Aadhaar's Success Story Deserves a Closer Look

Aadhaar, India's biometric identity system, is routinely held up as proof that a developing country can build a national digital identity system and use it to fix a hard governance problem: making sure welfare payments reach the people they are meant for. The World Bank has praised it, India showcased it as a model “digital public infrastructure” during its 2023 G20 presidency, and it now anchors “India Stack,” a bundle of platforms that other countries are encouraged to adopt, sometimes with direct technical support from Indian institutions.

That international reputation has taken shape despite, not because of, a lack of scrutiny. Indian economists, computer scientists, and journalists have produced a substantial body of critical work on Aadhaar over more than a decade, examining the suitability of the identity definition, its deduplication accuracy, its claimed fiscal savings, and its privacy and security design. In 2018, India’s own Supreme Court split 4-1 on the project’s constitutionality. Remarkably little of that domestic critique appears to have shaped how the system is described to the rest of the world.

This is worth a closer look, not because digital identity is a bad idea, but because Aadhaar embodies one particular design choice made between 2009 and 2016: a single, permanent, biometric identifier, reused as a common key across banking, telecoms, taxation, and welfare. .. Two distinct kinds of problems follow from that choice. The first, taken up in the next two sections, is that the evidence behind Aadhaar’s core technical and fiscal claims is weaker than its reputation suggests, regardless of how the identifier is designed. The second is that reusing one identifier everywhere creates a linking risk that a narrower, purpose-bound alternative would avoid — a design principle this piece returns to further below.

How sure is the system that no one is enrolled twice?

When India’s Supreme Court upheld Aadhaar’s constitutionality in 2018, its reasoning turned substantially on one claim: that Aadhaar reliably prevents duplicate identities, justifying the scheme even though some genuine beneficiaries might be excluded along the way. How reliable that claim actually is, therefore, speaks directly to the legal justification offered for the entire program.

India’s Comptroller and Auditor General, in a report tabled in Parliament in 2022, found that the identity authority’s own oft-cited “99.9 percent accuracy” figure for biometric deduplication is self-reported, and that the process “remained vulnerable for generating multiple Aadhaar numbers.” No outside body has been given access to the live database to independently audit its real-world accuracy.

The underlying problem is also computationally hard, not just administratively messy. Comparing every new enrollment against everyone already enrolled — 1:N matching with N = 1.4 billion people — is what computer scientists call an O(N²) problem: the work grows with the square of the population, not merely in proportion to it. That works out to roughly 10¹⁸ comparisons across the life of the program, a number no amount of additional hardware simply erases. UIDAI approximates by pre-sorting fingerprints into rough categories before detailed matching and splitting the work across three independent contractors, but these are ways of making the problem cheaper, not ways of making the matching more accurate. That the challenge remains live is shown by the identity authority’s own 2026 rollout of a new AI-based matching platform, built specifically to improve the speed and accuracy of a task it has been running for over a decade.

Does linking welfare to Aadhaar actually save money?

The government has credited Aadhaar-linked welfare payments with cumulative savings running into the hundreds of billions of rupees, figures echoed largely uncritically by international institutions. Economist Reetika Khera has traced one widely cited version of this number to its source and shown that it conflates the total value of money transferred through the direct-benefit-transfer system with the amount of fraud actually eliminated — two very different quantities. Other economists argue that much of the apparent fall in beneficiary counts reflects genuinely eligible people excluded by failed fingerprint scans or re-verification hurdles, rather than fraudulent "ghost" beneficiaries removed, and that no independent study has cleanly separated the two.

The strongest evidence available on biometric authentication of welfare payments was, in fact, not built on Aadhaar. A randomized trial covering 157 sub-districts and roughly 19 million people found that biometric smartcards reduced payment delay and leakage in the state of Andhra Pradesh. But that program began in 2006, three years before Aadhaar existed, and ran on a separate state database. The one study that evaluated Aadhaar’s own biometric authentication directly, in Jharkhand’s food-subsidy program, found a genuine mixture: corruption fell, but between 1.5 and 2 million people lost access to their entitlements at some point during the rollout. Independent economists disputed this later, more favourable reading of the same underlying data, arguing that the reform in question delivered “pain without gain.”

Every one of these efficiency claims also quietly narrows "leakage" to a single channel: someone other than the correctly identified beneficiary receiving the benefit. Biometric authentication can plausibly fix that one channel, but it has nothing to say about grain diverted from government warehouses before it ever reaches a customer — estimated to be roughly 43.9 percent nationally as of 2007-8 — or about a dealer who correctly authenticates a beneficiary's fingerprint and then simply hands over less than the recorded entitlement. Neither leaves any trace in a system built to check identity, not quantity.

Aadhaar-based KYC and the risk of repurposing: When one “yes” means more than was agreed to

A well-designed identity check keeps two things separate: authentication, meaning proving who a person is, and authorization, meaning that person’s specific consent to one particular transaction. Aadhaar’s e-KYC design does not clearly keep these apart. When an organization checks someone’s fingerprint against the database, the system simply replies “yes, verified,” with nothing to stop that organization from using the same moment to trigger a second, unrelated action the person never separately agreed to. The problem is even more severe in the more common Aadhaar-card based physical KYC, where the submitted paper copy can be repurposed for almost anything.

This is not a hypothetical worry. In December 2017, the identity authority suspended Airtel and Airtel Payments Bank’s license to perform Aadhaar checks after finding that retail agents, while verifying customers’ fingerprints to issue SIM cards, were using the same verification to silently open bank accounts. Because government subsidy payments in India are routed to whichever bank account is currently linked to a person’s Aadhaar number, cooking-gas subsidies worth roughly 1.9 billion rupees were quietly redirected into more than three million of these unrequested accounts. Regulators fined Airtel Payments Bank — a correction applied only after the fact, not a fix to the underlying design.

A tokenized design would have closed this loophole structurally. Tokenization replaces one fixed identifying detail with a substitute code specific to one purpose or one organization, which can be limited, changed, or cancelled without touching the underlying identity. It works the way a different password for every website works: if one leaks, only that account is compromised. Give a bank one token, a telecom provider a different one, and a ration shop a third, and none can be combined to reconstruct the whole person, because none shares a key with any other. A credential scoped to SIM verification alone could not have doubled as authorization to open a bank account, because the two functions would never have shared a common credential to misuse in the first place. Aadhaar, as built, is close to the opposite: one number and one set of biometric data, reused everywhere.

This is not a case of hindsight. Agrawal, Banerjee, and Sharma proposed tokenization, under the name “virtual IDs,” in one of the earliest detailed technical critiques of Aadhaar’s privacy and security design — years before the government’s own retrofitted “Virtual ID” scheme arrived.

A bridge across data silos

A related danger appears once the same Aadhaar number sits, as a matter of routine, inside a person’s bank, telecom, tax, employer, and welfare records. Any two organizations holding that number can quietly line up their records side by side and build a picture of a person’s life that neither was individually authorized to see, without ever needing to breach Aadhaar’s own database, simply because both use the same number as a filing tag.

Justice D.Y. Chandrachud, dissenting when the Supreme Court ruled on Aadhaar’s constitutionality in 2018, described this as building “a bridge across data silos,” warning that it enables profiling and surveillance by both government and private actors. This was one strand of a considerably broader dissent that led Chandrachud to hold the entire Act unconstitutional, against the majority’s assumption that cross-silo convergence was not a realistic risk.

That assumption did not hold up well in practice. Months before the judgment, in January 2018, journalists paid a small sum over a messaging app for ten minutes of unrestricted access to a portal returning the full name, address, photograph, and phone number linked to any of the roughly one billion Aadhaar numbers then in existence. The identity authority dismissed the episode as “misreporting.”

This is the specific failure the tokenization principle described earlier is built to prevent: with purpose-bound, unlinkable credentials issued separately to each relying party, no single leaked credential, and no two organizations comparing records, could reconstruct a person’s full profile, because there would be no shared key left to line up.

A workable alternative, not a wish

None of this is an argument against digital identity as such, or even against a portable national credential. What the evidence undermines is one specific design choice: a single, permanent, endlessly reused identifier, in place of narrower, purpose-bound, revocable tokens issued separately to each organization that needs to verify someone.

And the alternative is not hypothetical. MOSIP, the Modular Open Source Identity Platform, was built in India specifically so that other countries could obtain Aadhaar-like identity systems without being locked into Aadhaar’s own monolithic design; it has since been adopted, in some form, by the Philippines, Morocco, Sri Lanka, and several other countries. The European Union’s ongoing eIDAS 2.0 reform is building its new digital identity wallet around the same principle of unlinkability, making it cryptographically difficult for two relying parties to compare notes and discover they were dealing with the same person.

None of this is a ready-made blueprint India could simply have copied in 2009 — these frameworks all postdate Aadhaar’s founding design, and each carries its own unresolved trade-offs. The point is narrower: a tokenized alternative to a single, monolithic identifier is not a theoretical fantasy. It is a family of designs that governments, including India’s own, are actively building for adjacent problems, and one that could, in principle, close the correlation and repurposing risks this piece has traced. 

Identity is not a fingerprint

Finally, the identity definition itself requires a relook. Underneath the technical and economic questions sits a more basic one: identity is not a physical fact waiting to be measured by a scanner, but a social construct built out of names, relationships, and community recognition, not reducible to the ridges on a fingertip. Defining legal identity primarily as a biometric match does not just misdescribe what identity is; it decides, by design, who can settle a dispute about their own existence unassisted and who must instead petition a distant, opaque authority to be recognized at all — a burden that falls hardest on manual laborers, the elderly, and others whose biometric signal is naturally faint. That asymmetry is not an incidental bug awaiting a patch; it is what follows from treating a social fact as though it were a purely biological one.

The views expressed are those of the author.