The Ministry of Road Transport and Highways has ordered a CERT-In security audit of four transport portals, VAHAN, SARATHI, e-Challan and PUCC, after reports that vehicle owners’ personal details were being sold online. According to reports, entering just a car’s registration number could reveal the owner’s name, address and mobile number, sometimes for as little as Rs 5.
What exactly was being sold?
According to The420.in, a lookup using only a registration number allegedly returned:
- Owner’s full name and father’s name
- Residential and permanent address, with PIN code
- Mobile number
- Driving licence and challan records, FASTag details, and RC and DL copies
Digital rights group Internet Freedom Foundation had flagged the issue in September. It reported that one Play Store app returned owner details from a registration number with no OTP or login, at roughly Rs 2 per lookup, while a Telegram service charged Rs 5. Security firm Cyderes reported that the Telegram service appeared to use credentials linked to licensed identity-verification companies, rather than a hack of a government system.
What the government has ordered
- CERT-In forensic audits of VAHAN, SARATHI, e-Challan and PUCC.
- A review of data-sharing rules with MeitY under the Digital Personal Data Protection Act, 2023.
- Requests to app stores, including Google, to remove apps linked to showing vehicle owners’ details.
- An audit of access on the Unified Logistics Interface Platform by the National Informatics Centre.
As per the report, an RTI response showed 25,314 private entities held active credentials for these databases, with about 1.7 crore searches over 33 months.
SBI also reported a suspected data leak
In the same week, SBI informed stock exchanges about suspected customer data on the dark web. Of about 3.75 lakh records found, 3,897 contained personal details such as names, mobile numbers and addresses, The Week reported. SBI said it has appointed an independent agency to investigate and that its operations are not affected.
What you should do
- Expect smarter scam calls. A caller who knows your name, address and car number can sound very convincing. Verify before you trust.
- Never share OTPs, UPI PINs or card details on calls, even if the caller “knows everything” about you.
- Be careful with fake challan messages. Pay challans only on the official e-Challan portal or your state traffic police site.
- Lost money to fraud? Call the cybercrime helpline 1930 immediately and file a complaint on cybercrime.gov.in.
Under the DPDP Act, companies will have to notify users about breaches, but those rules only fully kick in from May 2027. Until then, a little suspicion is your best security.
Frequently asked questions
Which portals are being audited for the vehicle data leak?
The Transport Ministry has ordered CERT-In audits of VAHAN, SARATHI, e-Challan and PUCC.
What vehicle owner data was allegedly sold?
Reports say a registration number could reveal the owner's name, father's name, address, PIN code and mobile number, along with licence and challan details.
What should I do if I get a suspicious call about my vehicle or challan?
Do not share OTPs or payment details. Pay challans only on the official e-Challan portal, and call 1930 if you lose money to fraud.
