Fake FASTag Reactivation SMS Phishing — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: HIGH | View Full Scam Details

Beware of Fake FASTag Reactivation SMS Phishing in India 2026: Don’t Get Trapped

A rising number of fraudsters are sending fake SMS alerts about FASTag reactivation to steal money, putting millions of Indian vehicle owners at risk of financial loss through UPI and phishing.

What Is the Fake FASTag Reactivation SMS Phishing?

This scam involves fraudsters sending SMS messages falsely claiming to be from banks or FASTag service providers, urging vehicle owners to “reactivate” their FASTag immediately to avoid service suspension or penalties. FASTags are RBI-approved prepaid toll payment tags linked with vehicles and linked often to UPI or bank accounts, making them an attractive target.

Fraudsters reportedly obtain mobile numbers linked to FASTag registrations either from data leaks or public sources. They send convincing SMS notifications with sender IDs that mimic real entities. The urgent language prompts recipients to click on malicious links or share personal details such as Aadhaar or bank information. Given the increasing adoption of FASTag across India’s highways, particularly among everyday commuters and commercial vehicle operators, this phishing scam has affected a growing number of victims nationwide.

Government agencies like CERT-In and I4C have issued advisories in the past years urging vigilance against SMS-based frauds targeting digital payments and KYC (Know Your Customer) data. The Reserve Bank of India (RBI) also regularly cautions users to verify such messages directly through official bank or FASTag portals and warns against divulging OTPs or personal info.

How This Scam Works — Step by Step

1. Fake SMS Alert: The victim receives an SMS appearing to come from a reputed bank or FASTag provider. The message warns that the FASTag account requires “immediate reactivation” or else toll payments will stop, often threatening fines or suspension.

2. Malicious Link or Helpline Number: The SMS contains a link or a helpline number (which is actually controlled by scammers). The link typically directs the victim to a fake website resembling a known bank or FASTag portal.

3. Phishing for Details: On the fake site, the victim is prompted to enter sensitive data such as Aadhaar number, bank account details, UPI PIN, or OTPs received on their phone, under the guise of “verifying identity” or “renewing FASTag KYC.”

4. Unauthorized Transactions: Using the stolen credentials, fraudsters initiate fraudulent UPI transactions or SIM swaps to take control of the victim’s mobile number, enabling them to bypass two-factor authentication.

5. Financial Loss: Victims notice debits from their linked bank accounts or UPI apps, often after several days of unauthorized transactions. By the time banks detect and intervene, significant INR amounts may have been siphoned off.

Real Warning Signs to Watch For

• Sender ID looks similar but slightly off — e.g., “FASTaag” instead of “FASTag.”
• Urgency and threats in the message asking for immediate action.
• Links with unusual domains or misspelled URLs that do not match official bank or FASTag websites.
• Request for personal info or OTPs via SMS or calls.
• Unsolicited SMS about FASTag when no recent FASTag activity was made.
• Helpline numbers in the message not matching official customer care numbers of banks or FASTag providers.
• Poor grammar or spelling errors in the SMS text.

What Happens to Victims

Victims often suffer direct financial impacts, including unauthorized debits from their UPI wallets or bank accounts linked to FASTag services. Given the integration of FASTag with Aadhaar and mobile numbers, stolen data can lead to further identity misuse, such as fraudulent SIM swaps allowing scammers to intercept OTPs and lock victims out of their banking apps.

This not only drains their bank balance but can cause delays and difficulties in recovering funds, as UPI transactions are often irreversible once completed. Emotional distress is also common, as victims face uncertainty and the hassle of filing police reports and bank complaints. Rural and semi-urban users, who rely heavily on FASTag for toll payments, may get stranded or incur fines due to blocked or inactive FASTags.

What RBI and CERT-In Say

The Reserve Bank of India has highlighted the importance of safeguarding UPI PINs and discourages sharing OTPs or personal banking details over calls or SMS. RBI helpline numbers and official websites must be the primary channels for verifying any FASTag-related communication.

CERT-In (Indian Computer Emergency Response Team) advises users to beware of phishing messages and report suspicious activities immediately on cybercrime.gov.in or via the 1930 cybercrime helpline. The Indian Cyber Crime Coordination Centre (I4C) supports these efforts by raising awareness specifically around digital payment frauds involving UPI and related KYC misuse.

These agencies strongly recommend ignoring or deleting suspicious SMS and verifying FASTag status only through authenticated methods such as official bank apps or the National Payments Corporation of India (NPCI) portal.

How to Protect Yourself

1. Never click on links in unsolicited FASTag or banking SMS.
2. Verify the sender and message authenticity by contacting your bank or FASTag provider directly through official customer care or apps.
3. Do not share OTPs, Aadhaar numbers, UPI PINs, or banking details via SMS, calls, or websites from unknown sources.
4. Enable mobile number-based account alerts to monitor unexpected transactions immediately.
5. Install official UPI or FASTag apps from trusted app stores only, and keep them updated.
6. Regularly check your FASTag and bank account statements for unauthorized debits.
7. Use RBI’s guidelines for creating strong UPI PINs and updating KYC details only through verified platforms.

What to Do If You’ve Been Targeted

• Contact your bank and FASTag issuer immediately to block the account or FASTag linked to suspicious transactions.
• File a complaint online at cybercrime.gov.in or call the 1930 cybercrime helpline.
• Lodge a First Information Report (FIR) with local police if financial loss has occurred.
• Change all login credentials for your banking and payment apps and enable two-factor authentication where possible.
• Inform your mobile service provider if you suspect a SIM swap and request blocking or re-verification of your mobile number.
• Keep evidence of all suspicious communications, SMS, and transaction alerts for reporting.

Frequently Asked Questions

Q: Can I get my money back if I fall for this FASTag SMS phishing scam?
A: Refunds depend on the bank’s policy and investigation. UPI transactions are typically irreversible, so immediate reporting to your bank and police is crucial to improve chances of recovery.

Q: How can I confirm if a FASTag SMS is genuine?
A: Always verify by logging into your FASTag provider’s official app or website independently. Avoid using links or numbers provided in the suspicious SMS.

Q: Will blocking my FASTag affect toll payments?
A: Yes, if your FASTag is blocked or inactive, toll payments may fail, and you could face penalties on highways. Reactivate FASTag only through official channels after ensuring your details are safe.

Protect yourself by verifying suspicious FASTag SMS and other payment fraud alerts on BharatSecure.app, and if in doubt, report fraud immediately at the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.