KYC Documents on WhatsApp may seem convenient to share, but cybersecurity experts warn that sending sensitive documents such as PAN cards, Aadhaar cards
and bank statements through personal WhatsApp numbers can expose users to privacy and security risks.
Many people send these documents to loan agents, property brokers or hotel staff for verification.
However, once a document is shared, it may remain stored on another person’s phone, laptop or cloud backup for years.
KYC Documents on WhatsApp
According to Abhinav Parashar, Co-founder and CEO of digital trust platform Digio, people often believe they are sharing documents with an organisation, but in reality they may be sending them to an individual’s personal device.
He said this can result in users losing control over where their personal information is stored and how it may be used in the future.
Even if the recipient has no intention of misusing the documents, the files could later be exposed through a hacked device or compromised cloud account.
Why experts advise caution
Parashar said collecting KYC documents through personal phone numbers, instead of official company systems, creates additional copies of sensitive data outside an organisation’s cybersecurity infrastructure.
He warned that in the wrong hands, personal information could be used for unsolicited calls, spam or, in the worst cases, identity theft.
The Reserve Bank of India’s Annual Report for 2024-25 recorded 23,953 banking fraud cases involving Rs 36,014 crore, highlighting the importance of protecting personal financial information.
Experts recommend using official company portals or secure digital verification systems instead of sending documents over WhatsApp.
Businesses can verify customer details through official digital forms, DigiLocker or UIDAI’s Offline Verification Seeking Entity (OVSE) framework without relying on personal messaging apps.
If there is no alternative and documents must be shared, Parashar advises sending them as password-protected files and sharing the password separately.
DPDP Act and data protection
India’s Digital Personal Data Protection (DPDP) framework emphasises that personal information should be collected for a defined purpose and handled responsibly.
According to experts, using an official business portal provides a clearer record of who is collecting the information and why, while documents shared through personal messaging apps become much harder to track once they are downloaded or forwarded.