Kerala Police Alert Vehicle Owners Over Fake E-Challan Messages, APK Scam

Kerala Police have warned vehicle owners against a growing scam involving fake e-challan SMS messages that trick users into downloading malicious Android applications designed to steal sensitive information.

According to a police advisory, fraudsters send messages from private mobile numbers containing seemingly genuine e-challan details and a link. The link directs users to a fake website resembling the official Motor Vehicles Department e-challan portal, where they are asked to enter their vehicle registration number.

The website then displays a fraudulent dialogue box labelled “Internal Security Review” and prompts users to download an application to complete verification. Selecting “Yes” downloads a malicious APK file, police said.

The APK may seek multiple permissions, potentially allowing fraudsters to access sensitive information or gain control of the device, the advisory said.

Police urged people not to install APK files received through SMS, WhatsApp, Telegram or other messaging platforms in the name of e-challans, traffic fines, vehicle verification, KYC, refunds or RTO/MVD services.

Users should verify challan details only through official MVD, Parivahan or e-challan websites and authorised government applications. Police advised against opening links directly from SMS messages and recommended accessing official portals by typing their addresses manually or using verified government links.

Messages displaying phrases such as “Internal Review”, “Pending Verification” or “Install App to Clear Challan” should be treated with suspicion. Legitimate e-challan services generally do not require APK downloads from external sources, police said.

Anyone who suspects that a malicious APK has been installed should immediately disconnect the device from the internet and avoid banking or other sensitive transactions. They should remove suspicious applications where possible and check UPI accounts, bank accounts and recent transactions for unauthorised activity.

Victims should report suspected cyber fraud through helpline 1930 or the National Cybercrime Reporting Portal at the earliest. Prompt reporting of financial fraud can help authorities take steps to prevent or recover lost funds, police said.