Sharing your PAN: what to check before you hand it over

At a glance

Your PAN is the key to your financial identity, so share it only where the purpose genuinely needs it — a bank KYC, your employer for tax, a tax-reportable transaction. Unlike Aadhaar, PAN has no official masked version, so the safeguard is to self-attest the copy and write the purpose across it. Under India’s DPDP Act a business can collect it only for a purpose it has told you about, must keep it secure, and must delete it once that purpose ends — so a PAN sitting on a shop’s file “for records” is over-collection you can refuse.

Educational resource only. This explains how your PAN is treated as personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

On this page

• What is PAN, and why is it so sensitive?
• What your PAN reveals
• Who genuinely needs it — and who doesn’t
• The real risks if it’s misused
• How to share it safely
• How to store it, and when to let go
• FAQ

What is PAN, and why is it so sensitive?

PAN — the Permanent Account Number issued by the Income Tax Department — is the single identifier that ties together your entire financial life, which is exactly what makes a loose copy dangerous. It’s a 10-character alphanumeric number linked to your bank accounts, investments, high-value purchases, and tax record. Because it’s the thread the tax system uses to connect your financial activity, a misused PAN lets someone act financially in your name. It’s requested constantly — for accounts, loans, property, and large transactions — so the discipline is to give it only where it genuinely belongs.

What your PAN reveals

A PAN card shows your full name, father’s or parent’s name, date of birth, photo, signature and the PAN itself — an identity-and-finance bundle on one card. The number is the linking key; the rest confirms you are the holder. Because that combination is enough to impersonate you in a financial setting or to back a fraudulent application, a full PAN copy deserves the same care as your bank details — it effectively is a pointer to them.

Who genuinely needs it — and who doesn’t

Banks, employers, and parties to tax-reportable transactions have a real reason to collect PAN; a retail store pushing “no-cost EMI,” a hotel adding it at check-in, or an app asking at signup usually does not. Whoever collects it becomes a Data Fiduciary with duties to you: a clear notice of why it’s being collected (Section 5), and collection limited to what the stated purpose actually needs (Section 6).

So the test is: is this a situation the law or the transaction genuinely ties to PAN?

• Genuinely required — bank or regulated-lender KYC, your employer deducting tax, buying or selling property, and other transactions above the thresholds where quoting PAN is mandatory.
• Usually over-collection — an electronics store offering EMI, a hotel check-in, or an app or wallet asking at signup. Here you can decline, and ask what purpose it’s meant to serve.

PAN is one document where the “representative ID” habit doesn’t apply: where the requirement is specifically PAN — a tax-reportable payment, for instance — offering a different ID doesn’t satisfy it, and where PAN isn’t required, no ID substitute is needed either.

The real risks if it’s misused

A leaked PAN is a financial-impersonation tool — and PAN fraud is quiet, often surfacing only when the damage is already done. Because the number keys your financial identity, a misused copy can be used to:

• open accounts or apply for credit in your name, leaving you liable for the debt;
• link false financial activity to your tax record, from benami dealings to unexplained transactions;
• strengthen other fraud — a real PAN copy lends a forged application the credibility to pass a check.

The trap is that none of this announces itself. The usual first sign is an unexplained dip in your credit score, or a transaction you don’t recognise in your Form 26AS or Annual Information Statement (AIS) — which is why periodic checks matter more for PAN than for almost any other document.

How to share it safely

Aadhaar has a masked version; PAN does not — so the safeguards are self-attestation, a purpose watermark, and sharing only where required. Since you usually have to share the full number when PAN is genuinely needed, the goal is to make any copy hard to reuse elsewhere:

1. Self-attest every copy — sign across it and write the purpose plainly, e.g. “For KYC with [name] only.” A purpose-marked copy is far harder to repurpose than a clean scan.
2. Share only with trusted institutions — banks, registered financial companies, employers, government agencies. Never send PAN details, OTPs, or a copy to unverified callers, WhatsApp forwards, or “verification” links.
3. Give the number only where the number is what’s needed — some processes need only the PAN quoted, not a full card image. Provide the least that satisfies the request.
4. Never post it publicly — a PAN on a shared form, an email thread, or social media is a standing risk.

Masking, watermarking and safe channels work the same way for every document you handle — the steps above are the PAN-specific version of that shared routine.

How to store it, and when to let go

Keep your own copies secured, not loose in a gallery or chat — and hold businesses to deleting theirs once the purpose ends. For your own use, keep PAN scans in a secured, access-controlled place rather than your phone’s photo gallery or a WhatsApp thread, where they drift into backups and shared albums.

On the other side, a business that collects your PAN must keep it secure and erase it once the purpose it was collected for is over (Section 8). A PAN copy retained long after a one-time verification, or sitting in an unsecured shared folder, is a security failure the business answers for. You can ask what it holds, ask it to delete a PAN it no longer needs, and ask for written confirmation.

FAQ

Is there a masked PAN like masked Aadhaar? No. PAN has no official masked version. The practical safeguards are to self-attest the copy with the purpose written across it, share it only where genuinely required, and never send it over WhatsApp or to unverified callers.

Can a store or hotel insist on my PAN? Only where the purpose genuinely needs it — which a retail EMI desk or hotel check-in almost never does. An unrelated PAN demand as a condition of service is over-collection you can decline; your consent has to be free and unconditional.

When do I actually have to give my PAN? For bank and regulated-lender KYC, for your employer’s tax deduction, for property transactions, and for payments above the thresholds where quoting PAN is mandatory. Outside those, ask what purpose it serves before handing it over.

How would I know if my PAN was misused? It rarely shows up directly. The usual signs are an unexplained fall in your credit score, or an entry you don’t recognise in your Form 26AS or AIS — so check both periodically.

How do I get a company to delete my PAN copy? Once its purpose is over, you can ask the business to erase your PAN copy and confirm it’s done — the DPDP Act’s erasure duty (Section 8) backs this.