Fake e-challan texts may use legal threats to install an Android app
Who may be targeted: People who receive unexpected Indian traffic-fine or e-challan messages, especially Android-phone users.
What we are seeing
A text claims that an e-challan has been issued and threatens legal action unless a penalty is paid immediately. The message uses a shortened link instead of an official traffic or government address. The submitted report says the link downloads an Android APK described as a Trojan; the file was not available for independent analysis. Do not open the link or install the app. Check fines through the official government or traffic service opened independently.
Warning signs
- The message threatens legal action unless you pay immediately.
- The link is shortened and does not show an official government or traffic-authority domain.
- The message asks you to download or install an Android APK instead of using a normal official payment page.
- The notice includes a challan number and date to look official, but those details can be fabricated.
- The message arrives unexpectedly or does not match a fine you can find through the official service.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
tinyurl[.]com/PayChaIIan-qc7t36rg
Source and limitations — what this alert does not establish
- The report says the link downloads an APK described as a Trojan, but the APK itself was not available for independent analysis. The message does not establish who created the link or how many people received it.
Published Sep 8, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.