Every Aadhaar number is 12 digits long, but only the first 11 carry identity information. The twelfth digit is a mathematical guardian: a check digit computed with the Verhoeff algorithm. It means a KYC system can reject an invented or mistyped Aadhaar number instantly, offline, with zero API calls — if it knows how to check. Here is how it works, and just as importantly, what it does and does not prove.
Why check digits exist
Check digits solve a mundane problem: transcription errors. When a 12-digit number is typed by hand or read by OCR from a photocopied card, the most common failures are a single wrong digit (writing 7 for 1) and swapping two adjacent digits (typing 45 for 54). A well-designed check digit makes both errors detectable: change any single digit or swap any adjacent pair, and the number no longer validates.
Credit cards use the Luhn algorithm for this. Aadhaar uses something stronger.
Why Verhoeff and not Luhn
The Luhn algorithm — doubling alternate digits and summing — is simple but imperfect: it misses some adjacent transpositions (09 ↔ 90). The Verhoeff algorithm, published by Dutch mathematician Jacobus Verhoeff in 1969, catches all single-digit errors and all adjacent transpositions, plus most of the rarer error patterns (twin errors like 11 → 22, and jump transpositions).
It achieves this by abandoning ordinary addition. Verhoeff works in the dihedral group D5 — the symmetries of a pentagon — where the "addition" operation is deliberately non-commutative: combining a then b gives a different result from b then a. That asymmetry is exactly what lets it notice when two digits trade places. In practice the algorithm is three small lookup tables — a multiplication table, a permutation table applied by digit position, and an inverse table — and validation is a loop of table lookups ending in a comparison with zero. A dozen lines of code, no cryptography, no network.
What validation looks like in a claims pipeline
In an automated document pipeline, Aadhaar validation slots in right after field extraction. OCR reads the number from the card image; the Verhoeff check runs on the digits. Three outcomes matter:
- Valid checksum — the number is structurally genuine. It was either read correctly from a real Aadhaar-format number, or the forger copied a real number rather than inventing one.
- Invalid checksum — either OCR misread a digit (common with worn cards and low-quality photos), or the number was fabricated. Both cases deserve the same response: route to review rather than reject outright, because a re-read at higher resolution often resolves the OCR case.
- Consistency failures — the same Aadhaar number appears twice in the document (printed and inside the QR code, say) and the two do not match. This is a stronger tamper signal than a single failed checksum, because it means someone altered one copy and missed the other.
That last pattern — cross-checking the printed number against the QR/barcode payload on the same card — is one of the most effective offline forgery checks available, since editing an image of a card leaves the machine-readable copy untouched.
The same idea across Indian documents
Aadhaar is not alone. A KYC pipeline can apply structural validation to most Indian identity and financial documents:
- PAN — a fixed 10-character structure (AAAPL1234C) where the fourth character encodes the holder type; structural violations are instant red flags.
- Passport MRZ — the two machine-readable lines carry check digits over the passport number, date of birth, and expiry, validated with a simple weighted sum.
- GSTIN — the 15-character GST number embeds the holder's PAN and ends in a checksum character.
- Vehicle registration, voter ID, IFSC — fixed formats that reject malformed inventions cheaply.
What a checksum cannot tell you
This is the part that gets overlooked. A valid Verhoeff checksum proves the number is well-formed. It does not prove the number was ever issued, that it belongs to the person on the card, or that the card itself is genuine. A fraudster who copies a real person's Aadhaar number onto a doctored card passes the checksum perfectly.
Checksum validation is therefore a filter, not a verdict: it eliminates lazy fabrications for free, and it catches OCR errors before they corrupt downstream records. Establishing that a document is genuine takes the rest of the stack — image forensics, metadata analysis, QR cross-checks, duplicate detection, and where the use case justifies it, online verification against the issuing authority.
The takeaway
A 1969 algorithm built from pentagon symmetries is still one of the cheapest, fastest fraud filters available to any Indian KYC or claims pipeline. It costs nothing to run, works offline, and never produces a false positive on a correctly read genuine number. Every document intelligence system processing Indian IDs should run it — and treat it as the first gate, not the last word.
Techies Universe's Document AI runs Verhoeff, MRZ, GSTIN, and format validation automatically as part of its authenticity scoring for Indian documents. Get in touch to see it on your documents.