Sharing a cancelled cheque: can someone misuse it?

At a glance

A cancelled cheque can’t be encashed — that’s the point of the word “CANCELLED” across it — but it still hands over your name, account number and IFSC, and if you’ve signed it, a copy of your signature. Those details are enough to make fraud against you easier, so treat it as a bank-detail document, not scrap paper: never sign one, write the purpose on the copy, and give it only where account verification is needed. Under India’s DPDP Act, whoever collects it must state the purpose — and delete it after.

Educational resource only. This explains how a cancelled cheque is treated as personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

What a cancelled cheque is, and why everyone asks for one

A cancelled cheque is a leaf from your own chequebook with “CANCELLED” written across it — asked for not as payment, but as proof that the account details on it are real and yours. Because the account number and IFSC are printed by the bank, a cancelled cheque is treated as reliable evidence of your account — which is why employers, mutual funds, insurers and lenders ask for one when they need to route money to you. The cancellation stops it being used as a payment instrument; it does nothing to hide the data on it. That distinction — dead as a cheque, alive as a data document — is what this page is about.

What a cancelled cheque actually reveals

Everything someone needs to identify your bank account: account number, IFSC, the branch, usually your printed name — and, if you’ve made the classic mistake of signing it, your signature. The magnetic-ink MICR band along the bottom carries the machine-readable version of the same routing details. None of this is secret in the way a password is — you share these details whenever someone pays you — but bundled on one bank-printed document they’re a verified, credible package, which is exactly what makes a stray copy useful to a fraudster.

Who asks for it, and when it’s genuinely needed

The legitimate ask is always the same: someone needs to verify the account they’ll pay into or debit from. Whoever collects it becomes a Data Fiduciary with duties to you: a clear notice of why it’s collected (Section 5), and collection limited to what that purpose needs (Section 6).

• Reasonable — an employer setting up salary credit, a mutual fund or broker registering your account for redemptions, an insurer for claim payouts, a lender at disbursal, provident-fund (EPF) withdrawal processing.
• Question it — a cancelled cheque demanded where no money will ever move to or from your account, “for records” alongside a full KYC set that already proves the account, or a fresh cheque demanded by an unverified caller. Increasingly, a bank statement header, a passbook copy or penny-drop verification serves the same purpose — you can ask whether one of those will do.

The real risks if it’s misused

A cancelled cheque can’t be cashed — the danger is what the details on it enable. A stray copy can be used to:

• make fraud against you credible — a caller who reads out your real account number, branch and name doesn’t sound like a stranger, and that credibility is the engine of banking scams;
• feed forged paperwork — account details plus a signature sample (from a signed cheque) are raw material for forged mandates, withdrawal forms or cheques;
• complete a stolen identity — combined with an ID copy floating around from the same KYC packet, the account details round out an impersonation kit.

The signature is the multiplier. An unsigned cancelled cheque leaks data; a signed one leaks data and the means to fake your authorisation.

How to cancel a cheque properly

Two parallel lines, “CANCELLED” between them in ink, no signature — that’s the whole technique, and the no-signature rule is the one that matters.

1. Take a fresh leaf from your chequebook — don’t reuse one you’ve partially filled.
2. Draw two parallel diagonal lines across the face and write “CANCELLED” clearly between them, in ink that can’t be erased cleanly.
3. Don’t cover the essentials — the account number, IFSC and MICR band must stay readable; that’s the data the recipient needs.
4. Never sign it. No legitimate process needs a signature on a cancelled cheque — a signed one is a signature sample stapled to your account details.
5. Add a purpose note on the copy or the back — e.g. “For salary account verification, [company], [month/year]” — so the same leaf can’t be quietly reused elsewhere.

How to share it safely

Hand over the physical leaf or a protected scan through the organisation’s own channel — not a photo in a chat thread.

1. Prefer the official route — the employer’s HR portal, the fund house’s upload page, the branch — over email and WhatsApp forwards.
2. If you must send a scan, password-protect the file and share the password separately; a purpose-marked, protected PDF beats a loose gallery image.
3. One purpose, one cheque — write a fresh cancelled cheque per requirement rather than circulating one scan everywhere; the purpose note only works if it’s specific.

Masking, safe channels and minimisation work the same way for every document you handle — the steps above are the cancelled-cheque version of that shared routine.

How to store it, and when to let go

Don’t keep pre-made cancelled cheques or scans lying around — and hold businesses to deleting theirs once verification is done. A cancelled cheque has no ongoing use to you: make one when asked, for that ask. Delete stray scans from your phone gallery, chats and sent-mail folder, and destroy unused leaves you cancelled but never submitted.

On the other side, once your account is verified and the payout route is set up, the business’s purpose is served — under the DPDP Act it must keep the copy secure and erase it once the purpose ends (Section 8). A scan of your cheque sitting in a broker’s shared folder years after the account was verified is a security failure you can challenge: ask what they hold, ask for deletion, and ask for written confirmation.

FAQ