Fake RTO Challan or Vehicle App Sent as an APK through an app

How it looks through an app, the red flags and what to do.

A fake app can be installed from a link, from a file sent on chat or even from a lookalike listing. Once on your phone it can ask for powerful permissions. Fake RTO Challan or Vehicle App Sent as an APK is one of the ways this shows up: A message says you have a pending traffic challan and asks you to install an app file to see it. The app steals SMS and banking details.

What fake rto challan or vehicle app sent as an apk looks like through an app

• A "KYC", "challan" or "bank rewards" app from a link.
• An .apk file sent on WhatsApp or by SMS.
• An app outside the official store that asks for many permissions.

The scammer sends the same text to many numbers or to owners of vehicles whose data is found in leaks. The wording copies an official notice with a challan number, a vehicle number format and a deadline. Because many Indians have actually received a real traffic notice, the message feels familiar. The link either downloads an APK file directly or leads to a page copying a government portal, with a download button.

Red flags to check on the app

• A challan message asks you to install an app file instead of using the official site or app.
• The link ends in .apk or asks you to enable installs from unknown sources.
• The deadline is a few hours and the fine doubles.
• The app asks for SMS and accessibility permissions.
• It asks you to turn off Play Protect.
• The app does not come from the official store listing of the company.

What to do

1. Do not tap the link or install the file.
2. Check challans only through the official transport department site or app, typed or installed by yourself from a store.
3. If you installed it, switch on airplane mode and remove the app, including from accessibility and device admin lists.
4. Do not install it. If it is installed, uninstall it now (Settings, Apps).
5. Open Settings and check Accessibility, Device admin apps and Install unknown apps for anything you do not recognise.
6. Change the passwords of your bank and email from a clean device if the app had access.

Report the fake app to the store it came from and, if money moved, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. Call 1930 and report at cybercrime.gov.in at once.
2. Call your bank through the number on your card and ask to block cards and UPI.
3. Change net-banking and email passwords from a safe device.
4. Save the SMS and the link before deleting them, and consider resetting your phone.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Paste the challan message into Scam check in Safeavio Sentinel to see why it looks risky, and run Link check on the link before opening it. Phone scan lists apps outside a store, shows risky permissions such as accessibility and SMS, and checks settings like unknown sources. Safeavio does not read your messages by itself and cannot tell whether you really have a challan.

Full guide: Fake RTO Challan or Vehicle App Sent as an APK: how it works, signs and what to do. Other channels: SMS, WhatsApp, phone call.

Questions