E-Challan APK Scam: Real Challan or Malware, and What to Do

A WhatsApp message with your car’s number, a “pending challan” of a few thousand rupees and a file called RTO Challan.apk is the e-challan APK scam, and the file is the attack. A real traffic challan never needs you to install an app from a chat. You can check whether a fine actually exists in two minutes on the government portal, without touching the message at all.

If you have already tapped the file and installed it, the order of what you do next matters more than anything else in this guide. Go straight to the section headed “If you installed it”.

Last checked: 13 November 2026, against the CERT-In advisory, the eChallan portal and the other official pages linked below.

What the official warnings say, by date

Two government bodies have warned about the same campaign three times this year. Their details line up, which is useful when a forwarded message claims to be “new”.

CERT-In’s advisory is the most detailed of the three. It says the message usually reads something like “Your vehicle challan has been generated, download the receipt from the link below”, with the APK attached or linked.

How the fake app takes over the phone

The CERT-In advisory describes a two-step install, and the second step is what catches people.

1. The APK you install first is only a “dropper”. It sits in the app drawer looking harmless.
2. When you tap “Install Update” inside it, the real malware installs. That second app does not appear in the phone’s app list.
3. It asks for SMS and phone-call access, permission to run in the background and permission to set up a VPN connection, which lets the attacker watch the phone’s internet traffic.
4. It shows fake screens asking for banking or card details. Because it can already read SMS, the OTPs your bank sends go to the attacker’s server.

So deleting the visible “e-Challan” icon may not be enough. The app that does the damage is the one you cannot see.

How to check if the challan is real

Do not use any link, button or file in the message. Open a browser and type the address yourself.

• eChallan portal: go to echallan.parivahan.gov.in and use the pay or check challan option. Odisha’s transport department explains the lookup: enter the challan number, or the vehicle number with the chassis number, plus the captcha.
• NextGen portal note: the eChallan portal currently tells owners from many states, including Karnataka, Maharashtra, Tamil Nadu, Uttar Pradesh, Kerala, West Bengal, Rajasthan, Gujarat and Andhra Pradesh, to check and pay on its NextGen eChallan portal. Follow that link from the portal itself, not from a message.
• The official app: the government app is NextGen mParivahan, published on Google Play by the National Informatics Centre, with more than 5 crore downloads. Any “mParivahan” that arrives as a file in a chat is not it.

A quick way to judge the message you received:

If the portal shows no challan for your vehicle, the message was fake. If it does show one, pay it there, not through the message.

If you installed it

Work through these in order. CERT-In’s advisory lists the first steps; the money steps come from the rules on bank fraud.

1. Cut the connection. Turn off mobile data and Wi-Fi so the app cannot send more OTPs or data out.
2. Call your bank first if money may be at risk. Use the number printed on your card or passbook, or the bank’s official app on another phone, and ask them to block cards, net banking and UPI. Under the RBI’s circular Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions of 6 July 2017, how fast you report decides how much of a loss you may have to bear; our guide to unauthorised transaction liability sets out the three-day and seven-day limits.
3. Report the fraud. If money has already gone, call 1930 or file on cybercrime.gov.in straight away. Our 1930 complaint guide walks through it.
4. Remove the apps. In Settings, then Apps, uninstall the “e-Challan” app and anything else you do not recognise, as CERT-In advises. Then open Google Play, tap your profile, open Play Protect and run a scan. Google says Play Protect can disable or remove harmful apps from outside the Play Store.
5. Change credentials from a clean device. Reset your UPI PIN, net banking password and email password. CERT-In’s list includes changing the UPI PIN.
6. Check statements for a few weeks. Look for small test debits as well as large ones, and report each one.

If the hidden app keeps coming back, or the phone keeps showing permission requests you did not trigger, stop using it for banking until a service centre has reset it.

Report the message even if you lost nothing

Reporting helps block the number before it reaches someone else.

• Chakshu on Sanchar Saathi: the Department of Telecommunications’ Chakshu facility takes reports of suspected fraud calls, SMS and WhatsApp messages, including impersonation of government officials. It asks for reports within 30 days. Our Chakshu guide covers the form.
• Report Suspect on cybercrime.gov.in: the National Cybercrime Reporting Portal lets you report a website URL, WhatsApp number or SMS header as a suspect identifier.

Do not forward the file to friends “as a warning”. CERT-In asks recipients to delete it and block the sender instead.

Why turning off unknown-app installs helps

CERT-In tells Android users to keep “Install from unknown sources” off and turn it on only for a trusted source when there is no other way. With it off, a file from WhatsApp cannot install without you deliberately changing a setting first, which is a moment to stop and think. It also says never to grant Accessibility access to an app you do not know, the same permission abused in screen-sharing fraud.