INDUSTRY FACT FILE · DIGITAL IDENTITY, TRUST & ESIGN

Threat Landscape: Top Cyber Threats Facing Digital Identity and eSign Providers

The 18 most relevant cyber threats, attacks and industry challenges for Aadhaar ecosystem entities, certifying authorities, eSign providers, KYC platforms and DigiLocker partners, and the impact each has.

Identity and trust services attract attackers because they are the gate to money, accounts and legal commitments. Fraud groups clone fingerprints, buy or steal identity documents and build synthetic identities to open mule accounts; others use deepfake faces, virtual cameras and emulators to defeat video-KYC and face matching. Insiders and operators with privileged access can misuse enrolment, authentication or registration systems. Developers and vendors leave Aadhaar numbers in logs and reports, expose APIs with weak authorisation or build apps that can be tampered with. Certifying authorities and eSign providers face attacks on their keys and registration processes, because one rogue certificate can be used to sign in someone else's name. Behind all of this sit the ordinary threats of ransomware, cloud misconfiguration and phishing, aimed at organisations whose outages stop onboarding and payments across their clients.

Public reporting shows how these threats play out. The government has told Parliament that UIDAI introduced AI and machine-learning fingerprint liveness checks to detect cloned fingerprints, after media reports of fraud using silicone copies of prints taken from public land records. In 2017 UIDAI filed a complaint alleging replay of stored biometrics by three entities, which they disputed, and suspended Airtel's and Airtel Payments Bank's e-KYC access over accounts reportedly opened without informed consent. Internationally, DigiNotar's 2011 compromise led to at least 531 rogue certificates and the company's bankruptcy, Okta disclosed in 2023 that session tokens in support files gave an attacker access to 134 customers, and Arup confirmed in 2024 that deepfakes of colleagues on a video call led to transfers of HK$200 million. The IT Rules amendment of February 2026 now requires labelling of synthetic content and fast takedown on official orders.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by identity and trust segment (Codec Networks assessment).

4.1 Biometric spoofing and replay

Fingerprint authentication still carries large volumes of assisted transactions, often at agent outlets with older devices. Cloned fingerprints and replayed captures both exploit gaps between the device, the agent application and the AUA. UIDAI's registered device framework encrypts biometrics at capture, and the government has said UIDAI's AI and machine-learning liveness check detects cloned fingerprints, but fraud shifts to wherever devices, software or agent controls lag behind.

• Questions to test: Are all devices certified registered devices on current software with liveness? Are transactions monitored by agent, device and location for unusual patterns? Is face authentication used for high-risk transactions? Can agents be suspended quickly?
• Relevant services: registered device and agent app testing, authentication anomaly monitoring, sub-AUA and agent assessments, and fraud forensics.

4.2 Deepfakes and injected video in video-KYC

Video-KYC replaced the branch visit for many regulated entities, and fraudsters now attack the camera itself. Rather than holding up a photograph, they inject synthetic or replayed video through virtual cameras, emulators or tampered apps, so that liveness and face-match models see a convincing face. RBI's KYC Directions expect liveness and spoof detection and face matching, and the Arup case shows how persuasive real-time deepfakes have become.

• Questions to test: Does the platform detect virtual cameras, emulators and injected streams, not only presentation attacks? Are device integrity and app attestation checked? Are agents trained and calls concurrently audited? Are new accounts monitored for mule patterns?
• Relevant services: deepfake and injection testing, mobile app and SDK security testing, AI model risk review, KYC process audit and post-onboarding fraud monitoring.

4.3 Aadhaar data outside the vault

The Aadhaar Data Vault exists so that full Aadhaar numbers and e-KYC data sit in one encrypted, controlled place. In practice, numbers leak into application logs, error traces, reports, data lakes, backups, support tickets and test environments, and a single open cloud bucket can expose them. Circular 14 of 2025 restates that other systems should hold reference keys or tokens, and annual UIDAI audits increasingly look beyond the vault itself.

• Questions to test: Have we scanned every application, log, report, backup and cloud store for full Aadhaar numbers? Do all systems outside the vault use tokens or reference keys? Are vault keys in an HSM with separated duties? Is cloud storage private and monitored?
• Relevant services: data discovery, Aadhaar Data Vault and HSM review, cloud configuration review, masking and tokenisation design, and privacy programmes.

4.4 Signing without informed consent

An eSign is only as trustworthy as the application that asks for it. If an ASP displays a summary page but submits a different document hash, keeps a session open for reuse or lets a call-centre agent drive the flow, a cryptographically valid signature can attach to terms the signer never saw. Disputes then turn on evidence: what the signer was shown, what was signed and whether the logs can be trusted.

• Questions to test: Is the document hash shown to the signer the one sent to the ESP? Can a document be changed after consent? Are consent screens, OTP events and signing responses logged tamper-evidently? Has the ASP been assessed before go-live and after changes?
• Relevant services: ASP application security assessment, document-binding and consent tests, ESP API testing, log integrity review and dispute forensics.

4.5 Keys, registration authorities and certificate issuance

Certifying authorities hold the keys that make signatures trustworthy and run the registration processes that decide who receives a certificate. Attackers who cannot reach an HSM can still phish a registration officer, abuse remote access or exploit an RA portal to approve requests in other people's names. DigiNotar's collapse showed that a single intrusion can end a CA's business, and shorter certificate lifetimes increase the volume of issuance to protect.

• Questions to test: Are RA and CA operator accounts protected by MFA and privileged access management? Is certificate approval under dual control? Would the SOC see unusual issuance volumes or approvals out of hours? Are revocation and key compromise procedures rehearsed?
• Relevant services: CA and RA control review, HSM and key management review, red teaming of issuance processes, managed SOC and CCA audit readiness.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation; CERT-In may issue directions and advisories.
• UIDAI: contraventions by requesting entities, ASAs or enrolment agencies can lead to suspension of access and adjudicated civil penalties under the Aadhaar Act, as amended in 2019.
• CCA: security failures at CAs and ESPs can affect licence and empanelment standing and trigger audits and revocations.
• Sector regulators: RBI, SEBI and IRDAI expect regulated entities to answer for KYC and outsourcing failures, including those at technology vendors.
• IT Rules amendment (2026): synthetic content, including deepfakes, must be labelled and unlawful content removed within three hours of an official order.
• SEBI LODR (listed firms): cyber incidents disclosed in the quarterly corporate governance report; DPDP breach intimation for personal data once provisions commence.

• Where, outside the Aadhaar Data Vault, could full Aadhaar numbers or e-KYC data be sitting today?
• Would our video-KYC and face match detect an injected deepfake, not just a printed photograph?
• Can we prove that every signer saw the exact document they signed?
• How do we oversee the sub-AUAs, agents, ASPs and vendors who use our access?
• Are RA, CA and vault administrators protected by MFA, PAM and dual control?
• Could we detect, contain and report an incident within six hours, including at night?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from official statements and widely reported events; where parties disputed allegations, that is noted.