Do not install an APK sent with a traffic-fine message. Cyble, CERT-In and CYFIRMA have documented fake RTO, e-Challan and mParivahan apps that harvest personal and banking data. Some Android malware can place a transparent accessibility overlay over the real Google Pay PIN screen, record your taps and replay them into the genuine app. Verify a fine by typing echallan.parivahan.gov.in yourself or by using your state traffic-police website or app.
What the fake challan campaign does
Cyble’s 2025 reporting described GhostBat RAT activity distributed through phishing pages and malicious Android packages using RTO, mParivahan and e-Challan themes. The operation targeted 60 banking, UPI, wallet and fintech applications, according to Cyble Research and Intelligence Labs. The sources reviewed do not establish a campaign-wide victim count, total loss or prevalence percentage.
As an Amazon Associate I earn from qualifying purchases.
CERT-In’s advisory dated March 17, 2026 says scam messages commonly claim that a vehicle challan has been generated and attach files named RTO Challan.apk, RTO E Challan.apk or MParivahan.apk. The first application can function as a dropper: an “Install Update” prompt installs the follow-on payload. The malware may request SMS, call, VPN and background-running permissions, hide itself from the app list and forward intercepted one-time passwords to an attacker-controlled server.
Recommended Free Tools
CYFIRMA’s December 11, 2025 analysis found a counterfeit e-Challan app collecting names, phone numbers, dates of birth, Aadhaar and PAN details before asking for a ₹1 “verification” payment. Its card, net-banking and UPI forms were designed to collect credentials. A small payment request is not evidence of legitimacy.
#1 Best Overall
How an overlay can capture a PIN on the real Google Pay screen
The screen may look genuine
The malware abuses Android accessibility or overlay capabilities. A transparent, keypad-like layer is placed above the authentic Google Pay or MobiKwik PIN-entry screen. When you tap digits, the malicious layer records the touch choices and sends equivalent interactions to the genuine application. The payment can complete normally while the attacker learns the PIN.
This is different from a simple imitation website. Seeing the familiar Google Pay interface, app icon or transaction flow does not prove that the phone is uncompromised. An accessibility overlay can leave the real application visible throughout the transaction.
What a UPI PIN is for
Google Pay states: “You must enter your unique UPI PIN to authorize and complete each transaction.” It also states: “You don’t need to enter your UPI PIN to receive money.” Therefore, a request to type a UPI PIN into a message-linked form, to receive a refund, or to complete a ₹1 verification is a fraud warning. Never disclose the PIN to a caller or supposed support representative.
Legitimate and fraudulent challan workflows
| Check | Legitimate process | High-risk signal |
|---|---|---|
| Message source | You navigate to an official government portal or state traffic-police service. | An unsolicited WhatsApp, SMS or Telegram message pressures you to act. |
| Installation | You use an official website or a trusted app distribution channel. | You are told to sideload an APK such as RTO Challan.apk. |
| Payment | The normal government payment flow identifies the challan and amount. | A ₹1 “verification” charge or a form asking directly for a UPI PIN. |
| Permissions | Only permissions relevant to the stated function. | Requests for SMS, calls, VPN, accessibility or persistent background access. |
| Web address | You enter echallan.parivahan.gov.in manually or use a verified state site. | A shortened, lookalike or misspelled domain supplied in a message. |
What to do if you installed an RTO or e-Challan APK
- Disconnect immediately. Turn off mobile data and Wi-Fi to limit command, credential and OTP transmission.
- Remove the malware. Uninstall the e-Challan/RTO app and any unfamiliar app installed after it. In Android settings, revoke accessibility, SMS, call, VPN and other dangerous permissions first if the app resists removal.
- Scan and update. Run a trusted mobile-antivirus or antispyware scan, keep Google Play Protect enabled and install current Android security updates.
- Use a clean device. From a phone you believe is unaffected, change banking and email passwords and reset UPI PINs. Do not use the potentially infected handset to perform those changes.
- Contact your bank. Review account, card and UPI statements, report any unauthorized transaction and ask the bank to block or secure affected services.
- Report the incident. Report financial fraud at cybercrime.gov.in or by calling 1930. Report suspicious activity through Google Pay’s in-app support as well.
If the phone shows unexplained pop-ups, accessibility services you did not enable, missing icons, unusual battery or data use, or OTPs you did not request, keep it offline until it has been checked. A factory reset may be necessary when the malicious app cannot be confidently removed; back up only files you trust and change credentials after the reset.
How to avoid the trap
- Type the official challan address yourself instead of following a message link. CERT-In specifically advises checking echallan.parivahan.gov.in or your state traffic-police website or app.
- Keep “Install from unknown sources” disabled. Do not install APKs delivered through WhatsApp, SMS, Telegram or random websites.
- Reject unexpected requests for Accessibility Services, SMS, call, VPN or unrestricted background operation.
- Keep Android, Google Play Protect and reputable security software updated.
- Close screen-sharing or remote-control apps before opening Google Pay. Google warns that such apps can control a phone and expose card details or OTPs.
- Remember that Google Pay says it never asks you to download or install a third-party app for any reason.
The practical rule
A traffic-fine notice that asks for an APK is enough reason to stop. Check the challan independently, never put a UPI PIN into a form reached from a message, and treat a familiar-looking payment screen as unsafe if an untrusted app has accessibility or overlay control. The absence of a visible fake Google Pay page does not rule out PIN theft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
