A fake e-challan link that led to the theft of Rs 1.48 lakh from an engineer’s bank accounts, along with a separate Rs 99,000 credit-card fraud reported by a trader, shows how ordinary digital transactions can become entry points for financial crime. The two complaints reported in Ahmedabad are different in method, but both involve a citizen using a mobile device for a routine financial or administrative task and losing control of the transaction environment.
The first case began with a WhatsApp message sent to Kalol resident and private-company engineer Kuldipsinh Mahendrasinh Rajput. The message claimed that a Rs 1,000 traffic memo was pending against his vehicle and included a link marked “GET PDF”. According to the complaint filed with Kalol City Police Station, clicking the link caused an application named mParivahan to download on his mobile phone.
The application then asked him to pay a minimum charge of Re 1 to view the challan. He entered his Google Pay password while attempting the transaction, but the password was shown as invalid. That failure prompted him to check the official RTO e-challan portal, where he found that no traffic memo had been issued against his vehicle. He then uninstalled the downloaded application.
The reported loss had already occurred by that point. The complaint states that Rs 45,540 was taken from an HDFC Bank RuPay credit card, Rs 99,000 from an Axis Bank credit card, Rs 3,958 from a Central Bank account and Re 1 from an Axis Bank account. The total reported withdrawal was Rs 1,48,499 through unidentified IDs.
The case is significant not because it establishes that the official e-challan system was compromised—the report does not make that claim—but because the fraud used the appearance of a transport-enforcement service. A traffic memo is a familiar government-facing transaction. The message did not need to persuade the recipient to make an unusual investment or transfer a large sum voluntarily. It only needed to make the recipient believe that a routine penalty had to be checked or paid.
That distinction matters for digital governance. When government services move online, citizens increasingly encounter links, portals, applications and payment windows rather than a physical office or a uniformed official. The convenience depends on the user being able to distinguish an authorised interface from a fraudulent one. In this case, the reported check on the official RTO portal eventually revealed that the message was false, but the verification came after the application had been downloaded and a payment attempt had been made.
The reported method also shows how the fraud was layered. The first step was a message about a pending vehicle memo. The second was a download presented as an application for viewing the document. The third was a nominal Re 1 payment request. The fourth involved the entry of a payment credential. The engineer’s complaint says that the fraudsters then obtained control of the phone, after which money was taken from multiple banking instruments.
The source report does not establish precisely how the mobile phone was accessed, how the downloaded application operated, or whether the Google Pay password itself was captured. Those technical details remain important because they determine the nature of the breach and the responsibilities of the platforms and financial institutions involved. What is established in the complaint is the sequence described by the victim: a fraudulent traffic-memo message, an application download, an attempted nominal payment, subsequent loss of control and withdrawals from multiple accounts.
The second case, registered at Maninagar police station, involved a 48-year-old online clothing trader, Naresh Matlani. On August 11, 2026, he was attempting to submit an IPO application through Google Chrome on his mobile phone while logging into a bank account. According to the report, a page opened automatically and displayed a payment request for Rs 99,000 on a website identified as Fizpay.in.
The trader tried to exit the suspicious page, but an OTP arrived on his phone and was automatically entered into the page before he could close it. A message then indicated that Rs 99,000 had been debited from his bank credit card as a bill payment to a company. He contacted the cybercrime helpline 1930 and reported the fraud. The report says the amount was not held after a delay, and he subsequently filed a complaint with Maninagar police.
The two cases do not demonstrate that the same group, technology or payment channel was involved. They do, however, reveal a common dependence on the mobile phone as the point where browsing, authentication, payment and transaction alerts converge. In both accounts, the user was engaged in a legitimate task: checking a traffic penalty or applying for an IPO. The fraudulent activity entered through a page or application that appeared relevant to that task.
This is the institutional problem behind the individual losses. A citizen’s interaction with a service is no longer confined to the agency that provides it. A traffic fine may be associated with a transport authority, but the user may encounter it through WhatsApp, a browser, an application, a payment gateway and a bank account. A financial application may begin on a bank website but move through a browser page and an OTP system. The more connected the transaction becomes, the more difficult it can be for a user to identify which layer is authorised and which layer is not.
The first complaint also underlines the importance of official verification channels. The engineer checked the RTO e-challan portal only after receiving the message and attempting the payment. The report does not say whether the message contained an official sender identity, whether the link resembled a government address, or whether the application was distributed through an authorised app store. Those details would help determine how the deception was made credible and what preventive controls could have interrupted it.
The response after a fraud is equally dependent on institutional coordination. In the second case, the trader called 1930 soon after the debit, but the report says the amount was not held and that he later approached the local police station. The account does not provide the bank’s explanation, the status of the investigation, the identity of the recipient account or whether any funds were recovered. It therefore cannot establish whether the delay resulted from the reporting process, the payment chain, the bank’s internal controls or another factor.
The presence of the 1930 helpline in the second complaint shows that the reporting mechanism was known to the victim. But reporting and recovery are separate stages. A complaint creates an institutional record and may trigger coordination with banks or payment intermediaries; it does not itself establish that funds will be frozen. The report’s account of the trader’s experience makes that gap visible without establishing how frequently it occurs or where responsibility lay in this case.
For transport authorities, the fake e-challan case raises a narrower but important service-design question: how should citizens be directed to verify a traffic penalty? The supplied report does not include a statement from the transport department, police or the operator of the official portal. It also does not record whether any public advisory was issued after the complaint. Those missing responses are material because the credibility of a digital enforcement system depends not only on the accuracy of its records but also on the clarity of its official communication.
The cases also show why a small payment request can be a high-risk moment. The Re 1 charge in the first case was not the main financial loss; it was the mechanism through which the victim was persuaded to enter a credential and proceed inside a fraudulent environment. In the second case, the automatic entry of an OTP was followed by a Rs 99,000 debit. The reported sequence indicates that authentication, by itself, did not guarantee that the user was authorising a legitimate transaction.
At the same time, the available evidence does not support a broader conclusion about the scale of fake e-challan fraud in Ahmedabad or Gujarat. The report records one complaint involving a traffic-memo link and a separate complaint involving an IPO-related browsing session. It does not provide police statistics, bank data, recovery figures, information about other victims or a comparison with previous months. Any claim that such incidents are increasing would require evidence beyond the two cases described.
What can be established is that urban service delivery now operates through a chain of public and private digital systems, while accountability remains distributed across agencies, banks, payment platforms, application environments and law-enforcement bodies. When a citizen is deceived, the visible event is a debit from an account, but the enabling conditions may involve the misuse of an official-looking name, a browser session, an application download, an OTP flow and delayed intervention.
The immediate record from Ahmedabad therefore points to two issues that require clearer institutional answers: how citizens are to distinguish authorised transport communications from fraudulent messages, and how quickly banks and enforcement agencies can act after a reported debit. The police complaints establish the losses and the reported methods. They do not yet establish the technical source of either fraud, the identity of the perpetrators, the amount recovered or whether any public system was directly breached. Those are the next facts that would determine whether these cases remain isolated complaints or reveal a wider weakness in the city’s digital-service ecosystem.
