# Fake e-Challan messages: how India's traffic-fine scam steals cards, OTPs and UPI PINs

> Fake e-Challan texts send Indian drivers to lookalike Parivahan pages and "RTO Challan" APKs. How it works, the red flags, what to do if you paid.

Canonical: https://www.phishclean.com/blog/fake-e-challan-scam-india-2026
Last updated: 2026-09-25

September 25, 2026 - 7 min read

By [Chidambaram](https://www.phishclean.com/author/chidambaram), founder of PhishClean

A text says your vehicle has an unpaid traffic fine and your licence will be suspended. The link opens a page that looks like the government portal. It is one of the most common scams in India this year, and it comes in two forms: a fake payment page that steals your card, and a fake app that takes over your phone.

Fake e-Challan messages have been circulating across India since late 2025 and are still active. Cyble Research and Intelligence Labs found more than three dozen fake e-Challan websites in a single campaign. CYFIRMA and other researchers have taken apart the Android apps that ship alongside them. CERT-In, India's national cyber-security agency, has warned people not to install APK files that arrive over SMS, WhatsApp or Telegram.

## Version 1: the fake payment page

The message warns of an unpaid fine and a looming licence suspension or court case, then gives a shortened link. The page behind it copies the look of the Regional Transport Office or Parivahan site and shows a "violation" with a small penalty. Cyble saw amounts like ₹590, low enough that people pay rather than argue.

The giveaway is the payment step. The real portal offers UPI and net banking. The fake pages Cyble documented accept **only credit and debit cards**, because the goal is your full card number, expiry date and CVV. The same criminal infrastructure also hosted fake pages for courier companies (DTDC, Delhivery) and a bank.

## Version 2: the "RTO Challan" app

The second version asks you to download the challan receipt or an official app. The file has a name like *RTO Challan.apk*, *RTO E Challan.apk* or even *MParivahan.apk*. CYFIRMA's analysis of one sample found a two-stage dropper. The first app looks harmless, then asks you to tap "Install Update", and that installs the real payload, which runs hidden in the background. It asks for SMS and phone permissions so it can read your one-time passwords as they arrive. Its fake challan screen asks for Aadhaar, PAN, date of birth, card number, CVV, ATM PIN, net banking login and UPI PIN, supposedly to verify a ₹1 fee.

No government department sends traffic fines as an APK file. If a message asks you to install an app to see or pay a challan, it is a scam.

## How to check a challan safely

- **Type the address yourself.** The official portal is *echallan.parivahan.gov.in*. Real Indian government sites end in *.gov.in*. Don't use the link in the message.
- **Search by vehicle number on the real site.** If a fine exists, it will be there. If it isn't there, the message was fake.
- **Watch the payment options.** A "government" page that only accepts cards is a red flag.
- **Never install APKs from messages.** Install apps only from the Play Store, and check the publisher.
- **Never type a UPI PIN or OTP to "receive" or "verify" anything.** A UPI PIN is only for sending money.

## If you already paid or installed the app

Move quickly. Call your bank to block the card and dispute the charge. If you installed an APK, turn off mobile data and Wi-Fi, uninstall the app, then change your net banking password and UPI PIN from a different, clean device. Report it on the national helpline **1930** or at *cybercrime.gov.in*. Our step-by-step guide, [I clicked a phishing link (India)](https://www.phishclean.com/help/clicked-a-phishing-link-india), goes through this in order.

## What PhishClean checks on these pages

PhishClean 1.3.0 added a check for Indian scam pages. It flags a page that follows a known scam script (a traffic e-challan, KYC update, electricity disconnection, held parcel, tax refund or reward points) and asks for card, UPI or OTP details on a site that isn't the real bank or government service. It runs inside your desktop browser, on Chrome, Edge, Brave and Firefox, and never sends the pages you visit anywhere. It can't stop an APK on your phone, so the rule above still applies: no app installs from a text message.

## Sources

- [Cyble via IT Voice: nationwide phishing scam targets Indian motorists via fake e-Challan portals](https://www.itvoice.in/cyber-alert-nationwide-phishing-scam-targets-indian-motorists-via-fake-e-challan-portals)
- [CYFIRMA: RTO Challan fraud, a technical report on APK-based financial and identity theft](https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/)
- [The Cyber Express: CERT-In warns of Android malware campaign using eChallan and RTO Challan scams](https://thecyberexpress.com/android-malware-campaign-rto-challan/)

[Clicked a scam link? (India)What to do in the first hour.](https://www.phishclean.com/help/clicked-a-phishing-link-india) [PhishClean 1.3.0Detection for common Indian scam pages.](https://www.phishclean.com/blog/whats-new-phishclean-1-3-0) [Check a suspicious linkInspect a destination before opening it.](https://www.phishclean.com/check-link) [Protect your parents from scamsThe conversations that actually help.](https://www.phishclean.com/blog/protect-elderly-parents-from-online-scams)

## A second opinion before you type your card number

PhishClean warns when a page follows a known Indian scam script and asks for card, UPI or OTP details on an unofficial site.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 25 September 2026