These reports were obtained by Lighthouse Reports, a non-profit investigative newsroom based in Utrecht, The Netherlands, through more than 40 Freedom of Information (FOI) requests to the EU Commission, the UK and individual EU member states. These were collaboratively investigated by media partners across 11 countries, including The Indian Express in India, Der Spiegel in Germany and Le Monde in France. FOI is a legal framework similar to Right To Information (RTI) Act in India.

The Indian Express scrutinised all inspection reports, tracked the financial footprint of VFS Global, and interviewed nearly 150 applicants at its visa centres in Delhi and Mumbai. Records reveal that EU member states, in their inspections that included a field visit to India, flagged a range of concerns: how applicants’ personal and biometric data is stored on unencrypted discs, its transport and handling; widespread “visa shopping”, mainly by travel agents, in which Schengen visas were obtained from an EU nation, which typically offers faster approval, to reach another member state; and, unclear communication, even “lapses,” in informing applicants that value-added services (VAS), such as premium lounge access, are optional and have no link to visa approval.

People wait in a queue in front of the Trade Centre building where the office of VFS Global is located. (Express photo by Sankhadeep Banerjee)

VFS Global has rejected the allegations and said that its operations are “subject to rigorous and continuous government oversight” (see adjacent story).

Responding to queries from Lighthouse Reports, the European Commission said it has announced in the recently adopted EU Visa Policy Strategy that the “growing reliance by Member States on ESPs (External Service Providers) to handle parts of the visa process calls for improved quality control and monitoring”.

The key findings of the investigation:

• Fake VFS appointments were found to be sold by travel agents, alongside fake employment contract letters used to support national work visa applications.
• At the Swiss mission in New Delhi, passports that were sent back in 2020 were still found with VFS.
• Fee reimbursements to applicants incorrectly charged by VFS were found to be mishandled — so much so that Swiss auditors wrote: “This does not work at all.”
• A 2024 Schengen evaluation of VFS Global’s India operations, with Germany and Poland, noted that the company’s services were not compliant with EU’s GDPR (General Data Protection Regulation) which govern security of data including tax and financial details.

The reports also note remedial measures undertaken by VFS Global in several cases.

Luxembourg: Insecure data, fake appointments

The Embassy of Luxembourg, which works with 13 visa application centres across India, all operated by VFS Global, raised some of the most detailed concerns. The Embassy, however, also disclosed that it had signed a new three-year contract with VFS for 2024 to 2027, in which the only update from the previous agreement related to personal data protection rules.

Inspection findings from 2022, published in an implementation report in 2023, flagged that the biometric identifiers of applicants were being saved on unencrypted compact discs for transfer from VFS offices to consulates, while scanned application documents were saved on a separate disc. VFS was also found to be sending biometric data over open, unencrypted email when errors occurred during collection or transmission.

Auditors found that compact discs containing scanned applications, supporting documents and biometric data were not being destroyed frequently enough, despite a CD shredder being available on the premises. CDs with application data older than 18 months were recovered.

A 2024 New Delhi inspection report underlined problems of fake VFS appointments and “visa shopping”, mainly by travel agents. On fake appointments, the Embassy considered the matter outside VFS India’s direct responsibility but noted a significant increase in 2024. The inspection report stated: “These fake appointments are usually sold by unscrupulous travel agents. Simultaneously, from June 2024 onwards, the Embassy has observed a considerable increase in fake employment contract letters that agents are selling to applicants in order to apply for a national work visa.”

On visa shopping, the report said, “VFS monthly reports consistently reveal high rates of no-shows, particularly in Ahmedabad, Chandigarh and Jalandhar (sometimes 50% and above) and the Embassy still detects files created to fit Luxembourg as a destination when the real main destination is clearly another MS (Member State).” It pointed the finger at travel agents, saying VFS Global was not to blame directly for this practice.

Sweden: competitor on same floor in Mumbai

The Swedish mission’s spot-check of the VFS office in Mumbai in 2023 produced a 19-page report raising two concerns. The first was that Vasco, another visa services company, was found to be operating on the same floor. Auditors noted that “VFS have been informed that they need to take further measures to separate them from Vasco and make clear for applicants that Vasco is an independent company, not related to VFS”. Vasco has since shifted out.

The second observation concerned applicant privacy. The application counters were linked together and separated only by low dividers, meaning that while applicants could not see each other’s documents, their conversations with VFS staff were not private, the report noted.

By 2025, the Swedish mission’s inspection of the Mumbai office found compliance across 14 of 15 assessed categories. The single failing was on value-added services (VAS). The 24-page report stated: “VFS must mention VAS services as optional and this information must be clearly visible to the applicant. VFS must mention that their service is optional and not an obligation. Information must also be updated on their website.”

The seven VAS categories listed were: prime time, premium lounge, extended hours passport collection, hub city passport collection, call-back service, courier fees and SMS. When auditors asked whether it was clear to applicants that these services were optional, the response was: “The information is visible however it is not displayed clearly. A suggestion from the mission is to have a disclaimer outside the premium lounge about the same.”

Switzerland: passports from 2020, fee refund glitch

The Swiss mission’s 2023 inspection of VFS’s New Delhi office produced a compliance table covering 33 areas of operations. VFS was found non-compliant in six. Among the shortfalls: VFS had not made available the factsheet on “Schengen and personal data” at application counters or on its website, and had not submitted an annual list of additional services it provides, such as photocopies and courier services, nor verified whether the charges for these were in line with local rates.

The inspection also found passports at the VFS office that had been sent back in 2020 but never returned. The report was blunt: “We do not think that there are enough safes for the high season. It is also observed that the passports which were sent back as long as in 2020 were still with VFS.”

A 2025 report from the Hungarian consulate referenced a 2021 on-site inspection of VFS Global in New Delhi, during which auditors found that applicant data older than one month was still accessible in the VFS system.

Under the Schengen visa code, such data must be deleted no later than seven days after transmission. VFS staff were reminded of this requirement during the inspection. The report notes that the problem was subsequently resolved with assistance from Hungary’s IT team, and that “data retention rules are fully respected now”.

With Sarasvati Thuppadolla,  investigative reporter at lighthouse reports