Fake RTO e-challan websites in India are tricking drivers with small fines and stealing card details

Scam

A large online scam is targeting people who own vehicles in India. Cybersecurity company Cyble found more than 36 fake websites that look exactly like the real RTO e-Challan portals. These websites are made to fool you into thinking they are government pages, so you enter your personal and banking details without suspecting anything.

Earlier, scammers used fake apps or malware to attack phones. But this time, they don’t need you to install anything. All they need is one click on a link sent through SMS, and you are on their fake website. This makes the scam easier to spread, and harder for normal people to identify.

To make the messages feel genuine, the SMS is sent from an Indian number registered with Reliance Jio. The same number was also found linked to a State Bank of India account. Because the phone number and bank name feel familiar and trusted, many people assume it must be real. That is exactly what scammers want.

The SMS message creates fear so you act fast

The scam starts with an SMS saying you have a pending traffic fine. The fine amount is kept small, usually around Rs 590, so it doesn’t shock you. The message also gives a short deadline, like “Pay within 24 hours” or “Expires soon”. Then come the threats: your driving licence could be suspended, or you may get a court notice or legal action.

The link in the SMS looks like a real government e-Challan link, or sometimes it’s shortened so you can’t see the full website name. Once you click it, you land on a page that looks just like the real government site. It has the same logos, colours, and even government symbols like MoRTH and NIC. Everything is copied to make you trust the page.

The moment you enter your vehicle number, the website instantly shows you a fake challan record, even if no fine exists in real life. There is no checking happening in the background. It’s all fake, created to scare you and push you toward payment.

Payment page steals your card details quietly

The most important part of the scam is the payment page. Here, the website only accepts credit or debit card details. There is no UPI, no Google Pay, and no net banking option. This is because UPI payments are easy to track, but card details are not.

When you enter your card number, CVV, and expiry date, the website quietly sends it to the scammer’s system. It even allows you to submit the details again and again, and every time, the data goes straight to the attackers. The page also shows fake messages like “Payment is being processed by Indian banks” to make you feel safe. But nothing is being processed, everything is being stolen.

Cyble also found that the same scam system is being used to target delivery apps and banks. Fake DTDC and Delhivery websites were found using the same design and trick, and some pages even pretend to be HSBC bank payment pages.

How to stay safe from this scam

Protecting yourself is simple if you stay alert. Never click links in SMS messages about traffic fines. If you want to check your challan, open the real Parivahan website yourself and check there. Fake websites often have small spelling mistakes or strange extensions in their names. And if any website forces you to pay only by card, close it immediately.

If you get such messages, report them to cybercrime authorities. This scam works because it creates panic. The best way to beat it is to slow down, double-check, and not trust links that reach you out of the blue.