PAN Card Fraud India: How Scammers Are Misusing Your PAN in 2026

A grocery shop owner in Khurja, Bulandshahr, received a notice from the Income Tax Department for sales of Rs 1,41,38,47,126. He runs the shop out of his own house. A shoemaker in Balotra, Rajasthan, received a GST recovery notice for Rs 6.79 crore against an export firm registered in Tamil Nadu, a state he has never visited. A twenty five year old student in Gwalior got a notice for Rs 46 crore of transactions routed through a company operating in Mumbai and Delhi. None of the three had ever registered a company. All three had, at some point, handed over a photocopy of a PAN card.

That is PAN identity theft India 2026 in its finished form, and the numbers behind it are not small. According to the Entrust 2025 Identity Fraud Report, the Indian tax ID was the most targeted identity document in the world in 2024, appearing in 27 percent of all document fraud attempts globally, ahead of the Pakistan National Identity Card at 18 percent and the Bangladesh National Identity Card at 15 percent. India is not on that list because Indians are careless. India is on that list because PAN is uniquely valuable, and uniquely easy to forge.

This guide covers why PAN sits at the centre of Indian financial fraud, the six ways stolen PAN details are actually used, the real cases on police and tax department record, the seven free checks that tell you in ten minutes whether your PAN has been misused, and the exact sequence to follow if it already has been. It sits alongside our Aadhaar data breach guide, because in almost every documented case the two documents were stolen and used together.

Why PAN Is India's Most Stolen Document

Two things make PAN misuse India a global category of fraud rather than a local nuisance, and it is worth being precise about both.

The first is availability. Blank PAN templates circulate freely online, which means producing a convincing digital forgery costs a fraudster almost nothing. That matters more than it used to, because 2024 was the year digital document forgery overtook physical counterfeiting for the first time. Entrust found digital forgeries made up 57 percent of all document fraud worldwide, a 244 percent increase on 2023 and a 1,600 percent increase since 2021. A forged PAN no longer has to survive being held in a bank officer's hand. It has to survive being uploaded to a digital KYC flow, which is a far lower bar.

The second is value. Aadhaar proves who you are. PAN proves you can transact. It is the identifier attached to your bank accounts, your credit history, your demat account, your mutual funds, your property registrations and your tax filings, and it is quoted on every transaction above the reporting threshold. One working PAN does not open one account. It opens a synthetic financial identity that can borrow, invoice, incorporate and file, all at once.

The supply side is the part most people underestimate. Resecurity documented the personally identifiable information of roughly 815 million Indians offered for sale on the dark web, including Aadhaar and passport records alongside names, phone numbers and addresses, with the seller quoting 80,000 dollars for the full dataset. Breaches at Indian utilities have leaked the same combinations, including a Bengaluru Water Supply and Sewerage Board portal breach in which Aadhaar, PAN and payment data of users was put up for sale. The material is already out there in bulk, which is why the useful question is not whether your PAN has leaked but whether anyone has used it yet. Our dark web India guide covers how those markets operate.

Professor Triveni Singh, a cybercrime expert and former IPS officer, put the mechanics plainly in a report on the surge in identity based lending fraud: cybercriminals are using these documents to create fake identities and target the entire financial ecosystem. The combination they need is small. PAN, Aadhaar number, a mobile number, and a photograph. All four are routinely collected together by every loan agent, gym, hotel and rental broker in the country.

The 6 Ways Scammers Misuse Stolen PAN Details

The document is the same in every case. What changes is the machine it is fed into, and how long it takes you to find out.

Misuse 1: Fake Loan Applications in Your Name

This is the highest volume version and the one behind most fake loan using PAN India complaints. A fraudster combines your PAN with your Aadhaar number, a mobile number under their control and a photograph, completes a digital KYC journey at a bank or an NBFC, and draws a personal or business loan. The money goes to their account. The liability, the recovery calls and the credit damage go to yours.

The scale of the damage has nothing to do with the size of the loan. In April 2022 the actor Rajkummar Rao posted publicly that his PAN had been misused to take a loan of Rs 2,500 in his name and that his CIBIL score had been affected as a result. Two thousand five hundred rupees. A public figure with the reach to tag the bureau directly, and it still took a public post to get it looked at. For everyone else, the first signal is usually a recovery call, or a home loan rejected for a default they have never heard of.

What makes this category worse in India is timing. Fraudulent loans typically sit undetected for months, because nothing in the system tells you a stranger has borrowed against your identity unless you go looking. By the time the account is reported as delinquent, it has already aged on your report. Our fake loan app guide covers the lending side of this ecosystem, and our KYC update scam guide covers how the documents are harvested in the first place.

Misuse 2: Fake ITR Filing to Claim Fraudulent Tax Refunds

The phrase ITR filed without my knowledge India describes two different frauds. In the cleaner version, a return is filed on your PAN with fabricated deductions and, in some cases, false TDS entries, engineered so that a refund is generated and paid into an account the racket controls. In the messier version, you are recruited into it without understanding what you signed, by an agent promising a bigger refund for a commission.

This is not a fringe problem. On 14 July 2025 the Income Tax Department launched a large scale verification operation at more than 150 premises across Maharashtra, Tamil Nadu, Delhi, Gujarat, Punjab and Madhya Pradesh, targeting ITR preparers and intermediaries running organised rackets that filed returns claiming fictitious deductions and exemptions, some of them submitting false TDS returns to extract excessive refunds. The department used third party financial data, ground intelligence and AI tooling to find the patterns. In the four months around that action, close to 40,000 taxpayers voluntarily withdrew wrong claims worth about Rs 1,045 crore.

The reason to check your own filing history rather than assume is that the consequences land on the PAN holder, not on the preparer. If a return you did not file sits on your record, it is your assessment, your penalty exposure and your scrutiny. Open incometax.gov.in, go to e-File, then Income Tax Returns, then View Filed Returns, and read every year that is listed. Then read Form 26AS and the Annual Information Statement, which show every TDS credit and reported transaction that third parties have attached to your PAN. A salary from an employer you have never worked for shows up there first.

Misuse 3: Fake Company or LLP Registration

This is the most expensive form of PAN misuse in India, and the cruellest, because the victim usually finds out through a demand notice rather than through anything they could have prevented at the time.

The Bulandshahr case is not isolated, it is representative. A cobbler in Balotra district, Rajasthan, Jitendra Kumar Jingar, who makes traditional leather shoes in Gudamalani, received a GST recovery notice dated 5 May 2026 from the Assistant Commissioner of the Krishnagiri-2 Assessment Circle in Tamil Nadu, demanding Rs 6.79 crore from a firm called Shri Shivam Exporters for the financial years 2017-18 to 2019-20. He has never opened a company, never done export business and never been to Tamil Nadu. He believes his documents were misused after he approached a finance company in Barmer for a loan in 2018, following his father's death, when an executive collected his identity papers and an OTP saying both were needed to check his CIBIL score. Banks were directed to freeze his accounts, fixed deposits and overdraft facilities.

In Gwalior, a twenty five year old student, Pramod Kumar Dandotiya, received income tax and GST notices revealing a company registered on his PAN, operating in Mumbai and Delhi since 2021, with Rs 46 crore of transactions attached. In Kanpur, a security guard's PAN was allegedly used to register a firm called Om Enterprises which recorded Rs 17.47 crore in textile transactions and triggered a CGST notice of Rs 3.14 crore, now under Crime Branch investigation.

The pattern in all four is identical. A person with no business income, whose PAN was collected once in an unremarkable transaction, becomes the registered face of a shell entity used for bogus invoicing and input tax credit fraud. Government data shows the size of the machine: fake GST registrations obtained using forged or stolen PAN and Aadhaar credentials numbered 5,699 in 2023-24, 3,977 in 2024-25 and 1,517 in 2025-26, with detections of Rs 15,085 crore, Rs 13,109 crore and Rs 9,940 crore respectively. Over two years, 9,676 fake firms were identified with combined evasion above Rs 28,000 crore, leading to 1,178 arrests. Every one of those firms needed a PAN, and a great many of them borrowed one from someone who never knew.

The government response has been to tighten the front door with risk based biometric Aadhaar authentication for new GST registrations, mandatory geo-tagging of business premises, and bank account submission within 30 days. Those measures help future victims. They do nothing for the people already carrying a demand, which is why the check at mca.gov.in matters now rather than later.

Misuse 4: SIM Card Registration Using Your PAN

Mobile connections issued against stolen identity documents are the plumbing of Indian cyber fraud. They are used to make scam calls, to operate mule accounts, to receive OTPs and to register the messaging accounts that run every other fraud on this list. When investigators trace a number, the trail leads to the identity on the customer acquisition form, which may be yours.

The scale here is measurable because the government publishes it. As of July 2026 the Department of Telecommunications had disconnected more than five crore fraudulent mobile connections through the Sanchar Saathi platform and its modules. TAFCOP alone accounted for over 2.75 crore disconnections by December 2025. The Financial Fraud Risk Indicator, now integrated with more than a thousand banks and payment operators, is credited with preventing around Rs 1,800 crore in verified cyber fraud losses.

The consumer facing part of that system is free and takes two minutes. Go to sancharsaathi.gov.in, open TAFCOP, log in with your mobile number and an OTP, and you will see every connection registered against your identity. Anything you do not recognise can be flagged for disconnection with one tap. Our SIM swap fraud guide covers the related attack where your existing number is taken over rather than a new one issued.

Misuse 5: Dark Web Sale, Your PAN in Fraud Packages

Individual PAN theft is retail. The wholesale trade is what feeds it. Stolen records are aggregated into identity packages, PAN plus Aadhaar plus mobile number plus address plus a photograph, and sold on dark web forums and Telegram channels, with payment in cryptocurrency later converted to rupees through exchanges. The Resecurity disclosure of PII belonging to roughly 815 million Indians is the largest documented example, and utility and hospital breaches have supplied a steady stream since.

Prices are low, which is the uncomfortable part. Complete stolen databases have been listed on breach forums for a few hundred dollars, because the seller monetises volume while the buyer monetises each identity individually. A package that costs a fraudster a few hundred rupees can support a loan application, a GST registration and three SIM cards.

You cannot recall data that has already been sold. What you can control is detection speed, which is the entire argument for running the seven checks below on a schedule rather than after a notice arrives.

Misuse 6: KYC Bypass for Financial Accounts

The last category is the one that turns you from a victim into a suspect. Bank accounts, wallets, demat accounts and investment accounts opened on your PAN through a digital KYC flow become mule accounts, used to receive money stolen from other fraud victims and to layer it through several transfers before it is withdrawn.

When those funds are traced, the account is frozen and the account holder of record is questioned. The account holder of record is whoever the PAN belongs to. Explaining that you never opened it is possible, and people do it successfully, but it takes months and it starts from the wrong side of the table. Our mule account guide covers how those accounts are recruited and used, and our bank account fraud guide covers the freeze and unfreeze process.

How to Check If Your PAN Has Been Misused

Three of those steps are done badly often enough to be worth expanding, because a check that misses the fraud is worse than no check at all.

Do not stop at one bureau. India has four credit information companies, TransUnion CIBIL, Experian, Equifax and CRIF High Mark, and a lender reports only to the bureaus it subscribes to. A fraudulent loan can appear in one report and be entirely absent from another. You are entitled to one free full credit report from each bureau every calendar year, so the honest answer to how to check PAN misuse India is four reports, not one. Space them across the year and you get quarterly coverage for free.

Read Form 26AS and the AIS, not just the ITR list. The filed returns page tells you whether a return exists. Form 26AS and the Annual Information Statement tell you what the rest of the financial system has reported against your PAN, including TDS deducted by employers you have never worked for and high value transactions you never made. In the shell company cases, this is the layer where the fraud was visible years before the notice arrived.

Treat an unexplained OTP as a live event, not a wrong number. An OTP from a bank, a lender or a broker you have no relationship with usually means an account is being opened on your PAN at that moment. Do not share it, obviously, but also do not ignore it. Screenshot it with the timestamp, note the sender ID, and check your credit report the same week.

One more habit worth building. Run these checks on a schedule, not on a suspicion. Quarterly is enough for most people. The single variable that decided the outcome in every documented Indian case was how long the misuse ran before anyone looked.

How to Protect Your PAN From Being Misused

You cannot make your PAN unusable, because it has to be quoted to function. What you can do is make each copy you hand over useless for anything except the transaction it was given for, and make new activity on your PAN visible within days rather than years.

• Self attest every copy with purpose and date. Write the specific purpose and the date across the face of the photocopy, in ink that crosses part of the printed detail, for example For HDFC KYC only, 25 Aug 2026, and sign under it. A copy already committed to one named purpose is worthless to a shell company promoter, and its presence in a fraudulent file is itself evidence in your favour.
• Never send your PAN on a WhatsApp group, an unknown website or unverified email. Group media is downloaded by every member and forwarded onward permanently. Unknown websites are the single most common entry point into the identity packages sold on dark web forums.
• Take a written acknowledgement every time you submit a physical copy. Ask who retains it and get that on paper. Years later, in a dispute over a firm you never registered, an acknowledgement naming the recipient is what moves the burden off you.
• Never give a PAN copy and an OTP together. No legitimate CIBIL check, KYC process or loan enquiry requires you to read out an OTP to a person. That exact combination, documents plus an OTP framed as a credit score check, is what the Balotra artisan handed over in 2018 and what produced a Rs 6.79 crore demand in 2026.
• Set credit alerts for any new inquiry linked to your PAN. Alerts at your bureau convert a fraudulent loan from something you discover in eighteen months into something you dispute in two days, and the dispute clock is far kinder when the account is fresh.
• Keep PAN and Aadhaar linking active. It is mandatory anyway, and it adds an authentication layer to new account opening that raises the cost of running your PAN inside a synthetic identity.
• Redact what does not need to be visible. When a counterparty only needs to see that the card exists rather than read every field, mask the parts they do not need. Where they only need to confirm the number is genuine, offer online PAN verification instead of a scan.
• Ask what happens to the copy. Gyms, brokers, hotels and loan agents collect PAN copies routinely and store them badly. Asking the question changes behaviour more often than you would expect, and it tells you which counterparties to refuse.

On the question people ask most, lock PAN card India, the answer is unfortunately short. Aadhaar can be biometrically locked and unlocked through myAadhaar. PAN cannot. PAN 2.0, the Rs 1,435 crore modernisation approved in November 2024, brings a dynamic QR code that pulls your name, date of birth, photograph and number live from the department database rather than freezing them into a printed image, and adds logic to identify and deactivate duplicate PANs. Both are real improvements against forged and cloned cards. Neither is a lock, and neither stops a genuine PAN number being quoted on a fraudulent application.

What To Do If Your PAN Has Been Misused

Sequence matters here, because the acknowledgement number from step two is what every later step depends on.

1. Collect the evidence first. Download the credit report page showing the fraudulent account, the ITR history screen, the MCA record, the notice itself, and every SMS or email you received. Do it before you complain anywhere, because records get updated and screens change.

2. File at cybercrime.gov.in and save the acknowledgement number. Choose Report Other Cybercrime, then the category that fits, Online Financial Fraud where money moved and Identity Theft where it has not yet. You do not need to have lost money to file. The acknowledgement number is what turns a credit bureau dispute from a request into a documented fraud claim.

3. Call 1930 the same hour if money has moved. If an account opened on your PAN has transacted, or a tax refund was diverted, the helpline can request a lien while the money is still sitting in the receiving account. That window is measured in minutes. Our money recovery guide sets out the first hour in detail.

4. Dispute in writing with both the bureau and the lender. Raise the dispute at the credit bureau and separately with the lender that reported the account, attaching the cybercrime acknowledgement and the FIR if you have one. This is where the RBI framework in force since 26 April 2024 works for you. If your complaint about incorrect credit information is not resolved within 30 calendar days, you are owed Rs 100 for every additional day, and the credit institution owes compensation if it fails to send corrected information to the bureau within 21 days of being informed. Compensation is payable into your account within five working days of resolution, and wrongful denial can be escalated to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021. Cite the framework in the complaint itself. It changes how quickly it is handled.

5. Report ITR and e-filing misuse to the Income Tax Department. Use the e-filing portal's own account misuse and grievance route, call the helpline on 1800 103 0025, and lodge a PAN grievance through the TIN customer care complaint form. If a return was filed on your PAN that you did not file, say so in writing and keep the submission receipt.

6. Answer every notice inside its deadline, even when the demand is not yours. This is the step that decides how bad the case gets. An unanswered notice becomes a confirmed demand, and a confirmed demand becomes attachment of your bank accounts, fixed deposits and overdraft facilities, which is precisely what happened in Balotra. Reply, state clearly that the entity is not yours, attach your FIR and cybercrime acknowledgement, and ask for the registration documents on which the entity was created.

7. File an FIR at your local police station or cyber cell. Cite IT Act Section 66C for identity theft and Section 66D for cheating by personation using a computer resource, with BNS Section 318(4) where property or money was dishonestly obtained, plus the forgery provisions where documents were fabricated. Keep the FIR copy attached to every dispute, notice reply and grievance you file afterwards.

8. Where a company was registered on your PAN, write to the Registrar of Companies. File a written complaint with the RoC for that jurisdiction stating you never consented to the incorporation or the directorship, and ask for the record to be flagged. These cases run long, so keep every document in one physical and one digital file from day one.

What Indian Law Actually Gives You

PAN misuse is not a paperwork problem that you sort out with a phone call. It is a criminal offence on several counts, and you can file without having lost a rupee yourself.

The RBI compensation framework is the piece almost nobody invokes and the one that produces the fastest movement. It came out of two circulars dated 26 October 2023 and took effect on 26 April 2024. It binds both the credit institutions that report your data and the credit information companies that hold it, it sets a hard 30 day clock on complaint resolution, it puts a 21 day obligation on the lender to send corrections to the bureau, and it makes the compensation payable into your bank account within five working days of resolution rather than on request. A dispute letter that quotes the framework, the dates and the acknowledgement number from cybercrime.gov.in is a materially different document from a form filled in on a bureau website. Our victim rights guide covers what banks and police are obliged to do once you file.

Frequently Asked Questions

Sources and Credits

• Entrust, 2025 Identity Fraud Report: the finding that the Indian tax ID was the most targeted identity document globally in 2024 at 27 percent of document fraud attempts, ahead of Pakistan at 18 percent and Bangladesh at 15 percent, the availability of online templates as the driver, and digital forgeries reaching 57 percent of all document fraud, up 244 percent on 2023 and 1,600 percent since 2021.
• Deccan Herald, Uttar Pradesh Shopkeeper Stunned by Rs 141 Cr Tax Notice, Says PAN Misused for Shell Firms: the Khurja grocery shop owner, the notice for sales of Rs 1,41,38,47,126, the six Delhi firms allegedly incorporated on his PAN, the earlier 2022 notice, and the case registered at Khurja Police Station.
• Business Standard, Rs 141 Cr Tax Notice Stuns UP Shopkeeper, PAN Linked to 6 Delhi Firms: additional reporting on the same case and on how PAN misuse produces shell company demands.
• Free Press Journal, Rajasthan Footwear Artisan Gets Rs 6.78 Crore GST Notice, Fake Export Firm Allegedly Registered Using His PAN: Jitendra Kumar Jingar of Gudamalani, Balotra, the 5 May 2026 notice from the Krishnagiri-2 Assessment Circle in Tamil Nadu, the firm Shri Shivam Exporters, the 2018 loan enquiry in Barmer where identity papers and an OTP were collected as a CIBIL check, and the freezing of his accounts, fixed deposits and overdraft.
• Business Today, My PAN Card Has Been Misused, College Student From Gwalior Gets Rs 46 Crore Income Tax Notice: Pramod Kumar Dandotiya, the company registered on his PAN operating in Mumbai and Delhi since 2021, and the Rs 46 crore of transactions attached to it.
• The420.in, Experts Warn of Rising PAN and Aadhaar Misuse in Loan Fraud Cases: the Kanpur security guard whose PAN was allegedly used to register Om Enterprises with Rs 17.47 crore in transactions and a Rs 3.14 crore CGST notice, the digital KYC mechanism used to draw fraudulent loans, and the quote from Professor Triveni Singh, cybercrime expert and former IPS officer.
• Rajkummar Rao on X, 2 April 2022: the actor's public fraud alert that his PAN had been misused for a Rs 2,500 loan and that his CIBIL score had been affected as a result.
• Press Information Bureau, Income Tax Department Cracks Down on Bogus Claims of Deductions and Exemptions: the verification operation launched on 14 July 2025 at over 150 premises across Maharashtra, Tamil Nadu, Delhi, Gujarat, Punjab and Madhya Pradesh, the organised rackets of ITR preparers filing fictitious deductions and false TDS returns, and the use of third party data and AI tooling.
• Trak.in, 40,000 Taxpayers Withdraw Rs 1,000 Crore Bogus Claims: the roughly 40,000 taxpayers who voluntarily withdrew wrong claims worth about Rs 1,045 crore in the four months around the crackdown.
• TaxGuru, Fraudulent GST Registration Using Forged or Stolen PAN and Aadhaar: the year on year counts of fake GST registrations obtained on forged or stolen PAN and Aadhaar, 5,699 in 2023-24, 3,977 in 2024-25 and 1,517 in 2025-26, with detections of Rs 15,085 crore, Rs 13,109 crore and Rs 9,940 crore, and the biometric authentication and geo-tagging countermeasures.
• The420.in, Government Tightens Noose on Fake GST Registrations, 489 Cases Linked to Forged PAN and Aadhaar: the enforcement picture on fake registrations built on stolen identity documents and the tax evasion detected against them.
• TaxGuru, Government Detects Rs 38,134 Crore Fake ITC Fraud in 3 Years: the scale of fake input tax credit fraud run through shell firms, and the arrests and prosecutions arising from it.
• Resecurity, PII Belonging to Indian Citizens, Including Their Aadhaar IDs, Offered for Sale on the Dark Web: the personally identifiable information of roughly 815 million Indians offered for sale, including Aadhaar and passport records with names, phone numbers and addresses, and the 80,000 dollar asking price for the full dataset.
• OneIndia, BWSSB Data Breach, Aadhaar, PAN and Payment Data of Users Sold on Dark Web: an Indian utility breach in which Aadhaar, PAN and payment data was taken and listed for sale.
• Communications Today, DoT Says Over Five Crore Fake Mobile Connections Disconnected in Anti Fraud Drive: the five crore fraudulent connections disconnected through the Sanchar Saathi platform as of July 2026, the TAFCOP and Chakshu modules, and the Financial Fraud Risk Indicator credited with preventing around Rs 1,800 crore in losses.
• RTI Wiki, Check SIM Misuse via TAFCOP on Sanchar Saathi 2026: the step by step TAFCOP process for seeing every SIM registered against your identity and flagging the ones you do not recognise.
• Business Today, RBI Directive, Rs 100 Compensation for Each Day of Delay in Complaint Redressal: the 26 October 2023 circulars effective 26 April 2024, the 30 day resolution clock, the 21 day correction obligation on credit institutions, the five working day payment window, and the escalation route to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021.
• Income Tax Department, e-Filing Account Misuse: the official route for reporting misuse of an e-filing account and a PAN, and the department's guidance on what to submit.
• Ministry of Corporate Affairs, Verify DIN and PAN Details of Director: the free public check for finding companies and directorships attached to a PAN, alongside View Signatory Details.
• National Cybercrime Reporting Portal: the official complaint route for identity theft and online financial fraud, and India's national cybercrime helpline, 1930.
• TransUnion CIBIL: the credit report and credit alert service used to detect loans and inquiries made against a PAN without the holder's knowledge.