Indian Vehicle Owners Targeted in Large-Scale E-Challan Phishing Scam A resurgent phishing campaign is exploiting trust in India’s Regional Transport Office (RTO) systems, targeting vehicle owners with fake e-challan notices. Unlike earlier attacks that relied on Android malware, this operation has shifted entirely to browser-based fraud, lowering the barrier for attackers and expanding the victim pool to any user with a smartphone and internet access. The scam begins with unsolicited SMS messages, sent from regular mobile numbers, warning recipients of overdue traffic fines. The messages use threatening language—citing court action, license suspension, or additional penalties—to pressure victims into immediate action. Embedded links, designed to mimic official e-challan domains, redirect users to fraudulent portals hosted on attacker-controlled infrastructure, including the IP address 101[.]33[.]78[.]145. These phishing pages closely replicate government branding, featuring insignia from the Ministry of Road Transport and Highways (MoRTH) and the National Informatics Centre (NIC). Technical analysis revealed the templates were originally written in Spanish and later translated into English, indicating reuse across regions. Once on the fake portal, victims are prompted to enter vehicle or license details, after which the system generates a fabricated challan—typically for a modest fine (e.g., INR 590) with a near-term expiration date. Psychological manipulation, including warnings of legal consequences, is used to create urgency. The final stage directs victims to a payment page that only accepts credit or debit card details, excluding UPI or net banking options that might leave clearer transaction trails. Testing confirmed that all entered card data is transmitted to attacker-controlled servers, with no legitimate payment processing occurring. The same infrastructure supports multiple fraud verticals, including phishing lures impersonating Parivahan services, HSBC, DTDC, and Delhivery, with over 36 e-challan-themed domains identified on a single IP. The campaign’s localized tactics—using Indian mobile numbers, domestic telecom networks, and references to the State Bank of India—enhance credibility, reflecting a mature and scalable operation. Researchers at Cyble Research and Intelligence Labs (CRIL) noted the shift from malware to browser-based financial theft underscores the evolving sophistication of such scams, requiring coordinated mitigation efforts across telecoms, banks, and security teams.