The Rs 5 E-Challan Scam Shows How Cybercriminals Are Weaponising Fear
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
By Sunil Garodia
First publised on 2026-09-14 07:40:27
About the Author
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
A message received on a mobile phone can sometimes look so convincing that the recipient's first instinct is not to question it but to comply with it. That is precisely the danger posed by a new variant of the e-challan scam in which fraudsters are impersonating traffic authorities and attempting to persuade vehicle owners that they have an outstanding traffic penalty. The message appears to contain all the ingredients of an official communication, including traffic police imagery, references to an e-challan, a stated penalty amount and an instruction to make an online payment. What gives the particular message examined by India Commentary away is not one isolated mistake but the combination of several glaring warning signs.
The message tells the recipient that a vehicle has been issued an e-challan of Rs 1,000 for a traffic violation and then claims that the matter can be settled by paying only Rs 5. It describes this as the "LAST CHANCE TO SETTLE" and warns that failure to comply by midnight could result in immediate legal action and seizure of the vehicle. The recipient is then presented with a prominent "Click to OPEN" button and instructed to "PAY NOW". The combination is carefully constructed to make the recipient feel that there is both a serious problem and an extraordinarily easy way to make the problem disappear, provided action is taken immediately.
There is little doubt that the message is designed to exploit the familiarity of the genuine e-challan system. Electronic traffic enforcement is now an established part of everyday life in India, and motorists know that traffic violations can be detected by cameras and that challans can be generated without the driver necessarily being stopped by a police officer. That makes an unsolicited message about a traffic violation inherently plausible. A recipient who knows that a family member, employee or driver may have used the vehicle recently could quite reasonably wonder whether a genuine violation has occurred. The scammer does not have to persuade the victim to believe something extraordinary. The scammer only has to make a legitimate government process appear to be operating through a fraudulent channel.
The official eChallan portal of the Ministry of Road Transport and Highways has itself warned citizens about fraudulent websites and mobile applications impersonating the official system. The portal advises users to access the service through the official website and warns about attempts to obtain sensitive information through fraudulent communications. The existence of this warning is important because it demonstrates that the threat is not merely theoretical. Fraudsters are actively using the identity and appearance of the e-challan system to target motorists.
The extraordinary reduction from Rs 1,000 to Rs 5 is one of the strongest indicators that the message should not be trusted, but the timing of the message makes the deception even more interesting. The SMS arrived on September 12, the very day the National Lok Adalat was being held, providing an unusually convincing backdrop for a fraudulent offer to settle a traffic challan at a drastically reduced amount. The West Bengal State Legal Services Authority had listed a National Lok Adalat for September 12, and traffic challans were among the matters that could attract public attention around such proceedings. A vehicle owner receiving a message on that particular day offering to reduce an alleged Rs 1,000 challan to just Rs 5 could therefore be more inclined to believe that the offer was connected in some way with the day's Lok Adalat proceedings. That appears to be precisely the kind of coincidence a sophisticated scammer could exploit. The Rs 5 figure itself is also psychologically clever because someone who might hesitate before making a Rs 1,000 payment could easily convince themselves that there is little harm in clicking on a link when the alleged payment is only â¹5. The victim may believe that even if the message turns out to be genuine, the easiest course is simply to pay the nominal amount and move on.
That reasoning is dangerous because the Rs 5 may have very little to do with the criminal's actual objective. The purpose of the payment page may be to obtain card information, personal information or other financial details from the victim. The victim may subsequently be asked for an OTP or persuaded to approve a transaction that has nothing to do with the original Rs 5 payment. In other cases, fraudulent websites can attempt to persuade users to download an application or provide permissions that expose their devices or data to further abuse. The initial amount demanded can therefore be deliberately insignificant because the real value to the criminal lies in gaining access to information or persuading the victim to take another action.
The message also demonstrates the importance of recognising urgency as a warning sign. The reference to midnight is not there because traffic enforcement necessarily stops at a particular hour. It is there to create a deadline in the victim's mind. Once a person believes that a legal consequence could follow within a few hours, the natural inclination is to resolve the matter before investigating it. The scammer therefore tries to prevent the most important defensive action available to the victim, which is to stop and independently verify the claim.
This is one of the oldest principles of social engineering, but it remains remarkably effective because it exploits ordinary human behaviour. People are more likely to make mistakes when they are frightened, hurried or embarrassed. A message threatening legal action can create anxiety, while an apparent discount can provide an incentive to act immediately. The two elements work together. The victim is first made afraid of what might happen and then offered a simple solution that requires a single click.
The instruction to "Click to OPEN" is consequently much more significant than it may appear. The recipient is not being asked to independently establish whether a challan exists. Instead, the message is directing the recipient to a website chosen by the sender. If that website is fraudulent, everything the victim sees after clicking can be designed to reinforce the original deception. The page can carry government logos, traffic police imagery, official-looking forms and familiar terminology. Once the victim has accepted the website as genuine, subsequent requests for information may appear perfectly reasonable.
This is why a citizen should never use the link contained in an unsolicited message to verify whether a government demand is genuine. The verification process must begin independently. In the case of an alleged traffic challan, the vehicle owner should open the official eChallan portal separately and check the vehicle or challan details there. If the alleged violation does not appear in the official system, the message can be treated as fraudulent. If a challan does appear, any payment should still be made through the independently accessed official system rather than through the link supplied by the message.
The sender information in the message provides another reason for caution. The communication appears under the name "THIRUMALAI ENGINEE..." rather than an identifiable traffic police or government authority. While the appearance of a sender name is not by itself conclusive evidence of fraud, an alleged government communication arriving under an unrelated or unfamiliar sender identity should prompt immediate verification. People should also understand that logos, names and visual presentation are not proof of authenticity. Modern phishing operations routinely copy the branding of banks, government departments, courier companies and other institutions because familiarity is one of the easiest ways to reduce suspicion.
The broader danger is that citizens have become accustomed to conducting important transactions through links received on their phones. A genuine bank may send a notification, a courier company may send a delivery update and a government department may send an alert. As a result, the mere appearance of a message on an official-looking template no longer feels unusual. Cybercriminals exploit that familiarity by inserting themselves into the same communication environment and making their fraudulent messages resemble the legitimate ones people are used to receiving.
Traffic challans are particularly suitable for this kind of fraud because they combine financial consequences with the possibility of legal consequences. Most vehicle owners understand that an unpaid traffic penalty can create complications, but many may not know the precise procedures involved in enforcement. A scammer can therefore make vague references to legal action, vehicle seizure or a final deadline without necessarily being challenged by the recipient. The less the victim knows about the actual process, the easier it becomes for the scammer to fill the information gap with threats.
The appropriate response to such messages is therefore not to determine whether the story sounds plausible. It is to remove the message from the verification process altogether. If an e-challan is claimed, the recipient should independently access the official government system and check the vehicle details. If a bank account is supposedly at risk, the customer should independently contact the bank through its published customer-care number or official application. If a parcel is supposedly awaiting payment, the recipient should independently check the courier company's official website or application. The principle is the same in every case: the person making the claim should not also be allowed to control the method by which the claim is verified.
Anyone who receives a suspicious e-challan message should also preserve evidence rather than simply deleting it. A screenshot containing the sender information, wording, payment demand and link can be useful when reporting the attempted fraud. The National Cyber Crime Reporting Portal provides facilities for reporting cybercrime and suspicious identifiers, while the national cybercrime helpline, 1930, should be used promptly if money has actually been lost through a cyber fraud.
There is a particularly important lesson in the â¹5 demanded by this particular scam. People often assume that the size of a payment determines the seriousness of the risk. That is not how phishing works. A criminal may ask for Rs 5 precisely because a small amount is less likely to make the victim suspicious. The financial transaction can simply be the mechanism used to get the victim onto a fraudulent website or to persuade the victim that the communication is legitimate. Once the victim has crossed that first barrier, the criminal can attempt to extract considerably more valuable information.
The e-challan scam therefore deserves to be viewed as more than another fraudulent message asking motorists for money. It is an example of a wider evolution in cybercrime in which criminals exploit legitimate government systems, familiar institutional names and ordinary administrative processes to manufacture credibility. The technology may be sophisticated, but the underlying manipulation is straightforward. The victim is given a problem that appears credible, threatened with consequences if the problem is not dealt with immediately and offered a convenient solution that requires the victim to abandon independent verification.
The safest habit is consequently also the simplest. Whenever an unexpected message claims that money is owed to a government department, bank, courier company or other institution, the recipient should resist the temptation to resolve the matter through the link provided in the message. The alleged problem should first be verified through a source that the recipient has accessed independently. In the case of an e-challan, that means checking the official Government of India eChallan system rather than trusting a link sent by an unknown or suspicious sender.
A traffic violation, if it actually exists, can be dealt with through the proper legal and payment process. There is no reason for a vehicle owner to allow a threatening message, an artificial midnight deadline and an implausible Rs 5 settlement offer to dictate what happens next. A few minutes spent independently checking the claim could be the difference between discovering a genuine challan and walking voluntarily into a cybercriminal's trap.
