INDUSTRY FACT FILE · DIGITAL IDENTITY, TRUST & ESIGN

Cybersecurity FAQs for Digital Identity, Trust and eSign Providers

Forty frequently asked questions and answers in five categories, written for Boards and CEOs, CISOs and compliance officers, product and engineering teams, CA and signing operations, fraud, privacy and response teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: UIDAI, CCA and regulatory requirements 3.  Category 3: Authentication, APIs, apps and data 4.  Category 4: Certificates, eSign and signing operations 5.  Category 5: Fraud, privacy and incident response

Audience: Boards, CEOs, managing directors and business leadership

Q1. Why are identity and trust providers such frequent targets?

Because a successful authentication, e-KYC response, video-KYC session or eSign turns directly into money, accounts or legal commitments. Fraudsters, data thieves and organised groups all see value in defeating identity checks or stealing the data behind them.

Q2. What are the biggest cyber risks for an identity or trust provider?

Cloned and replayed biometrics, deepfakes injected into video-KYC, Aadhaar numbers stored outside the vault, API and app abuse, signing without informed consent, key and registration authority compromise, partner misuse and slow detection that misses CERT-In's six-hour window.

Q3. Which public incidents should leadership know about?

UIDAI's 2017 complaint alleging replay of stored biometrics, which the entities disputed, and its 2017 suspension of Airtel's e-KYC access, DigiNotar's 2011 collapse after rogue certificates were issued, Okta's 2023 support-system breach and Arup's 2024 deepfake video-call fraud.

Q4. Is identity security an IT problem or a leadership problem?

A leadership problem. Suspension of authentication or e-KYC access, CA licence action or a fraud wave affects the whole business and its clients. Boards must own the risk appetite, fund controls and see evidence that audits and fraud defences work.

Q5. What should the Board review each quarter?

UIDAI and CCA audit findings and their closure, data discovery results for Aadhaar numbers outside the vault, fraud trends and deepfake test results, partner and sub-AUA assessments, SOC coverage, incidents reported to CERT-In, consent disputes and progress on ISO 27001 and DPDP.

Q6. Who should own cybersecurity in an identity or trust organisation?

A CISO working with the Aadhaar or KYC compliance officer, product and engineering, fraud, CA operations and the data protection officer, with a clear Board mandate, a single inventory of systems, data and partners, and regular reporting.

Q7. How should we prioritise investment?

Get Aadhaar data into the vault and out of everything else first; secure devices, APIs and apps; protect keys and privileged access; assess partners; then add deepfake testing, 24x7 monitoring and ISO 27001 or SOC 2 over successive budget cycles.

Q8. How can Codec Networks help?

Codec Networks provides role-specific UIDAI assessments, vault and HSM reviews, data discovery, ASP and eSign onboarding security, authentication and API testing, deepfake testing for video-KYC, CA and RA control reviews, managed SOC with fraud monitoring and forensics for identity incidents.

Audience: CISOs, Aadhaar compliance officers, legal and audit teams

Q9. What audit does UIDAI expect from a requesting entity?

Regulation 14(1)(h) of the 2021 Authentication Regulations requires an annual audit of operations and systems by a certified information systems auditor, and UIDAI's compliance checklist calls for this IS audit to be carried out by a CERT-In empanelled auditor.

Q10. Do the checklists differ by role?

Yes. UIDAI publishes separate compliance checklists for requesting entities and for ASAs, and sub-AUAs and sub-KUAs operate under their parent entity's agreement. The audit must therefore be scoped to your role, your integrations and the version of the checklist in force.

Q11. What is the Aadhaar Data Vault requirement?

Entities that need to store Aadhaar numbers and connected e-KYC data must keep them only in an Aadhaar Data Vault, encrypted with keys protected in an HSM, using reference keys or tokens elsewhere. UIDAI Circular 14 of 2025 revised the hosting rules in November.

Q12. Can we store biometrics to speed up repeat customers?

No. The Aadhaar Act prohibits storing core biometric information, and registered devices encrypt biometrics at capture so they cannot be reused. UIDAI's 2017 complaint about replayed biometrics shows how seriously such misuse is treated.

Q13. What penalties can apply under the Aadhaar Act?

Since the 2019 amendment, adjudicating officers appointed by UIDAI can impose civil penalties of up to ₹1 crore on entities that contravene the Act, with up to ₹10 lakh a day for continuing non-compliance, besides suspension of access and criminal offences for some acts.

Q14. Can a private company now use Aadhaar authentication?

Approved non-government entities may, under the January 2025 amendment to the good-governance rules, for specified public-interest services. Proposals are assessed by UIDAI and permitted through the relevant ministry, and approved entities take on the full obligations of a requesting entity.

Q15. What rules govern eSign?

The IT Act's Second Schedule permits Aadhaar e-KYC-based electronic signatures. eSign service providers must be licensed CAs empanelled by the CCA after audit, and follow its e-authentication guidelines and API specifications; ASPs integrate under an agreement with the ESP.

Q16. What do RBI's rules expect from video-KYC?

RBI's KYC Directions of November 2025 carry forward V-CIP: a live video interaction by an official of the regulated entity, geotagging, document capture, liveness and spoof detection and face matching. Vendors are reached through their clients' outsourcing and audit terms.

Audience: CTOs, product, engineering and integration teams

Q17. How should Aadhaar numbers be handled outside the vault?

They should not be. Use reference keys or tokens in every other system, mask numbers in screens, logs and reports, scan applications, backups and cloud storage regularly for full numbers and remove any found.

Q18. How do we secure authentication and e-KYC APIs?

Enforce strong client authentication and authorisation, encrypt requests end to end, validate every response, apply rate limits and replay protection, log securely without full Aadhaar numbers and test the APIs before release and after every significant change.

Q19. What should we check in mobile apps and SDKs?

Root, jailbreak and emulator detection, app integrity and attestation, secure storage, certificate pinning, protection of keys and tokens, resistance to hooking and tampering, and whether security checks can be bypassed on the device rather than enforced on the server.

Q20. How do registered devices protect biometrics?

Registered devices encrypt and sign biometric data at the point of capture, so the AUA's application never sees raw biometrics and captures cannot be replayed. Use only certified devices on current software, and remove old or uncertified devices from service.

Q21. How should offline verification with the signed QR code work?

Validate UIDAI's digital signature on the QR data, check the photograph against the person present, collect only the details you need, avoid storing the Aadhaar number and record that verification took place without keeping unnecessary data.

Q22. How should DigiLocker integrations be secured?

Request only the documents needed for the purpose, obtain and record the resident's consent, verify issuer signatures, protect API credentials, set retention limits for fetched documents and test the integration like any other external API.

Q23. How do we manage sub-AUAs and partners using our access?

Assess them before onboarding, bind them by agreement to UIDAI's requirements, monitor their transaction patterns, audit them periodically and suspend access quickly on misuse, because their failures are attributed to the parent entity.

Q24. How does Codec Networks test identity applications?

Codec Networks tests the whole flow: devices, apps, SDKs, APIs, vaults, consent screens and logs, using OWASP API and mobile standards and identity-specific abuse cases, and reports findings mapped to UIDAI, CCA and RBI expectations.

Audience: CA operations, RA teams, ESPs and ASP product teams

Q25. What makes an eSign trustworthy?

A genuine e-KYC authentication of the signer, a single-use key protected by the ESP, a document hash that matches what the signer saw, informed consent and tamper-evident logs of every step that can be produced if the signature is disputed.

Q26. What is document binding and why does it matter?

Document binding ensures that the hash submitted for signing is computed from exactly the document displayed to the signer. Without it, an application can show one document and obtain a valid signature on another.

Q27. What security assessment should an ASP expect before going live?

ESPs commonly require a security assessment of the integrating application, often by a CERT-In empanelled auditor, and an agreement covering data handling and logs. Confirm the current requirements in your ESP's onboarding manual before scheduling the test.

Q28. How should a CA protect its registration authority processes?

Use MFA and privileged access management for RA officers, dual control for approvals, strong verification of applicants, monitoring of approvals by volume, time and location, and prompt removal of access when staff leave.

Q29. How should signing keys be protected?

Generate and keep keys in certified HSMs, separate duties for key ceremonies, restrict and log administrator access, back up keys under dual control and rehearse key compromise and revocation procedures.

Q30. What does the move to shorter certificate lifetimes mean?

Under CA/Browser Forum rules, publicly trusted TLS certificates were limited to 200 days from March 2026, falling to 47 days by 2029. Issuance and renewal must be automated, and that automation needs the same security as manual processes.

Q31. What should a CA or ESP do if it suspects rogue issuance?

Preserve evidence, suspend the affected RA accounts, identify and revoke suspect certificates, assess key exposure, report to CERT-In within six hours, inform the CCA as its rules require and engage forensics before resuming normal issuance.

Q32. How does Codec Networks support CAs and ESPs?

Codec Networks reviews CA, RA, HSM and key management controls, tests issuance and signing infrastructure, assesses ASP applications, prepares evidence for CCA audits and monitors issuance and administrator activity through its managed SOC.

Audience: Fraud, risk, privacy, security operations and incident response teams

Q33. How do we defend video-KYC against deepfakes?

Detect virtual cameras, emulators and injected streams, check device integrity, use passive and active liveness, train agents to spot anomalies, audit calls concurrently, monitor new accounts for mule behaviour and test the platform regularly with current deepfake techniques.

Q34. How should cloned fingerprint fraud be tackled?

Use certified registered devices with liveness on current software, monitor transactions by agent, device and location, use face authentication for high-risk transactions, act quickly on complaints and suspend agents or devices that show suspicious patterns.

Q35. What should the SOC monitor in an identity business?

Authentication and e-KYC failure spikes, unusual transaction patterns by agent, device or partner, API abuse, vault and HSM access, RA approvals and certificate issuance, privileged activity, cloud storage changes and CERT-In advisories relevant to the estate.

Q36. What should we do if Aadhaar numbers are found exposed?

Close the exposure, preserve evidence, establish what data was exposed and for how long, report to CERT-In within six hours, inform UIDAI and affected clients as agreements require, prepare for DPDP breach intimation once applicable and fix the root cause.

Q37. How should consent be captured and proven?

Explain the purpose in plain language, obtain explicit consent before authentication or signing, record the consent screen version, time and session, keep the record tamper-evident and retain it only as long as needed for disputes and audits.

Q38. How does the DPDP Act affect identity providers?

Identity, KYC and document data is personal data, so organisations need lawful purposes, notices, reasonable security safeguards, retention limits and breach intimation. Most DPDP Rules obligations apply from May 2027, so programmes should be running well before then.

Q39. Should we run fraud and cyber crisis exercises?

Yes. Annual tabletop exercises with leadership, compliance, fraud, CA operations, legal and communication teams, using deepfake onboarding, data exposure and rogue issuance scenarios, test decisions on containment, reporting and client notification before a real incident.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your role in the ecosystem, integrations, partners and audit cycle; Codec Networks will propose a practical assessment, testing and monitoring plan mapped to UIDAI, CCA, RBI and CERT-In expectations.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments applicable to your organisation, your role and agreements with UIDAI, any CA licence or ESP empanelment, your clients' regulators and your contracts.