EPFO Fraud Alert: Protect UAN, Aadhaar and OTP

Frequently asked questions

This EPFO fraud alert on UAN, Aadhaar and OTP safety has one direct answer for employees and employers: never disclose login credentials, identity details or an OTP because an unexpected caller or message claims that a PF account, KYC update or claim needs urgent action. As of 7 November 2026, the EPFO Member Portal alert says members should not share passwords, and that EPFO does not request Aadhaar, PAN or bank details by phone. HR should turn that warning into a clear verification and incident-response process.

What the EPFO fraud alert means for UAN, Aadhaar and OTP safety

EPFO’s EPFiGMS fraud warning says members should not share their UAN, password, PAN, Aadhaar, bank-account details, OTP or other personal and financial information. It also says that EPFO and its staff do not seek these details through calls, messages, WhatsApp or social media.

The UAN and password provide access to the EPFO member account. Aadhaar and OTP-based authentication can be used in identity-related services, so an unexpected request for a KYC update or claim approval needs careful scrutiny. EPFiGMS itself uses OTP verification for grievance registration, which is different from being asked to disclose an OTP to a caller or message sender. See the EPFiGMS service information.

Not every OTP is a scam. An official process may generate one after the member starts an action in the correct service. However, the EPFiGMS fraud warning is clear that members should not share OTPs or personal and financial details with anyone. The member should enter the OTP personally in the official service they opened.

The direct answer: never share UAN credentials, Aadhaar details or OTPs through unverified messages or calls

Employees need one rule they can remember: do not share UAN, password or OTP details with another person. They should also reject requests for a full Aadhaar number, PAN, bank details, card information, UPI PIN or a payment to “release” a claim. The EPFO Member Portal alert says EPFO does not ask for Aadhaar, PAN or bank details by phone, and does not contact members for monetary deposits.

This remains true when the caller knows the employee’s name, employer, UAN digits or an earlier PF issue. Familiar information does not establish that a call or message is genuine.

Aadhaar OTPs require the same care. UIDAI’s authentication guidance explains that Aadhaar authentication history records biometric, OTP and demographic authentication activity. It also provides Aadhaar and biometric locking options for account holders who see suspicious activity or want to restrict authentication.

HR and payroll staff should follow the same standard. They should not ask an employee to forward an OTP, log into a member account using the employee’s password or place credentials in a shared spreadsheet.

Common EPFO scam signs employees should recognise

EPFO phishing messages often imitate a familiar service problem. Common warning signs include:

• a threat that the PF account, claim or KYC will be blocked within a few hours;
• a link received unexpectedly through SMS, email or a messaging app;
• a shortened URL, misspelt domain or page that resembles an EPFO login screen;
• a request to disclose an OTP, password, Aadhaar number or bank credentials;
• instructions to install an app, open an APK file or allow remote access to the phone;
• a demand for a fee, refundable deposit or payment to release PF money;
• pressure to remain on a call while completing the requested steps; or
• poor spelling, inconsistent branding or a sender address unrelated to the claimed organisation.

CERT-In’s Digital Safety Compass Handbook advises people to verify shortened URLs before opening them, avoid sharing passwords or PINs through email or text, and watch for poor grammar or spelling in phishing messages. The handbook also warns that scam calls can pressure people to install harmful software or grant remote access, while fake apps can be used to steal credentials and OTPs.

A padlock icon or polished design is not enough. Employees should reach the service independently through a saved bookmark or a manually entered address rather than relying on the link in a message. CERT-In’s phishing guidance recommends closing an email and going directly to the organisation’s website through the browser’s address bar when a genuine service needs to be reached.

How HR can verify an EPFO-related request before sharing it with staff

HR should treat every new EPFO circular, campaign, WhatsApp message or urgent service update as unconfirmed until it matches an official source.

1. Do not open or forward the original link. Record the sender, time, wording and claimed action.
2. Open a known official channel independently. Use a saved bookmark or manually access the EPFO Member Portal rather than following the incoming message.
3. Check the scope carefully. Confirm who the message applies to, what action is required and whether it is a member task or an employer task.
4. Use an official help route when unsure. The EPFO Member Portal lists EPFO helpdesk number 14470, while EPFiGMS accepts grievances relating to EPFO services.
5. Prepare a fresh internal notice. Summarise confirmed information in the company’s own template and link employees to the official source instead of forwarding a message chain.
6. Add a safety reminder. State that HR will never ask for a UAN password, Aadhaar OTP, banking OTP or remote access to an employee’s device.

Where employees are using new EPFO communication channels, HR can also share the EPFO WhatsApp service checklist. It can help teams distinguish a confirmed member service from lookalike messages and unsupported promises.

What an employee should do after clicking a suspicious link or sharing an OTP

Speed matters, but the response should remain orderly.

If the employee only clicked the link

• Close the page and do not return to it.
• Do not download a file, install an app or approve permissions.
• Save the message, sender details and a screenshot for reporting.
• Update the device and run a trusted security scan.
• Monitor the UAN profile, KYC information, passbook and claim status through an official channel.

The EPFO Member Portal alert advises members to use licensed anti-malware protection, keep systems updated and maintain a complex password. CERT-In’s Mobile Phone Best Practices also advise users to keep operating systems and anti-malware software updated, avoid apps sent through messages or chats, and not click suspicious links or share OTPs.

If the employee entered a UAN password

Change the password immediately through the official member portal. If the password was reused for email or another account, replace it there as well. CERT-In’s 15 Elemental Cyber Defense Controls for MSMEs, issued on 1 September 2025, recommend strong, unique passwords, restricting password reuse and educating users not to share credentials. Its phishing guidance also says a person who suspects phishing should change the password immediately.

If Aadhaar information or an Aadhaar OTP was exposed

Review Aadhaar authentication history and consider locking Aadhaar or biometrics if there are unfamiliar authentication attempts. UIDAI says its authentication-history service shows the authentication mode, date and time, response code, Authentication User Agency name and transaction ID. UIDAI also says that a person who suspects biometric misuse should lock biometrics, review authentication history and report the concern for further assistance.

If bank details, a banking OTP or money was involved

Contact the bank immediately using the number in its official app, website or transaction alert. The Reserve Bank of India’s 2 February 2024 caution on KYC fraud warns that unsolicited calls, SMS and emails can pressure customers to reveal account or login details or install unverified apps.

For a financial cyber fraud, call 1930 and file a report through the National Cyber Crime Reporting Portal. The RBI’s 2 February 2024 caution directs people facing financial cyber fraud to the portal or 1930, and to inform their bank immediately. Preserve transaction references, phone numbers, URLs, screenshots and complaint acknowledgements.

What HR should do next

Assign one case owner and involve IT or the company’s security contact if a work device, company email account or employee list may be affected. Do not circulate the live suspicious link internally. Share a screenshot with the URL obscured where possible.

HR should also assess whether the same message reached other employees. Send a focused warning where needed, but do not name the affected employee or disclose their personal information.

A simple SME payroll-team checklist for protecting employee PF data

For a small payroll team, the aim is to reduce unnecessary access to sensitive information and make legitimate communication easy to recognise. CERT-In’s 15 Elemental Cyber Defense Controls for MSMEs recommend role-based access aligned with job responsibilities, least-privilege access, unique user IDs rather than shared accounts, and periodic reviews of access privileges. These baseline recommendations are directly intended for MSMEs.

• Tell employees that HR will never request their UAN password or OTP. EPFO’s fraud warning on EPFiGMS says EPFO and its staff do not ask for UAN, password, Aadhaar, bank-account or OTP details through calls, messages, WhatsApp or social media.
• Store UAN and PF records only in an approved, access-controlled HR or payroll system. Give access according to defined payroll responsibilities and review permissions when responsibilities change, following the role-based and least-privilege approach in CERT-In’s MSME cyber defence controls.
• Do not keep passwords or OTPs in ordinary workplace messages or spreadsheets. CERT-In’s MSME cyber defence controls advise against credential sharing and recommend secure encryption and hashing for password storage.
• Use individual company accounts instead of shared credentials, and remove or update access when a payroll role changes or ends. CERT-In’s MSME cyber defence controls recommend unique user IDs, periodic access reviews and an immediate review of privileges following role changes, transfers or exits.
• Verify EPFO announcements independently before circulating them. CERT-In’s phishing guidance recommends reaching a genuine service by typing its address directly in the browser rather than following an unsolicited link.
• Give employees one approved address or ticketing route for PF questions, maintain an escalation list for payroll, HR, IT, the employee’s bank, EPFiGMS and 1930, and cover the process in onboarding and awareness reminders. EPFO’s EPFiGMS portal provides the grievance route, while the RBI’s 2 February 2024 caution directs financial-fraud victims to their bank, the cybercrime portal and 1930.

For UAN account safety, consistency is the most useful control. Employees should know where a genuine HR message will appear, what information HR may request and which details it will never collect.

FAQs: Can EPFO ask for an OTP or Aadhaar details by phone, WhatsApp or email?

Can EPFO ask me to read out an OTP over the phone?

No. EPFO’s EPFiGMS fraud warning says EPFO and its staff do not ask members to share OTPs or personal and financial details through calls, messages, WhatsApp or social media. A legitimate online process may send an OTP, but you should enter it yourself in the official interface.

What if a message claims to come from EPFO’s official WhatsApp service?

Do not trust a display name or logo alone. Compare the number, service and instructions with a current official announcement. Do not disclose a password or read an OTP to anyone. Use the EPFO WhatsApp service checklist before HR circulates instructions to employees.

Should HR collect an employee’s full UAN and Aadhaar over email?

HR should collect only the information needed for the task through an approved, access-controlled process. It should never ask for portal passwords or OTPs. EPFO’s fraud warning on EPFiGMS says members should not share UAN, password, Aadhaar or OTP details, while CERT-In’s Mobile Phone Best Practices advise people not to share Aadhaar details or OTPs with strangers.

Where can I make an EPFO fraud complaint?

Use EPFiGMS for a grievance concerning an EPFO service or account issue. Report suspected cybercrime through the National Cyber Crime Reporting Portal. Call 1930 immediately if financial fraud has occurred, and notify the relevant bank without delay, as set out in the RBI’s 2 February 2024 fraud caution.

Build a safer employee-benefits communication process

Scammers benefit when employees receive benefits information from many unrelated numbers, inboxes and informal groups. HR can reduce confusion by using one approved communication route, a predictable message format and a clear rule that passwords and OTPs are never collected.

Include PF scam response in the same process used for insurance, wellness and other benefits queries. A central channel gives employees somewhere familiar to check an unexpected request before acting and gives HR a record of what was communicated.

Review your employee benefits with Healthysure to give HR one clearer, well-managed place to communicate benefits and support employees.