New Delhi: Received a text about a pending traffic challan? Do not click on any unidentifiable link. Delhi Police has issued this warning following a surge in fake “traffic challan” messages circulating on WhatsApp and SMS, many of which contain malicious links designed to install malware on users’ phones.
The messages claim that a challan is pending and prod recipients to click on a link—often an attachment titled “RTO CHALLAN.apk”—to make an immediate payment. Police said these are phishing scams designed to install malware, take remote control of victims’ phones and drain their bank accounts.
Several residents across the city reported receiving such messages in recent days. The alerts typically mention a specific challan amount and even include the recipient’s vehicle registration number to appear authentic. “Fearing heavy fines, many people click on the link, which results in their phones being hacked. Fraudsters then gain remote access, putting victims at serious risk of financial loss,” a senior police officer said.
Officers clarified that Delhi Traffic Police never issue challans through APK files, external links or unidentified messages. Traffic violations captured on CCTV cameras are communicated only through official SMS alerts, which carry verifiable sender codes. Any message coming from a personal number or lacking proper govt or police identifiers should be treated with suspicion.
Another officer said police have already received complaints from people who were duped into downloading the malicious APK. “Fraudsters are sending SMSes that look official, but citizens must check the sender code carefully. No traffic police unit, bank or govt agency sends APK links on SMS or WhatsApp,” he stressed.
Police said citizens are advised to verify challans only through the official Parivahan portal or the Delhi Traffic Police website.
Anyone who may have accidentally downloaded or installed a suspicious file should immediately switch their phone to airplane mode, delete the file, reset the device and change all passwords using a secure phone. Users have also been advised to keep the “installation from unknown sources” setting disabled, enable Play Protect and report any suspected cyber fraud to the 1930 cyber helpline or on cybercrime.gov.in.
