FASTag Fake Annual Pass Website Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: CRITICAL | View Full Scam Details

Beware in 2026: FASTag Fake Annual Pass Website Scam Hits Vehicle Owners Across India

Millions of Indian vehicle users relying on FASTag for seamless toll payments face a new critical threat — fake websites tricking them into handing over personal and payment data.

What Is the FASTag Fake Annual Pass Website Scam?

The FASTag Fake Annual Pass Website Scam is a phishing fraud targeting Indian vehicle owners who use FASTag — the electronic toll collection system mandated by the National Highways Authority of India (NHAI). Scammers have created fake websites that imitate official portals of NHAI or its partner banks. These sites claim to offer annual FASTag passes with special discounts or easier services, luring users into making payments and sharing sensitive details.

This scam primarily targets everyday commuters and logistics operators who prefer to pay tolls in advance via annual FASTag passes. Its reach is pan-India, with increasing cases reported across states, especially where toll plazas are busy and users look for faster toll clearance options. While awareness has increased, fraudsters exploit the growing digital payment ecosystem in India to deceive unsuspecting users through WhatsApp forwards, social media ads, and even QR codes displayed in public spaces.

The Indian Computer Emergency Response Team (CERT-In) and the Indian Cybercrime Coordination Centre (I4C) have issued advisories warning about such phishing sites. The Reserve Bank of India (RBI) also stresses caution with online payments and sharing OTPs, particularly in scams impersonating government portals.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp, Social Media, or Public QR Codes: You might receive a forwarded message on WhatsApp or see an advertisement on Facebook, Instagram, or roadside banners offering “Discounted FASTag Annual Pass 2026” with a link or QR code.

2. Visiting the Fake Website: The link leads to a fake website closely resembling the official NHAI or bank FASTag portal, complete with logos and government-like URL structures that trick users.

3. Entering Vehicle and Personal Details: The website asks for your vehicle registration number, name, mobile number, and sometimes Aadhaar number — mimicking genuine annual pass application forms.

4. Payment Request: The fake site demands payment for the annual pass via debit/credit card, UPI, or net banking. The payment gateway looks real but is controlled by the fraudsters.

5. OTP and Authentication Request: To complete the transaction, users receive an OTP (One-Time Password) on their phone and are asked to enter it on the site. Scammers use this OTP to authorize fraudulent payments or steal UPI access.

6. Data and Money Theft: Once payment succeeds, victims receive no official FASTag pass. Instead, their financial details are compromised, leading to unauthorized transactions, UPI frauds, or identity theft.

7. No Recourse from Fake Site: Victims find that the website disappears or becomes unreachable. Customer care numbers given are fake or unresponsive.

Real Warning Signs to Watch For

• URL looks suspicious or uses uncommon domains (e.g., fastag-india.com instead of nhaltoll.gov.in)
• Advertisements/promotions not from official government or bank sources
• Payment pages requesting OTPs outside genuine banking apps or UPI apps
• Unsolicited messages on WhatsApp or social media claiming huge discounts on FASTag passes
• QR codes pasted on walls/roadsides that do not match official FASTag partner accounts
• No official acknowledgment email or SMS from NHAI after payment
• Grammar mistakes, spelling errors, or odd sentence structures on the website

What Happens to Victims

Victims often lose money directly due to unauthorized debits from their debit/credit cards or UPI wallets. Fraudsters can misuse the stolen personal information, including Aadhaar or vehicle registration details, for wider identity theft schemes. Victims experience emotional distress from the financial loss and a sense of violation.

Due to the finality of UPI payments and bank transactions in India, reversing fraudulent payments may be difficult or time-consuming. Even if reported, victims may face delays due to SIM swap frauds that block OTPs or complicate account recovery. Without quick reporting, scammers might use stolen details to open fake accounts or apply for loans in victims’ names, worsening the damage.

What RBI and CERT-In Say

The RBI emphasizes never sharing OTPs or PINs with anyone, even if requested via official-looking sites or calls. They advise users to verify payment portals carefully and use only authorized government or bank websites for transactions.

CERT-In recommends vigilance against phishing sites and urges reporting suspicious URLs to the Indian Cyber Crime Coordination Centre (I4C). The Ministry of Road Transport and Highways (MoRTH) and NHAI advise users to purchase FASTag and related passes strictly from official portals or bank branches.

For help, you can reach out to:

• Cybercrime Helpline: 1930
• RBI Customer Helpline: 1800 425 8384 or 080-26599990

How to Protect Yourself

1. Always buy FASTag passes and renewals from the official NHAI portal (nhaltoll.gov.in) or verified bank websites.
2. Ignore WhatsApp messages and social media ads offering “discounted” FASTag annual passes.
3. Cross-verify URLs carefully for spelling, HTTPS security lock, and official domain endings.
4. Never share OTPs or UPI PINs with anyone, including websites or callers.
5. Use official mobile apps of banks or NHAI for FASTag management and payments.
6. If scanning QR codes, confirm they are genuine and displayed by authorized points like toll plazas or official bank branches.
7. Regularly check your bank and UPI transaction history for unauthorized activity.

What to Do If You've Been Targeted

• Immediately block or freeze your debit/credit cards via your bank’s customer service or app.
• Change your UPI PIN and deactivate any suspicious linked devices.
• Call the 1930 Cybercrime Helpline and report the scam with full details.
• File a complaint on the official cybercrime portal: cybercrime.gov.in.
• Inform your bank about the fraudulent transactions so they can investigate and possibly reverse charges.
• Report the fake website URL to CERT-In at cert-in@nic.in.
• If Aadhaar data is compromised, visit your nearest UIDAI center to check for unauthorized updates.

Frequently Asked Questions

Q: Can I get a FASTag annual pass discount from sources other than NHAI or banks?
A: No, any discounted FASTag annual pass offers outside official NHAI or bank portals are likely scams. Always use verified government or bank websites.

Q: I entered my details on a site but did not complete payment. Am I safe?
A: Partial data entry may still expose your personal information. Monitor your bank accounts closely and report any suspicious activity immediately.

Q: What if I already shared my OTP on a fake website?
A: Immediately block your bank cards and change UPI PIN. Report the incident to your bank and the cybercrime helpline (1930) without delay. The faster you act, the higher are chances of limiting losses.

If you receive suspicious messages or links promising FASTag deals, do not trust them blindly. Verify all information and report fraud attempts at BharatSecure.app — your trusted partner against digital scams in India. Stay safe, stay informed!