Fake challan SMS sent from users' own phones: Delhi Police case

On 31 October 2026, Delhi Police announced the arrest of five people in a phishing network that began with one fake traffic challan message. According to reports in The Hans India and The Tribune, the South-West District Cyber Police Station is investigating the case. This post explains how the scheme is reported to have worked and what to do if a challan link reaches you.

What happened. A complainant received an SMS with a link supposedly meant for paying a traffic challan. After he clicked it, an unauthorised transaction of Rs 2.21 lakh was made on his credit card. An e-FIR was registered on 28 November 2025 under BNS S. 318(4), the provision for cheating (The Tribune). Police then linked the case to 544 complaints on the National Cyber Crime Reporting Portal, involving cheated amounts of more than Rs 10 crore, and to more than 3,300 suspicious messages. Bulk SMS activity is reported to have begun around 3 November 2025. These are police allegations; they have not been tested in court.

The unusual part is how the messages were sent. According to The Hans India, the reward-earning app reached a school student through a WhatsApp group, and was found on that student's phone. Reports say that whenever a user redeemed a reward, the screen stayed locked for about 30 seconds. In that time the app sent nine to twelve SMS messages from the user's own phone. The messages carried links about fake challans, delivery-address verification and reward points. Users were paid roughly Rs 1 to Rs 3 per redemption.

Police allege that about Rs 2 crore was paid out to more than 41,000 users linked to the app within three days, through many small transactions. In other words, ordinary phones were used as relays. As a general observation, not a police finding, messages sent from a real personal number can look more believable to the person who receives them than messages from an unknown sender.

The money trail was also layered. According to the reports, the initial trail led to an account at the National Bank of Kuwait, which made it hard to link the money to the suspects. Investigators later traced reward payouts to an account held by a Mumbai-based firm. Police also say the network arranged company documents and current bank accounts for a commission. The Hans India reports that five people were arrested after raids in Mumbai, Lucknow, Delhi, Rajasthan and Punjab, and that a car, 59 debit cards, 15 phones and tablets and other items were recovered.

Why a challan message works. A challan notice creates urgency, the amount looks small, and many people have a vehicle with some dues. The message asks you to act before you think. That is also why you should never settle a challan through a link that arrives by SMS or WhatsApp.

Warning signs. The message comes from an ordinary mobile number rather than a verified sender name. It carries a link that is not the official Parivahan e-challan portal. It gives a deadline or threatens a penalty, or it asks for card details, an OTP or an app download. A challan you cannot trace to a real vehicle number or a real traffic-police notice is a further red flag. A separate sign applies to the app side: an app that pays you small sums for tapping, redeeming or watching, and that asks for permission to send SMS, should be treated as unsafe.

If you clicked a link or entered card details, act in the first hour. First, call 1930, the national cyber fraud helpline run with the Indian Cyber Crime Coordination Centre, and give the amount, the time and the transaction number. Reports on this line go into the central system that alerts banks, so that they may be able to hold the money; speed matters. Second, file the complaint on cybercrime.gov.in and keep the acknowledgement. Third, call your bank or card issuer to block the card and dispute the transaction. Fourth, keep screenshots of the message, the sender number and the link, and do not delete them.

If you installed an app because of such a message, uninstall it, review the permissions it holds, and change the passwords of your banking and UPI apps from a clean device. If you used a reward app of this kind, check your SMS sent folder for messages you did not write; this is useful for you to know and to tell the police.

To check a real challan, type the address of the official e-challan portal yourself or use the Parivahan or traffic-police site or app you already trust. Do not tap a link in a message.

What the law says. The reported FIR invokes BNS S. 318(4), cheating and dishonestly inducing delivery of property. Reports on this case do not name any other sections, so we do not speculate about them. A complaint registered on the portal can be converted into an FIR by the state police. As in any matter, the facts and charges are for the police and the courts; this post is general information, not legal advice.

About this post. Codesnag × VirtualVakil publishes scam-awareness guidance of this kind for individuals, schools and small businesses. If you are unsure whether a message is genuine, do not click it; check it on an official portal, and report it on 1930 or cybercrime.gov.in.

The short rule: a challan is checked on an official portal, never through a link in a message, and a free app that pays you to tap is not free. If money has already left your account, call 1930 at once.