Explained: How the fake RTO challan scam on WhatsApp can hack your phone and steal your bank details

A new scam is making the rounds on WhatsApp, and it’s catching many unsuspecting users off guard. Several people have reported receiving fake “RTO challan” messages from unknown numbers, claiming that a traffic fine has been issued against their vehicle. The message looks official, complete with a file attachment — but it’s actually a dangerous trap.

According to cybersecurity tipster Abhishek Yadav (@yabhishekhd), opening the attached file can instantly compromise your phone. The message usually contains a file named RTO E Challan.apk or Mparivahan.apk, and once you install it, the malware hidden inside gives hackers remote access to your device. This means cybercriminals can steal your personal data, bank details, and even use your number to send the same scam message to your WhatsApp contacts.

In some cases, users have reported that their WhatsApp accounts were banned after the malware spread through their device. The scam is particularly dangerous because it appears authentic — many people assume the challan is real and click without thinking twice.

Experts warn that any message containing an APK file — especially from an unknown number — should be treated as suspicious. APK files are Android installation packages, and installing them outside official app stores can expose your phone to serious risks like spyware, ransomware, or data theft.