Fake E-Challan SMS: How Scammers Know Your Vehicle Number, and How to Check in 30 Seconds
The fine is invented. The vehicle number in it is not. Here's where that number comes from, and the one check that settles it.
Short answer: If a challan SMS comes from an ordinary mobile number and asks you to tap a link, treat it as fake. Real reminders arrive under the mParivahan sender name and carry no payment link, and government sites end in .gov.in. Check for yourself by typing echallan.parivahan.gov.in or opening the mParivahan app. The scam is convincing because it uses your real vehicle number, and that number comes from vehicle registration data that has passed through many hands. In October 2026 reports said it was being sold for as little as ₹5 a lookup.
The misconception: “it has my car’s number, so it must be real”
That’s exactly the point of including it. A random number would get deleted. Your own registration plate, sitting next to a precise-looking fine of ₹2,000 and a long reference code, gets a second look and sometimes a tap.
Two of these reached a member of our team in October. On 14 October: “Violation of traffic challan of INR 2000 generated”, with the correct vehicle number and a link to mparivahan-gov.dnet.hu. On 19 October: “Image logged”, a 21-character reference and a link to 7hm2jd.buzz. The official app showed no such challan. One clue was hiding in plain sight: .hu is Hungary’s domain, and a .buzz address can be bought by anyone for the price of a cup of coffee.
Where your number actually comes from
Every registered vehicle in India sits in VAHAN, the transport ministry’s database. A record links the plate to the owner’s name, address and mobile number. That’s the pairing a scammer needs.
The data has never stayed in one room. In July 2019 the then transport minister told the Rajya Sabha that the ministry had given 87 private and 32 government entities access to VAHAN and SARATHI (the driving-licence database) and earned about ₹65 crore. Data shared then doesn’t come back. Plates are also looked up every day by dealers, insurers, RTO agents and third-party “vehicle info” apps.
In October 2026 reports said owner details could be pulled from a plate number on Telegram for as little as ₹5. The ministry responded by asking CERT-In, the government’s cyber-security agency, to run a forensic audit of four portals: VAHAN, SARATHI, e-Challan and PUCC. It also asked app stores to remove apps misusing the data. The audit has been ordered and no findings have been published.
The twist: nobody can tell you where your data leaked
The honest answer is that nobody knows yet, not you and not the ministry, which is why there’s an audit. In our team member’s case, the first fake arrived four days before a routine pollution check, so the obvious suspect was ruled out by the calendar.
Fortunately, the fix doesn’t depend on solving the mystery. A scam needs one thing from you after it has your number: the tap.
What happens if you tap
- A fake portal dressed as a government page asks for a card number, UPI PIN or OTP “to pay the fine”.
- An APK download, an app installed from outside the Play Store, which can read your SMS and the one-time passwords inside them. Kerala Police issued a specific warning about this version in September 2026.
What to actually do
- Never tap a link in a challan SMS, however accurate the details look.
- Check yourself: type echallan.parivahan.gov.in into the browser, or open the official mParivahan app, and search by vehicle number.
- Never install an APK that arrives in a message, whoever it claims to be from.
- Report the SMS on Sanchar Saathi’s Chakshu facility. Your telecom network may already flag it as spam; both of ours were labelled “SPAM” on arrival.
- If money has gone, move within minutes: call 1930, file at cybercrime.gov.in, and ask your bank to block the card or UPI.
The real fine, if there ever is one, will still be on the official site tomorrow. The fake one only works if you hurry.
Take action
Sources
- Ministry of Road Transport and Highways — CERT-In forensic audit of VAHAN, SARATHI, e-Challan and PUCC portals over vehicle-data sale reports (as reported by The420.in and NewsBytes, October 2026)
- Nitin Gadkari, written reply in the Rajya Sabha, 8 July 2019 — VAHAN/SARATHI bulk data access to 87 private and 32 government entities, about ₹65 crore earned (as reported by The Quint and MediaNama)
- Kerala Police — warning on malicious APK files sent via fake e-challan SMS (ThePrint, September 2026)
- Indian Cyber Crime Coordination Centre (I4C) — advisory on e-challan phishing (via Republic World)
- Department of Telecommunications — Sanchar Saathi / Chakshu fraud-communication reporting
How do I know if a traffic challan SMS is fake?
Look at the sender and the link. Official reminders from the Ministry of Road Transport and Highways arrive under the mParivahan sender name, can't be replied to, and don't carry a payment link. A fake one comes from an ordinary mobile number and asks you to tap a link. If the link's address doesn't end in .gov.in, it isn't a government site.
How do scammers know my vehicle number and phone number?
Vehicle registration data, including the owner's name, address and mobile number, sits in the government's VAHAN database, which many organisations have been allowed to access. In 2019 the government told Parliament it had given 87 private and 32 government entities access and earned about ₹65 crore. In October 2026 reports said owner details were being sold on Telegram for as little as ₹5 per number, and the transport ministry ordered a CERT-In audit of four portals. Exactly where any one person's data leaked from is not known.
How do I check if a challan against my vehicle is genuine?
Type echallan.parivahan.gov.in into your browser yourself, or open the official mParivahan app, and search by your vehicle number. If the challan isn't there, the SMS was fake. Never use a link from the message to check.
What happens if I click the link in a fake challan SMS?
Usually one of two things: a fake government-looking page asks for your card number, UPI PIN or OTP, or you're asked to download an APK file, an app from outside the Play Store that can read your SMS and one-time passwords. Kerala Police warned about the APK version in September 2026.
What should I do if I paid a fake challan?
Call the national cybercrime helpline 1930 immediately, file a complaint at cybercrime.gov.in, and tell your bank to block the card or UPI. Speed matters: the sooner it's reported, the better the chance of freezing the money.
Are Cancer Medicines Getting Cheaper in India? Yes, From 9 November — If You Check
The government has capped what middlemen can add to 137 cancer drugs. Prices should fall 20 to 70% from 9 November. Almost nobody paying for chemotherapy has heard about it.
The WhatsApp 'Reply NO' Scam: No OTP, No Link — Here's What Actually Takes the Money
Hyderabad Police warn of WhatsApp messages that say money has left your account and ask you to reply NO. There's no OTP and no link. The panic does the work. Here's the one rule that beats it, the settings that help, and the 3-day RBI window if money does go.
Cattle Feed in Biscuits, Detergent in Milk: What FSSAI Found, and 4 Checks You Can Do at Home
In one week, India's food regulator moved to prosecute a biscuit maker over cattle-feed bran, a dairy over detergent in milk, and a raisin seller over pesticides. Ahmedabad sealed a 'ketchup' unit that used no tomatoes. The case that started it all began with one shopper's complaint.