E-Governance & Citizen Portals: A Field Study

Yes, DigiLocker employs 256-bit SSL encryption and complies with the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016. Your documents are stored across secure data centres hosted by the National Informatics Centre (NIC).

Under Section 5A of the IT Act, electronically fetched documents in DigiLocker carry identical legal validity to original physical certificates. Crucially, no department or agency can access your documents without your explicit consent. Every access request triggers an OTP or explicit authorization prompt on your registered mobile number.

Official government portals like UMANG and DigiLocker interact directly with the UIDAI Central Identities Data Repository (CIDR) through encrypted API channels. They do not store your raw biometric records.

However, for everyday identification (hotel check-ins, offline delivery receipts), UIDAI strongly advises downloading and sharing a Masked Aadhaar (available on DigiLocker or the official UIDAI portal). A Masked Aadhaar obscures the first 8 digits (e.g., XXXX-XXXX-1234), preserving your privacy while keeping the photo and verification QR code fully authentic.

UMANG aggregates over 1,200 diverse government services, each with specific operating prerequisites:

• SMS: Used for automated one-time password (OTP) verification to prevent phishing intercepts.
• Location: Required for geotagging services such as locating nearest CSC Kendra centres, polling booths, or fair-price ration shops.
• Storage/Camera: Necessary for uploading identity proofs or downloading digitally signed certificates.

Our UI/UX audit recommends that UMANG adopt runtime just-in-time permissions—asking for access only when a user specifically launches a feature requiring that capability.

Every minute counts. The first 2 to 3 hours following an unauthorized transaction constitute the "Golden Hours":

1. Dial 1930 immediately: Call the National Cybercrime Financial Fraud Helpline (operated by the Indian Cyber Crime Coordination Centre, I4C). They trigger automated lien alerts across banking switches to freeze stolen funds before scammers withdraw them.
2. Log on to cybercrime.gov.in: Submit a detailed formal complaint under "Report Financial Fraud" with transaction IDs, UPI handles, bank reference numbers, and debit timestamps.
3. Freeze your cards & UPI: Immediately block your compromised debit/credit cards and reset your UPI and NetBanking MPINs via your bank's official app.

Citizen portals store sensitive tax returns, driving records, and pension documents. Protect your access with these core security hygiene principles:

• Never use obvious sequences or birth years (e.g., 123456, 000000, or your birth year) as your DigiLocker 6-digit security PIN.
• Do not reuse the same PIN or password across your citizen portals and social media accounts.
• Never share an OTP received on SMS with anyone claiming to be a "portal customer support agent" or "Aadhaar verification officer". Genuine government representatives will never ask for your OTP.

Cybercriminals frequently create lookalike domain names to harvest Aadhaar details and bank accounts. Always verify these indicators:

• The .gov.in or .nic.in domain rule: Genuine Indian government portals strictly end in .gov.in or .nic.in (e.g., digilocker.gov.in, web.umang.gov.in). Beware of domains ending in .com, .org.in, .xyz, or .online.
• Suspicious SMS Senders: Official government alerts use registered SMS sender IDs like AD-DGLCKR, VM-GOVSMS, or VK-NIC, never standard 10-digit mobile numbers.
• Urgent Demands for Payment: Legitimate portals do not charge fees for basic DigiLocker registration or scheme discovery on MyScheme.

While DigiLocker and Cybercrime Portal communicate over HTTPS (encrypted connection), public Wi-Fi networks in railway stations, bus stands, or coffee shops are susceptible to Man-in-the-Middle (MITM) attacks, rogue hotspots, and DNS spoofing.

Recommendation: When downloading sensitive identity documents or conducting financial fraud reporting, prefer your cellular data (4G/5G) or use a reputable Virtual Private Network (VPN). Always log out of shared computers at cyber cafés immediately after completing your work.