Ahmedabad Aadhaar Fraud Racket Reportedly Used Purportedly AI-Generated Deepfakes to Change Businessman's Linked Mobile Number

Ahmedabad Cyber Crime police reportedly arrested four people after businessman Amit Patel alleged that his Aadhaar-linked mobile number had been changed without consent. Police reportedly said the accused allegedly used purportedly AI-generated deepfake videos made from Patel's photo to bypass facial authentication, access DigiLocker/e-KYC services, open bank accounts, and apply for loans.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves malicious actors using AI-generated deepfake videos to impersonate specific victims for financial gain through fraudulent loan applications and bank accounts.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The perpetrators illegally accessed and updated the victims' Aadhaar profiles and DigiLocker accounts, compromising their sensitive personal data.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human actors who intentionally used deepfake generation tools post-deployment to bypass biometric security and commit identity fraud.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI-generated content such as deepfakes, which falls under Limited Risk due to transparency and manipulation concerns.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Identification
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers, Unique Identification Authority of India
• Alleged deployer: Scammers, Mohammad Kaif Iqbalbhai Patel, Kanubhai Bahadursinh Parmar, Deep Maheshbhai Gupta, Ashish Rajendrabhai Waland
• Alleged harmed parties: Bonneville Foods Private Limited, Amit Patel, Aadhaar holders

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes severe privacy violations, including identity theft and unauthorized access to personal data.

Directly caused: The accused illegally accessed the victims' Aadhaar details, altered their registered mobile numbers, and accessed their DigiLocker and e-KYC profiles.

Inferred additional harm: The compromise of Aadhaar details could lead to further unauthorized access to other linked financial and personal accounts of the victims.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Insecure Aadhaar Kit Management: Aadhaar update kits were not properly secured against unauthorized use.
• Poor Identity Verification Auditing: Lack of real-time monitoring to detect fraudulent biometric updates.

Technology

• Vulnerable Facial Authentication: System failed to distinguish deepfake videos from live human faces.
• Deepfake Video Generation: AI tools allowed creation of realistic blinking and facial movements.

Data Inputs

• Unsecured Personal Photos: Victim's photograph was easily acquired to generate the deepfake.
• Stolen Aadhaar Credentials: Aadhaar numbers and personal details were obtained via unauthorized means.

Human Factors

• Collusion by CSC Operators: Operators compromised security by sharing kits for commission.
• Lack of Operator Verification: Operators did not verify the physical presence of the Aadhaar holder.

Process and Methods

• Flawed Aadhaar Update Process: Process allowed mobile number changes via remote facial authentication.
• Inadequate Liveness Detection: Methods used to verify live presence were bypassed by simulated blinking.

Regulatory Environment

• Weak CSC Operator Oversight: Inadequate regulatory monitoring of Common Service Centre operators.
• Lack of Deepfake Regulations: No strict controls on AI tools capable of synthesizing identity media.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, detailed factual accounts of the fraud mechanism, the arrests, the specific victims, and the role of AI-generated deepfakes in bypassing biometric authentication. There is little ambiguity regarding how the AI was used or the nature of the incident.
• Ambiguities identified: The specific AI software or model used to generate the deepfakes is not identified.
• Alternative interpretations: None. The incident is clearly a case of targeted financial fraud and identity theft enabled by deepfake technology.

Local criminals in India successfully used AI-generated deepfakes to bypass facial biometric authentication on Aadhaar, the national identity system, to commit identity theft and financial fraud. While localized, the incident highlights a critical vulnerability in national digital infrastructure to AI-enabled spoofing.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: India
• Alleged perpetrator: Criminal group

Threat characteristics

• Imminence: Long-term. The immediate threat is mitigated by the arrests, but the vulnerability of biometric systems to deepfakes is an ongoing strategic security concern.
• Autonomy: Human-controlled. The AI deepfake generation tools were directly operated and controlled by human actors to execute a specific fraud scheme.
• Novelty: Evolved capability. Represents an evolved capability where deepfakes are specifically engineered to bypass liveness detection in national biometric authentication systems.

Impact by dimension

• Physical security: Negligible. No kinetic threats, physical infrastructure damage, or physical safety risks identified in the incident.
• Information security: Minor. Use of deepfakes to bypass authentication represents a minor information security compromise, but lacks broader intelligence or systematic information warfare elements.
• Sovereignty: Substantial. Successful bypass of the national biometric ID system (Aadhaar) and DigiLocker represents a notable compromise of core government identity verification infrastructure.
• Economic security: Minor. Financial fraud was limited to local victims and personal loans, presenting no systemic threat to national financial stability.
• Societal stability: Minor. Targeted identity theft and privacy violations occurred, but the impact was localized and did not threaten population-scale stability or civil liberties.