Fake e-Challan WhatsApp Scam: Check Real Challan Online (2026)

In March 2026, Vinay in Hyderabad received a WhatsApp PDF from an unknown +91 number titled “Traffic-Challan-TG09EH4521.pdf” demanding ₹2,500 for “no helmet, signal jump on 14 Feb 2026” with a payment link ending in .xyz and an “Install Vahan App.apk” attachment. He had not been on the road that day. The instant verification rule for any e-challan in India is this: a real challan only ever lives at echallan.parivahan.gov.in or your state transport portal, never inside a PDF or APK on WhatsApp. Do not click the link, do not install the APK, and do not pay. Verify the challan number directly on the government portal in 60 seconds, then report the scam to the National Cyber Crime helpline 1930 within 24 hours so any debited money can still be frozen.

This is part of a wider family of impersonation frauds documented across RTI Wiki, including the digital arrest scam, fake courier customs scam, electricity bill WhatsApp scam, and fake customer care number scam. The fake e-challan variant is especially dangerous because it exploits the automatic trust Indians place in traffic police notifications.

A genuine e-challan in India has five characteristics that a WhatsApp scam cannot replicate:

• Source: Real challans come via SMS from shortcodes like VK-PARIVA or VM-VAHAN (TRAI-approved sender IDs), or appear on the Parivahan portal — never from a random +91 WhatsApp number.
• Format: A real challan notification contains the challan number, vehicle number, section of MV Act violated, amount, and a link to parivahan.gov.in — not a .xyz or .bit.ly link.
• No APK: No government body sends app installation files via WhatsApp. The genuine mParivahan app is only available on Google Play Store and Apple App Store.
• Amount consistency: Real challan amounts match the Motor Vehicles Act schedule — ₹500 for no helmet (first offence), ₹1,000 for signal jump. Scam amounts are often round numbers like ₹2,500 or ₹5,000 that do not correspond to any MV Act section.

1. Payment destination: Real challans direct you to pay on echallan.parivahan.gov.in or your state portal. Scams redirect to a look-alike UPI ID or third-party gateway.

🟡 Citizen tip , If the WhatsApp message contains an attachment called “Vahan.apk”, “TrafficPolice.apk”, or “Challan_Payment.apk”, it is 100% a scam. The real Parivahan app is listed as “NextGen mParivahan” on the Play Store with 10 million+ downloads and verified developer credentials.

1. Take screenshot of the issue, the conversation, and the receipt or transaction page.
2. Note the exact time and the transaction ID, booking ID, or reference number.
3. Do not delete any chat messages, emails, app history, or notification SMS.
4. Raise the complaint on the official app or portal first (in-app help, grievance email).
5. Escalate to NCH 1915, NCRP 1930, or the regulator only after you have saved proof.

🟡 Citizen tip , Most weekend complaints fail not because the law is weak but because evidence gets lost in the first hour. Photograph everything before you call any helpline.

1. Do NOT click the payment link, do NOT open the APK, and do NOT forward the message to anyone (forwarding helps the scammer harvest more numbers).
2. Open echallan.parivahan.gov.in on a browser. Enter your vehicle number or driving licence number and CAPTCHA. Real challans appear here within 24 to 72 hours of issue.
3. Cross-check on your state portal as well: e.g. echallan.tspolice.gov.in (Telangana), echallan.mahatrafficepolice.org (Maharashtra), traffic.delhipolice.gov.in (Delhi).
4. Take a screenshot of the WhatsApp message showing the sender number, timestamp, and the suspicious URL.
5. Report the WhatsApp number inside the WhatsApp app: long-press the chat, tap “Report”, tick “Block and report” so Meta gets the spam telemetry.
6. File a complaint at cybercrime.gov.in or call 1930 (24×7 cybercrime helpline) with the screenshot. If you already paid or installed the APK, dial 1930 immediately, the golden window for fund freeze is 4 hours.
7. Email [email protected] with the URL so CERT-In can request a takedown under the Information Technology Act 2000 §70B. You can also report via cyberswachhtakendra.gov.in.

The fake e-challan scam is part of a family of impersonation-based WhatsApp frauds that target the automatic trust citizens place in authority. Here is how the major variants compare:

• Full screenshot of the WhatsApp chat showing sender number, profile photo, and message timestamp (use long-screenshot if multi-page).
• The PDF or APK file itself, saved but not opened, for forensic submission.
• Screenshot of the suspicious URL when copy-pasted into a URL inspector such as urlscan.io or virustotal.com.
• Screenshot of the empty result on echallan.parivahan.gov.in for your vehicle number, proving no real challan exists.
• Your vehicle Registration Certificate (RC) front and back.
• Your driving licence front and back.
• Bank or UPI transaction screenshot if any payment was made, showing UTR and beneficiary account.
• Call detail record from your telecom provider for the day, if a follow-up phone call was made by the scammer.
• Aadhaar masked copy for NCRP filing.
• Phone make, model, OS version and a list of installed apps as on the date of incident, in case the APK was installed.

🟡 Trust signal , Bharatiya Sakshya Adhiniyam 2023 Section 63 admits screenshots and email as primary electronic evidence when forwarded to your own email with timestamp preserved.

The single fastest route is the National Cyber Crime Reporting Portal at cybercrime.gov.in or its phone helpline 1930, which is available 24×7 in 11 languages and is run by the Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs. If money was actually debited, 1930 triggers an automated lien-marking request to your bank under the RBI 2017 Master Direction on Limited Liability of Customers, and funds parked in mule accounts can be frozen within 4 hours. For a step-by-step script on what to say when you call 1930, see our 1930 helpline script guide. In parallel, report the URL or phishing domain to CERT-In at [email protected] or cyberswachhtakendra.gov.in for technical takedown under IT Act 2000 §70B. For the WhatsApp number, also file an in-app report so Meta can suspend it under WhatsApp's Acceptable Use policy.

🟡 Most citizens miss this , Consumer court fee starts at ₹100. e-Daakhil online filing needs no lawyer. Median resolution 6 to 12 months. See our e-Daakhil online filing guide.

Tier 1 (in-platform, hour 0 to hour 24): Block and report the WhatsApp number, screenshot everything, run echallan.parivahan.gov.in and your state portal to confirm no real challan exists, alert family on the same WhatsApp group.

Tier 2 (regulator and helpline, hour 24 to day 7): File on cybercrime.gov.in, call 1930 (especially if any payment was made), email CERT-In, and file a separate ticket on pgportal.gov.in (CPGRAMS) tagged to Ministry of Road Transport and Highways for “fraudulent impersonation of e-challan system”.

Tier 3 (FIR and prosecution, day 8 onwards): File a written FIR under BNS 2024 §318 (cheating by personation), §319 (cheating by personation using electronic means), §336 (forgery), read with Information Technology Act 2000 §66C (identity theft) and §66D (cheating by personation using computer resource). For the link itself, request CERT-In to issue a §70B blocking direction.

If your bank account has been frozen as a result of this fraud, see our guides on bank account freeze recovery and bank freeze in cyber fraud cases. If the scam involved a UPI transaction, follow the UPI fraud complaint process for RBI zero-liability reversal.

To: [email protected]
CC: [email protected]
Subject: Fake e-challan WhatsApp scam, number +91[XXXXXXXXXX], IT Act 66D + BNS 318, request for takedown and FIR

Sir / Madam,

I, [Name], aged [Age], resident of [Full Address], wish to report a phishing
attempt by impersonation of the Government e-challan system.

On [Date] at [Time], I received a WhatsApp message from +91[XXXXXXXXXX]
containing a PDF titled "[Filename]" and a payment link "https://[suspicious
URL]". The message claimed a traffic challan of ₹[Amount] was due against
my vehicle [Reg No.]. On verification at https://echallan.parivahan.gov.in
no such challan exists for my vehicle.

The act constitutes:
1. Cheating by personation under BNS 2024 §319.
2. Forgery of electronic record under BNS 2024 §336.
3. Identity theft under Information Technology Act 2000 §66C.
4. Cheating by personation by use of computer resource under §66D.
5. Phishing in violation of Information Technology Rules 2021 Rule 3(1)(b)(ii).

I request:
(a) Registration of FIR.
(b) Direction to the telecom service provider for KYC details of the
    sender number under IT Act §69B.
(c) Blocking of the URL https://[suspicious URL] under IT Act §70B.
(d) Lien-marking of beneficiary account [if payment made: UTR No., Amount,
    Beneficiary Name] under RBI Master Direction on Limited Liability 2017.

All evidence is enclosed: WhatsApp screenshot, PDF file, URL scan report.

Yours faithfully,
[Name]
[Phone] | [Email]
[Date]

To,
The Public Information Officer,
Ministry of Road Transport and Highways,
Transport Bhawan, 1 Sansad Marg,
New Delhi 110001.

Subject: Application under Section 6(1) of the Right to Information Act 2005

Sir / Madam,

Kindly furnish the following information regarding fake e-challan
phishing scams targeting Indian citizens:

1. Total number of fake e-challan scam complaints received by the
   Ministry, NIC, or echallan.parivahan.gov.in helpdesk during financial
   years 2024-25 and 2025-26.
2. The standard operating procedure issued, if any, to State Transport
   Departments for warning citizens against fake WhatsApp e-challans.
3. List of all advisories or press releases issued on this subject in
   the last 24 months, with copies.
4. Action taken on the URL https://[suspicious URL] reported via
   complaint reference [NCRP docket no.], including any §70B blocking
   direction issued via CERT-In.
5. Whether the parivahan.gov.in portal is integrated with WhatsApp
   Business API for genuine challan delivery, and if so the official
   sender ID.

Application fee of ₹10 enclosed via IPO / e-payment.
I am an Indian citizen seeking the information in personal capacity.

Yours faithfully,
[Name]
[Address]
[Phone] | [Email]
[Date]

For help drafting your own RTI application, use the free AI RTI Drafter tool. See also our complete RTI Act 2005 guide for the full legal framework.

A pure phishing scam where you did not pay anything is primarily a criminal matter, not a consumer matter, so the FIR + 1930 route is the one that delivers. However, if the fraud succeeded and your bank delayed reversal of an unauthorised debit beyond the 10-day window mandated by RBI's Master Direction on Limited Liability of Customers (RBI/2017-18/15), you have a parallel consumer claim against the bank for deficiency in service under Consumer Protection Act 2019 §2(11). District Consumer Commission jurisdiction applies up to ₹50 lakh, filing fee is ₹100 to ₹500, e-Daakhil at edaakhil.nic.in is fully online, and the typical timeline is 6 to 12 months. The Supreme Court in Avtar Singh v. State of Punjab (2017) 8 SCC 471 affirmed that electronic-record offences under the IT Act are cognisable, and Shreya Singhal v. Union of India (2015) 5 SCC 1 confirms intermediary obligations under §79 of the IT Act.

For the full e-Daakhil filing process, see our e-Daakhil online filing guide and how to file in consumer court. For banking-specific escalation, use the banking ombudsman complaint guide or the RBI complaint against bank guide.

🟡 Do this immediately , Disable UPI auto-debit and reduce per-transaction limit to ₹1 the moment a financial dispute opens. Restoring later takes 24 hours; preventing further loss takes 30 seconds.

• 🛡️ Weekend Problem Solver — 15 emergency topics hub
• 🛡️ Citizen Crisis Response Network — 100 guides
• 🏦 Banking Ombudsman + RBI complaint route
• 🏦 RBI complaint against bank — full process
• 🛂 Digital arrest / fake notice scam
• ☎️ Fake customer-care number scam
• ⚖️ Consumer court e-Daakhil filing route
• 📚 RTI application format and full guide
• 🪄 AI RTI Drafter — free tool
• 📬 PIO Reply Checker
• 📞 1930 Cyber fraud helpline script
• 🔒 Digital arrest scam recovery
• 💳 UPI fraud complaint and RBI zero liability
• ⚡ Electricity bill WhatsApp/SMS scam
• 📦 Fake courier customs scam

Login to RTI Wiki to download the printable PDF checklist (8-step printable summary) for this article.

Open echallan.parivahan.gov.in, enter your vehicle number or driving licence number with the CAPTCHA, and the portal lists every genuine challan against you nationwide. Most state police forces also run their own portals, e.g. traffic.delhipolice.gov.in for Delhi. Real challans never come as a PDF or APK on WhatsApp. For a broader guide on verifying government dues, see our RTI Act 2005 complete guide.

The risk is that the link may have been a credential-harvesting page or may have triggered a silent APK download. Immediately disconnect the phone from Wi-Fi and mobile data, run an antivirus scan (Lookout, Bitdefender, Kaspersky), check Settings then Apps for any unfamiliar app installed in the last 24 hours, and change your UPI PIN, banking password, and Gmail password from a different trusted device. Also watch for SIM swap fraud symptoms if the scammer captured your phone number during the session.

Power the phone off, take it to an authorised service centre for a factory reset, do not just delete the app because banking-trojan APKs install hidden services. Call 1930 immediately for any UPI or banking debit alerts, freeze your debit card via netbanking, and file an NCRP complaint citing IT Act 2000 §66 and §66D. Avnish Bajaj v. State (2008) 150 DLT 769 establishes intermediary liability for hosting malicious files. See also ATM fraud recovery and bank account freeze recovery if your account was compromised.

You cannot trace it directly, but the police can. Once you file an FIR or NCRP complaint, the investigating officer can issue a notice under Bharatiya Nagarik Suraksha Sanhita 2024 §94 (formerly CrPC §91) to the telecom service provider for the KYC details linked to that mobile number. WhatsApp itself only stores message metadata, not content, but the phone number's KYC is with the telco.

If you report the unauthorised transaction to your bank within 3 working days, RBI's 2017 Master Direction on Limited Liability fixes your liability at zero. Between 4 and 7 days, liability is capped at ₹5,000 to ₹25,000 depending on account type. Beyond 7 days, the bank's board-approved policy applies. Always file a parallel NCRP complaint and call 1930 within 4 hours for fund-freeze. For the full process, see our UPI fraud complaint guide and failed transfer refund guide.

BNS 2024 §318 is plain cheating, §319 is cheating by personation (pretending to be someone else, like the traffic police), and IT Act 2000 §66D is cheating by personation using a computer resource (PDF, link, app). The same act of sending a fake e-challan PDF can attract all three sections together, with §66D carrying up to 3 years imprisonment plus fine.

No. Do not reply, do not say “stop”, do not type “wrong number”, do not call back. Any response confirms your number is active and gets you sold to other scam farms. Long-press the chat in WhatsApp, tap “Report and Block”, which silently sends the last five messages to Meta's Trust and Safety team and removes the chat from your view.

Both use WhatsApp/SMS and impersonate a government authority, but the e-challan scam sends a PDF with a vehicle number and payment link, while the electricity bill scam typically threatens disconnection unless you install AnyDesk or pay via UPI immediately. The e-challan variant is harder to detect because vehicle numbers in the PDF look real — always cross-check on echallan.parivahan.gov.in.

This is a hybrid scam combining the fake e-challan with a digital arrest or intimidation tactic. The scammer may claim to be a police officer or transport official on video call, show a fake ID card, and demand immediate payment to “cancel the warrant”. This is extortion under BNS 2024 §308(2). Do not stay on the call — hang up immediately, screenshot the call log, and report to 1930. See our digital arrest scam India guide for the full rescue protocol.

Yes. The Ministry of Home Affairs' Indian Cybercrime Coordination Centre (I4C) regularly issues advisories on WhatsApp-based phishing scams via Press Information Bureau (PIB) press releases. The Cyber Swachhta Kendra also publishes bulletins on malicious APK campaigns. Always verify advisories at the official .gov.in domain — scammers create fake “advisory” pages that look official but contain malware.

The fake e-challan WhatsApp scam is the 2026 successor to the fake courier and fake bank-KYC frauds, and it works because Indians have been trained over a decade to take government dues seriously. The Citizen Crisis Response Network's playbook is built for exactly this moment: pause for 60 seconds, verify on echallan.parivahan.gov.in, and dial 1930 if anything has already gone wrong. RTI Wiki's editorial team tracks every new scam variant and updates this guide as the URLs and APK names mutate. Share this article in every family WhatsApp group. The forwarded message that warns is the one that protects.