Got a Traffic Challan Message on WhatsApp? Check It Before Paying or Installing Any App

A WhatsApp message claiming that you have an unpaid traffic challan can easily create panic, especially when it warns of an outstanding fine and asks for immediate payment. But clicking the attached link or installing an app without verifying the notice could expose your phone and bank account to cybercriminals.

Fraudsters are increasingly using fake e-challan notices, phishing links and malicious Android APK files to target smartphone users. The messages are designed to look like genuine communication from traffic police, an RTO or government transport services.

India's cyber security agency CERT-In has specifically warned about an Android malware campaign impersonating RTO and e-Challan services. Fraudulent files can carry convincing names such as "RTO Challan", "RTO E Challan" or "MParivahan" to make victims believe they are installing an official government application.

The safest response to an unexpected challan message is simple: don't pay through the message itself. Verify the challan independently through an official government platform first.

How the Fake Traffic Challan Scam Works

The fraud usually begins with a WhatsApp or SMS message informing the recipient that a traffic violation has been recorded against their vehicle.

The message may mention a fine and create urgency by warning that the amount must be paid immediately. A link is then provided to view the alleged challan or complete the payment.

In other cases, users may be asked to download an APK file to see the challan details.

The message can look convincing because scammers may copy the names, logos and visual elements associated with transport departments or government services.

CERT-In says malicious applications used in these campaigns can compromise Android devices, steal sensitive financial information and facilitate unauthorised transactions.

Why Installing an Unknown APK Can Be Dangerous

An APK is an application package used to install software on Android devices. APK files themselves are not inherently malicious, but installing one received from an unknown WhatsApp number, SMS or untrusted website carries serious risks.

A fake challan app may ask for permissions that give it access to sensitive functions on the phone.

Once malicious software gains sufficient access, attackers may attempt to collect financial or personal information and use the compromised device to facilitate further fraud.

CERT-In therefore advises users not to install APK files received through WhatsApp, SMS, Telegram or random websites and recommends keeping installation from unknown sources disabled.

Real Victims Have Already Lost Money

This threat is not merely theoretical.

In a recently reported case from Ahmedabad, a 61-year-old trader allegedly lost around ₹5.67 lakh after receiving a traffic-challan message and downloading a suspicious APK file. Police said the man's bank account was subsequently compromised.

Such incidents demonstrate why even a professional-looking challan message should not automatically be trusted.

How to Check Whether a Traffic Challan Is Genuine

Instead of using the link supplied in an unexpected message, open the government's e-Challan service independently and check whether a challan actually exists against your vehicle.

The official e-Challan platform operated under the Ministry of Road Transport and Highways allows users to check pending challans and make payments. The portal itself currently displays a warning about fraudulent websites and mobile applications impersonating e-Challan services.

Official Government e-Challan Portal

You can also verify a challan through the appropriate official state traffic police service where applicable.

Importantly, receiving a challan alert through WhatsApp does not by itself prove that the message is fraudulent. Some authorities use WhatsApp for legitimate challan alerts; for example, Delhi Traffic Police has announced WhatsApp-based challan notifications. The key is to verify independently rather than trusting the message's payment link.

Warning Signs of a Fake Challan Message

Be particularly cautious if a message creates extreme urgency, comes from an unfamiliar personal number, asks you to install an APK file or directs you to an unusual website.

Poor spelling, strange website addresses and requests for unnecessary banking information are additional warning signs.

The government's e-Challan portal warns that users should beware of fraudulent websites and apps and says it does not ask for passwords, OTPs, payment information or sensitive personal details through unsolicited calls, emails, messages or links.

Already Installed a Suspicious Challan APK? Act Quickly

If you accidentally installed an APK received through a suspicious challan message, CERT-In recommends taking immediate precautions.

Disconnect the phone from mobile data and Wi-Fi and uninstall the suspicious application. Run a scan using trusted security software and check your bank statements for unauthorised activity.

You should also change potentially compromised passwords and your UPI PIN where necessary.

If money has already been stolen or you suspect financial cyber fraud, contact your bank immediately and report the incident through the appropriate cybercrime channels.

Don't Let a Challan Message Create Panic

Cybercriminals often succeed because they create urgency. A message claiming that a traffic fine is overdue can push a recipient into clicking a link before checking whether the challan even exists.

That is precisely what users should avoid.

Whenever you receive an unexpected traffic challan on WhatsApp or SMS, do not install an attached APK, do not enter banking credentials on an unfamiliar website and do not make an immediate payment simply because the message threatens consequences.

Instead, independently open the official government e-Challan service, enter the required vehicle or challan information and confirm whether the fine is genuine.

A few minutes spent verifying a traffic challan could prevent a fake ₹500 or ₹1,000 fine from turning into a much larger financial loss.