well, at least that proves that locking the biometric works.

Problem is that you have to start unlocking it days ahead, in case you need any work done when required.
Lot of complaints about unlocking.

You need biometric to be unlocked only if there is an biometric authentication requirement as part of the "convenient" eKYC. Otherwise where do you require it ? How frequently is that needed to be done ? I try to avoid giving out my Aadhar as far as possible anyways. Note that the biometric lock is separate from a Aadhar lock.

Biometric Lock/Unlock - Unique Identification Authority of India | Government of India

UIDAI is mandated to issue an easily verifiable 12 digit random number as Unique Identity - Aadhaar to all Residents of India.

uidai.gov.in

Aadhaar Lock/Unlock - Unique Identification Authority of India | Government of India

UIDAI is mandated to issue an easily verifiable 12 digit random number as Unique Identity - Aadhaar to all Residents of India.

uidai.gov.in

 

[TEUser2K1]

Website /api crashes a lot and get user into trouble many times.

 

[enthusiast29]

You need biometric to be unlocked only if there is an biometric authentication requirement as part of the "convenient" eKYC. Otherwise where do you require it ?

Exactly, when fingerprint authentication/verification is done only then it's needed to unlock.