September 25, 2026 - 7 min read

By PhishClean Research Team

Fake e-Challan Messages: How India's Traffic-Fine Scam Steals Cards, OTPs and UPI PINs

A text says your vehicle has an unpaid traffic fine and your licence will be suspended. The link opens a page that looks like the government portal. It is one of the most common scams in India this year, and it comes in two forms: a fake payment page that steals your card, and a fake app that takes over your phone.

Fake e-Challan messages have been circulating across India since late 2025 and are still active. Cyble Research and Intelligence Labs found more than three dozen fake e-Challan websites in a single campaign. CYFIRMA and other researchers have taken apart the Android apps that ship alongside them. CERT-In, India's national cyber-security agency, has warned people not to install APK files that arrive over SMS, WhatsApp or Telegram.

Version 1: the fake payment page

The message warns of an unpaid fine and a looming licence suspension or court case, then gives a shortened link. The page behind it copies the look of the Regional Transport Office or Parivahan site and shows a "violation" with a small penalty. Cyble saw amounts like ₹590, low enough that people pay rather than argue.

The giveaway is the payment step. The real portal offers UPI and net banking. The fake pages Cyble documented accept only credit and debit cards, because the goal is your full card number, expiry date and CVV. The same criminal infrastructure also hosted fake pages for courier companies (DTDC, Delhivery) and a bank.

Version 2: the "RTO Challan" app

The second version asks you to download the challan receipt or an official app. The file has a name like RTO Challan.apk, RTO E Challan.apk or even MParivahan.apk. CYFIRMA's analysis of one sample found a two-stage dropper. The first app looks harmless, then asks you to tap "Install Update", and that installs the real payload, which runs hidden in the background. It asks for SMS and phone permissions so it can read your one-time passwords as they arrive. Its fake challan screen asks for Aadhaar, PAN, date of birth, card number, CVV, ATM PIN, net banking login and UPI PIN, supposedly to verify a ₹1 fee.

How to check a challan safely

• Type the address yourself. The official portal is echallan.parivahan.gov.in. Real Indian government sites end in .gov.in. Don't use the link in the message.
• Search by vehicle number on the real site. If a fine exists, it will be there. If it isn't there, the message was fake.
• Watch the payment options. A "government" page that only accepts cards is a red flag.
• Never install APKs from messages. Install apps only from the Play Store, and check the publisher.
• Never type a UPI PIN or OTP to "receive" or "verify" anything. A UPI PIN is only for sending money.

If you already paid or installed the app

Move quickly. Call your bank to block the card and dispute the charge. If you installed an APK, turn off mobile data and Wi-Fi, uninstall the app, then change your net banking password and UPI PIN from a different, clean device. Report it on the national helpline 1930 or at cybercrime.gov.in. Our step-by-step guide, I clicked a phishing link (India), goes through this in order.

What PhishClean checks on these pages

PhishClean 1.3.0 added a check for Indian scam pages. It flags a page that follows a known scam script (a traffic e-challan, KYC update, electricity disconnection, held parcel, tax refund or reward points) and asks for card, UPI or OTP details on a site that isn't the real bank or government service. It runs inside your desktop browser, on Chrome, Edge, Brave and Firefox, and never sends the pages you visit anywhere. It can't stop an APK on your phone, so the rule above still applies: no app installs from a text message.

Sources

• Cyble via IT Voice: nationwide phishing scam targets Indian motorists via fake e-Challan portals
• CYFIRMA: RTO Challan fraud, a technical report on APK-based financial and identity theft
• The Cyber Express: CERT-In warns of Android malware campaign using eChallan and RTO Challan scams

Last updated: 25 September 2026