PAN 2.0 is a real government project, but the emails and SMS telling you to click a link to download your PAN 2.0 or e-PAN card are fake. The Income Tax Department does not send unsolicited links, and it never asks for your Aadhaar, bank account, or OTP. Any message that tells you your PAN will be deactivated unless you update it now, or that your new QR-code PAN is ready to download, is a phishing attempt built to harvest your identity and drain your account. Do not click. If you lost money or shared bank details, call 1930 and report at cybercrime.gov.in.
Who this is for
Anyone in India who holds a PAN card, which is nearly every working adult, every taxpayer, and every person with a bank account. Scammers are riding the genuine PAN 2.0 rollout to make their emails and texts look official. The people most at risk are those who saw a news headline about PAN 2.0 and are unsure whether they need to act, senior citizens, first-time taxpayers, and anyone who banks or files returns on a phone. You do not need a tax or security background to stay safe. You need to know one thing: the government does not make you download your PAN through a link.
What PAN 2.0 actually is
PAN 2.0 is a genuine upgrade to how the Permanent Account Number is issued and managed. The Cabinet Committee on Economic Affairs approved the PAN 2.0 Project on 25 November 2024 with a financial outlay of INR 1,435 crore, and the Income Tax Department later named LTIMindtree as the technology partner.
What it changes, per Protean’s official PAN 2.0 FAQ and ClearTax’s breakdown:
- One unified portal replaces the three separate systems taxpayers used before (e-Filing, UTIITSL, and Protean).
- New and reprinted cards carry a dynamic QR code that holds current cardholder data.
- The e-PAN is free.
The part scammers hope you miss: existing PAN cards stay fully valid. You do not have to reapply, and you do not have to pay or click anything to keep your PAN working. The upgrade happens on the government side. This gap between what people fear and what is actually required is exactly the space the scam lives in.
Why this is spiking now
Two things collided in 2025 and 2026: a real PAN 2.0 launch that people half understood, and a PAN and Aadhaar linking deadline that created genuine urgency. Scammers fused both into a believable threat.
| Fact | Detail | Source |
|---|---|---|
| PAN 2.0 approved | 25 Nov 2024, INR 1,435 crore, unified portal, free QR e-PAN | NewsOnAir / PIB |
| Fake e-PAN emails flagged | PIB Fact Check confirmed e-PAN download emails are fake, July 2025 | PIB Fact Check |
| PAN and Aadhaar deadline | Link by 31 Dec 2025 or PAN turns inoperative from 1 Jan 2026 | Business Standard |
| Cyber fraud losses 2024 | INR 22,845 crore lost, up 206 percent, 85 percent financial fraud | Angel One / I4C data |
The Press Information Bureau’s fact-check unit put out a direct warning in July 2025. Its scam alert told citizens that an email asking you to click a link to download your e-PAN card is fake, to check the sender’s email ID, and to never click links or download attachments from such emails. News coverage from WION and The Tribune confirmed the same advisory.
How the PAN scam works
The scam runs across email, SMS, and sometimes a phone call. The variations share one goal: get you onto a fake page and take your PAN, Aadhaar, and bank details.
- The bait. An email or SMS lands with a subject like PAN 2.0 Cards, Download your new e-PAN, or Your PAN will be deactivated. Reported scam emails came from lookalike domains such as info@smt.plusoasis.com, never from a government address. Some texts use the PAN and Aadhaar linking deadline: PAN and Aadhaar link mandatory, account suspension begins tomorrow.
- The urgency. The message sets a same-day or 24-hour deadline. Deactivation, suspension, blocked refund, or a penalty. Urgency is designed to stop you from checking.
- The fake portal. The link opens a page that copies the look of a government site but sits on a domain that does not end in .gov.in. It may show a QR code and a Download e-PAN button to match the real PAN 2.0 story.
- The data harvest. The page asks for your PAN, Aadhaar number, date of birth, mobile number, bank account, card details, and then an OTP that it claims verifies your identity. In reality the OTP authorises a transaction on your account.
- The theft. With your PAN and Aadhaar, fraudsters can attempt identity theft, apply for loans or credit in your name, or move money straight out using the card details and OTP you entered. Some victims only find out when a loan they never took appears against their PAN.
The whole flow is built to feel like routine compliance. That is what makes it work on careful people.
How real PAN services actually work
There are only a few official channels. Memorise them, because everything outside this list is suspect.
- incometax.gov.in is the Income Tax e-filing portal. Instant e-PAN, which is free and Aadhaar based, PAN and Aadhaar linking, and the Know Your PAN check all happen here. Per the Income Tax Department’s PAN page, this is the primary official source.
- Protean (formerly NSDL) at onlineservices.proteantech.in handles PAN applications and corrections.
- UTIITSL at pan.utiitsl.com is the other authorised agency for PAN services.
Three rules that never change:
- The e-PAN is emailed to you only when you yourself applied for it. It never arrives unrequested with a download link.
- The Income Tax Department never asks for your password, PIN, full card number, or OTP by email, SMS, or call. Confirmed on the department’s own Report Phishing page.
- If you want to update or link your PAN, type the official address yourself. Do not reach it through a link in a message.
Red flags any reader can apply
Any one of these is enough to stop and delete the message.
1. The sender is not a .gov.in address
Real Income Tax email comes from incometax.gov.in. A message from a random domain like smt.plusoasis.com or a free email account is fake, no matter how official the logo looks.
2. It tells you to download your PAN or e-PAN through a link
The government does not push PAN downloads to you. The e-PAN is only issued when you apply on an official portal. An unrequested Download your e-PAN link is the scam’s signature move.
3. It threatens deactivation or suspension with a deadline
Your PAN will be deactivated today. KYC expires tonight. Link now or lose access. Real deadlines exist for PAN and Aadhaar linking, but the real process is done on incometax.gov.in, never through a link in a threatening message.
4. It asks for Aadhaar, bank details, card number, or OTP
No official PAN service collects your OTP, card number, or net banking password on a web form to verify your PAN. The moment a page asks for these together, it is harvesting them.
5. The greeting is generic and the page is slightly off
Dear User instead of your name, spelling mistakes, odd formatting, and a URL that almost looks right but does not end in .gov.in. Scam pages copy the design but rarely get every detail correct.
What to do if you got one
- Do not click, do not reply. If you have not entered anything yet, delete the message. That is the whole defence.
- Verify independently. If you are genuinely unsure about your PAN status, open a fresh browser and type incometax.gov.in yourself. Use Know Your PAN. Do not use any link from the message.
- If you already entered details, move fast. Call your bank, block the card or freeze the account, and tell them you shared details on a phishing site. Change your bank, email, and reused passwords.
- Never share an OTP. If you did, inform the bank at once so they can try to stop the transaction.
- Save the evidence. Keep the email, the sender address, screenshots of the fake page, the SMS, and any phone number before you delete anything.
- Report it. Details in the next section.
- Tell your family. Especially parents and older relatives, who are the most common targets of PAN and KYC threats.
How to report a PAN scam in India
Two channels, depending on what happened.
For a phishing email or fake PAN website (no money lost yet): forward the email or the fake site URL to webmanager@incometax.gov.in and copy incident@cert-in.org.in, the national CERT-In reporting address. This is the process on the Income Tax Report Phishing page.
If money was lost or you shared bank details: call 1930, the national cybercrime helpline operated 24 hours a day by the Indian Cybercrime Coordination Centre under the Ministry of Home Affairs, and file a formal complaint at cybercrime.gov.in within 24 hours. Reporting within the first hours gives banks the best chance to freeze the receiving account before the money is withdrawn.
Got a message? Send it to us, we verify free
If a PAN, e-PAN, or KYC email or SMS feels off and you want a sanity check before doing anything, send it to us privately.
WhatsApp / Call: +91 99644 43350
Send a screenshot, the sender address, the link, or whatever you have. We tell you whether it is a real government contact or a scam, and what to do next.
What we do:
- Check the sender domain and the link against the real Income Tax and PAN service domains
- Look for the phishing tells (download-link lure, deactivation threat, Aadhaar and OTP harvest)
- Tell you whether it is real or fake, in plain language
What we do not do:
- Charge you for the verification
- Ask for your PAN, Aadhaar, bank details, OTP, or UPI PIN
- Pretend to be a government department
Verification is free. We also publish a related guide on the KYC account-block SMS scam and on the traffic challan SMS scam, which use the same fake-deadline playbook. A companion post on ITR refund scams covers the tax-refund version of this trick.
Save this number now
If you ever get an email or SMS claiming your PAN will be deactivated, or offering a PAN 2.0 or e-PAN download link, and you are unsure: WhatsApp +91 99644 43350. Save it now. During an active scam, you will not have time to search.
We also publish a Karnataka citizen safety guide for the same broad audience these scammers target.
Frequently asked questions
Is PAN 2.0 real, and do I need to click a link or pay to get it?
PAN 2.0 is a real government project. The Cabinet approved it on 25 November 2024 with a budget of INR 1,435 crore, and it adds a QR code plus a single unified portal for PAN services. But you do not need to do anything to get it. Existing PAN cards stay fully valid, and the Income Tax Department has confirmed nobody has to reapply. There is no email that makes you click a link to download a PAN 2.0 card. Any message telling you to download your PAN 2.0 or e-PAN through a link is a phishing scam. The e-PAN is free and is only issued through official government portals when you yourself apply.
How do I spot a fake e-PAN or PAN 2.0 email or SMS?
Check the sender first. Real Income Tax communication comes from addresses ending in incometax.gov.in, never from a random domain. PIB Fact Check flagged one scam email sent from info@smt.plusoasis.com in July 2025. Other tells: a generic greeting like Dear User instead of your name, an urgent deadline threat such as your PAN will be deactivated today, a link that does not end in .gov.in, spelling errors, and any request for your Aadhaar number, bank account, card number, or OTP. The Income Tax Department never asks for passwords, PINs, or bank details over email, SMS, or call. If even one of these signs is present, do not click and do not reply.
What are the only official ways to apply for or update a PAN?
There are three official routes and nothing else. Instant e-PAN, which is free and Aadhaar based, on the Income Tax e-filing portal at incometax.gov.in. The Protean (formerly NSDL) portal at onlineservices.proteantech.in. And the UTIITSL portal at pan.utiitsl.com. PAN and Aadhaar linking is also done only on incometax.gov.in. If a website asking for your PAN details does not sit on one of these domains, it is not official. Always type the address yourself instead of clicking a link from an email or SMS, and verify your existing PAN using the Know Your PAN service on incometax.gov.in before applying for anything.
I clicked a fake PAN link and entered my details. What should I do now?
Act fast. If you shared a card number, CVV, or net banking password, call your bank immediately and block the card or freeze the account. Never share an OTP, and if you already did, tell the bank so they can reverse or stop the transaction. Change the passwords for your bank, email, and any account that used the same password. Watch your bank and UPI statements for unfamiliar charges. Then file a complaint at cybercrime.gov.in and call 1930 within 24 hours. Speed is the single biggest factor in stopping money before it leaves your account, because banks can sometimes freeze the receiving account within hours.
How do I report a PAN phishing email or scam in India?
For a phishing email or fake PAN website, forward it to webmanager@incometax.gov.in and copy incident@cert-in.org.in, which is the national CERT-In reporting address. If any money was lost or you shared bank details, call the cybercrime helpline 1930 and file a formal complaint at cybercrime.gov.in within 24 hours. The 1930 helpline is operated 24 hours a day by the Indian Cybercrime Coordination Centre under the Ministry of Home Affairs. Save any evidence first: the email, the sender address, screenshots of the fake website, the SMS, and the phone number. The more detail you give, the faster investigators can act.