mParivahan APK scam: checking a fake e-challan message

A message about an unpaid traffic challan should not become a reason to install a file on your phone. If it offers an APK under the mParivahan name, stop. Check the alleged fine through the official portal before responding to the message or trusting its download instructions.

The fake domain and Scanify's findings

One fake site checked by Scanify on 9 November 2026 was app.mparivahan[.]cfd. The domain was registered on 8 October 2026 through Spaceship, Inc. It had a valid certificate. Its .cfd ending appears on published lists of heavily abused domain endings. Those observations describe the address and connection, not the contents of an APK.

A user reported the site to Cloudflare, and by 9 November Cloudflare was showing its Suspected Phishing warning in front of it. Scanify's sandbox observed that warning on 9 November. This is a dated observation, not a promise that the same warning will always appear. Do not bypass it to investigate the download.

Where to find the real mParivahan app

The official eChallan portal identifies itself as a Ministry of Road Transport and Highways initiative and warns about impersonating websites and apps. Start there to verify the message independently. Its notice says it does not request passwords, one-time passwords or payment details through calls, emails or messages.

For Android, the official Google Play listing is named NextGen mParivahan. It displays National Informatics Centre. as publisher and uses the app identifier com.nic.mparivahan. The government app privacy policy also identifies NIC as the developer. Use those references rather than a download button in an unsolicited message.

What the official malware warning says

CERT-In describes fake RTO and e-challan messages delivering malicious APKs. In its documented campaign, an initial installer leads to another installation through an update prompt. The malware seeks SMS and call permissions, uses fake screens to collect financial credentials, and sends SMS one-time passwords to an attacker.

These are CERT-In's findings about that campaign. We have not established that a particular APK from the domain above has every described capability. The practical advice remains the same: do not install a message attachment to inspect a supposed traffic fine.

How to check a link like this yourself

1. Copy the URL without opening it or installing the attached file.
2. Inspect it with the fake website checker, then compare the complete address with the government portal.
3. Open echallan.parivahan.gov.in independently, or use your state traffic police service.
4. If you need the genuine app, use its official store listing and check the publisher. Keep the message's APK uninstalled.

Use the scam email checker for an email version, or the QR code checker if the destination is hidden in a code.

If you already installed the APK

A West Jaintia Hills Police advisory recommends disconnecting the device from the internet, uninstalling the suspicious application and changing important account passwords. CERT-In additionally recommends a trusted mobile antivirus scan, changing the UPI PIN and checking bank statements. For financial fraud, it directs people to cybercrime.gov.in or 1930.