Real or Fake E-Challan? How to Check a Challan and What to Do If You Clicked

Nearly every vehicle owner in India has had the message by now. A challan is pending, pay today or the fine goes up, tap the link. Some of these messages are real. Many are not, and the fake ones are built to look exactly like the real thing. Between 31 October and 2 November 2026, Delhi Police said it had arrested five people over a network that sent fake challan texts, partly through an app that paid ordinary users a few rupees to send them from their own phones. This guide is not about that case. It is about the thing every reader can do today: check a challan the right way, stay off the apps that pay you to send SMS, and know your first hour if you have already clicked. Checked 2 November 2026.

In short

• Never use the link in the message. Open a fresh browser, type echallan.parivahan.gov.in yourself and search with your challan number, vehicle number or driving licence number.
• A real challan does not need an app. The Press Information Bureau (PIB) has told people not to install APK files that arrive by SMS, WhatsApp or any unknown source.
• Do not install an app that pays you for sending messages, redeeming rewards or doing tasks. It may be using your phone and your SIM to send fraud texts.
• If you clicked or paid, call 1930 straight away, tell your bank or card issuer, and file a complaint at cybercrime.gov.in.

How to check a real challan

We opened the official e-Challan page of the Parivahan portal on 2 November 2026. It lets you look up a challan by challan number, vehicle number or DL (driving licence) number. You enter one of them and choose “Get Detail”. The result shows the challan number, date, amount and status, with a Pay Now link beside any unpaid challan. For some details the page asks you to verify through the mobile number registered at Vahan or an Aadhaar OTP.

1. Do not tap anything in the message. Close it. A real challan is still there when you check it yourself.
2. Type the address. Open your browser and type echallan.parivahan.gov.in. Do not search for it and click the first result, and do not follow a link from a friend’s forward. Fake sites copy the look of the real one.
3. Search with your own number. Use the vehicle number, the challan number or your DL number, as the page offers.
4. Read the page notices. The page told us that a challan forwarded to a Virtual Court can still be paid there, but that you should not pay in both places. It also showed a notice that users in some listed states should pay on the NextGen eChallan portal. If the portal sends you there, follow the notice on the official page. We did not check which states are on that list.
5. Pay only on the official page. If you do not find a challan, there is nothing to pay.

What the official sources say to watch for

The portal itself carries a warning in so many words: “Please beware of fraudulent websites and mobile apps impersonating our echallan services.” It also says its officials never ask for your password, OTP or payment details through calls, emails, messages or links.

PIB’s fact-check unit put out a warning on 26 May 2026, as carried by All India Radio’s news site, about a viral message that told violators to pay a pending e-challan at once. The fact-check said scammers were sending fake e-challan notices with suspicious payment links, and that clicking could download APK files on the phone and put personal and financial data at risk. It said not to install APK files received through SMS, social media, email or any unknown source, to report suspicious content and to verify challans only on the official transport portal.

On 10 July 2026, Outlook Money reported a PIB advisory that repeated the point: check a pending challan only on the official Parivahan e-Challan portal, do not click challan links in SMS or WhatsApp, do not install APK files shared there, and download apps only from official app stores. A state CID cybercrime unit in Himachal Pradesh said in July 2025 that installing such an APK can give criminals access to your WhatsApp account and the phone, and then to passwords and banking details.

Putting these together, the warning signs are the same every time:

• The message arrives with a link or an APK file and asks you to pay or install now.
• It asks you to download an app. A challan does not need one.
• It pushes you to act at once, with a fine that will “increase” or a legal notice.
• The website address is not the official Parivahan address that you typed yourself.

Apps that pay you to send SMS: why to stay away

The second trap is quieter. In January 2026, the Home Ministry and its Indian Cyber Crime Coordination Centre (I4C) blocked an Android app called Wingo. As reported by PTI through ThePrint on 30 January 2026, I4C described it as a “Telecom Mule as a Service” app that paid users for SMS tasks and then used their phones to send messages for cybercrime. It said the messages reached 1.53 crore people a day, that more than 1.53 lakh users had been drawn in by small daily payments, and that these users were unknowingly becoming an accessory in an SMS fraud network. The government also blocked the app’s command and control centre, four Telegram channels and more than 50 YouTube videos that promoted it. The reported source of the probe was Noida police, who found the app while looking into an e-challan-related fraud.

Our case study on the Delhi Police fake e-challan network, reported from 31 October to 2 November 2026, describes a similar trick with an app called Wingo Cash, which, police said, paid Rs 1 to Rs 3 per redemption and sent 9 to 12 SMS from the user’s phone each time. We have not seen any report that says the two apps are the same, so we do not say so.

Our advice, which is our own and not an official rule:

• Do not install any app that pays you for sending SMS, watching ads, redeeming rewards or completing tasks, especially if it came through a WhatsApp group, Telegram channel or video link.
• Be careful about the SMS permission. A genuine reward or game app has no reason to send texts on your behalf.
• If you have already installed one, uninstall it, check your SMS usage with your mobile operator and tell your bank if you have used it for any payment. Report it at cybercrime.gov.in.

If you have clicked or paid: the first hour

1. Call 1930. The I4C page we opened says the 1930 national helpline runs in all States and Union Territories, and that complaints can be made on 1930 or on the National Cybercrime Reporting Portal. The reporting system behind it is meant for quick reporting of financial cyber fraud. Reports differ on how long the best window is, so do not wait to find out. Call at once.
2. Tell your bank or card issuer now. Ask them to block the card or UPI and note the time of your call. Do not delay for the police report. Our guide to reporting UPI and cyber fraud has the steps in order.
3. File at cybercrime.gov.in. Keep the acknowledgement number.
4. Keep the evidence. Do not delete the SMS. Take screenshots of the message, the link, the payment message and the bank’s reply, and note the time.
5. If you installed an APK, uninstall it, then change your UPI PIN, net-banking and email passwords from another, clean device. That step is our suggestion.
6. Report the message to Sanchar Saathi. Its Chakshu facility accepts reports of suspected fraud calls, SMS and WhatsApp messages. The portal says Chakshu is not for fraud that has already happened; for that, use 1930 or cybercrime.gov.in.

What your bank may owe you, and what it does not promise

The Reserve Bank of India’s circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions, which we opened on the RBI site on 2 November 2026, says the customer has zero liability where the loss comes from the bank’s own fault. For a third-party breach where the fault lies neither with the bank nor the customer, it gives zero liability if the customer tells the bank within three working days of the bank’s message about the transaction. The bank must credit the amount back within 10 working days of being told, and the burden of proving customer liability lies on the bank. If the customer reports later, the circular limits the liability by account type up to a ceiling, and beyond seven working days it follows the bank’s board-approved policy.

Please read this as a reason to report fast, not as a promise of a refund. We cannot say whether your case falls under it. If you shared an OTP or PIN, or installed the app yourself, the bank may treat it differently. Ask your bank in writing which part of its policy it is applying, and check that its current policy matches the circular, because we opened the 2017 text only.

What may change

On 29 October 2026 the Supreme Court heard the suo motu case on victims of digital arrest. LiveLaw, whose report we could read only in part, says the order text records that the RBI’s proposed regulations must make financial institutions indemnify victims, with compensation not less than the amount lost, where the fraud happened because of the institution’s failure of due diligence. The bench also said orally that it was proposing strict liability on financial institutions, and the Attorney General told the court that the RBI’s measures were likely to be operational by December. This is an indication and a proposal, not a final rule, and it concerned digital-arrest fraud. Do not count on a refund because of it.

The scale, in numbers

ThePrint reported on 21 February 2026, citing Ministry of Home Affairs data, that 28.15 lakh cyber-fraud complaints were registered in 2025, up from 22.68 lakh in 2024, and that Indians lost at least Rs 22,495 crore. FIRs were 55,484. By share of money lost, investment fraud was 76 per cent, digital arrest 9 per cent and sextortion 4 per cent. Challan-link and reward-app frauds sit inside these broad totals and the report does not split them out. We tried to open the Lok Sabha reply of 21 July 2026 on the MHA website; the page did not open, so no figure from it is used here.

What we could not confirm

• The Delhi Police advisory on fake challan messages that news reports mention. We did not open it, so we do not quote it.
• Any NPCI guidance. The NPCI pages we tried did not give usable text, so none is quoted.
• The sender names and SMS headers that genuine challan messages use. We found no official page that lists them, so we give no rule on this.
• How long the best window for reporting a fraud is. Reports differ.
• We found no public Instagram, Facebook or LinkedIn video that we could open and match, so the videos below are from YouTube; one is background on the Wingo app and four are general challan-scam explainers.

Do this today

Save 1930 on your phone and tell your family the one rule: no link, no app, no payment from a message. Check your own challans now and then at the portal, typing the address yourself. If a parent or relative who is less used to the phone has a vehicle, show them how. Our related guide on checking an urgent money request another way uses the same habit.