NHAI and Bank Impersonation Scams (FASTag) — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 28, 2026

Severity: HIGH | View Full Scam Details

Beware of the NHAI and Bank Impersonation Scams (FASTag) in India — 2026 Alert

As FASTag usage grows across India’s highways, a serious scam involving fraudsters impersonating NHAI officials and banks threatens vehicle owners’ money and personal data.

What Is the NHAI and Bank Impersonation Scams (FASTag)?

The NHAI (National Highways Authority of India) and Bank Impersonation Scam linked to FASTag is a rising cybercrime targeting Indian vehicle owners who use electronic toll payments for smoother travel. FASTag—a compulsory RFID tag linked to a prepaid or linked bank account—allows automatic deduction at toll plazas. However, scammers are exploiting the system’s popularity to trick users.

These fraudsters pretend to be representatives from NHAI or banks managing FASTag accounts and initiate contact via phone calls, WhatsApp, SMS, or emails. They allege issues with the victim’s FASTag account such as invalid payment, blocked tags, or urgent need for “verification.” Their aim is to obtain sensitive information like OTPs (One-Time Passwords), PIN codes, Aadhaar-linked authentication details, or full card numbers.

In India, such scams have increased sharply as more people rely on FASTag post the government’s push for digital toll payments. According to public complaints to cybercrime cells and advisories from CERT-In (Indian Computer Emergency Response Team), many victims have reported losing money or having their bank accounts compromised after such interactions. RBI and I4C (Indian Cybercrime Coordination Centre) warn citizens to remain vigilant against these evolving phishing tactics.

How This Scam Works — Step by Step

1. Initial Contact: The victim receives a phone call, WhatsApp message, SMS, or email claiming to be from NHAI helpline or their bank’s FASTag department. The caller ID or sender number may look very similar to official numbers via spoofing technology.

2. Urgent Issue Alert: The fraudster claims there is a problem with the FASTag account—such as non-payment of toll, account suspension, or suspected fraud—and urges immediate “verification” or “update” of details to avoid service interruption.

3. Request for Sensitive Info: The victim is asked to share OTPs received on their phone, Aadhaar number with linked biometrics, debit/credit card details, or login credentials under the pretense of “security check” or “account activation.”

4. Phishing Links: Sometimes, victims receive links that look like official FASTag or bank websites. Clicking these leads to fake portals designed to harvest login credentials or payment information.

5. Funds Drained: Once the scammer has gained OTPs or card details, they can authorize unauthorized bank transactions, UPI payments, or recharge wallet accounts, causing financial loss.

6. SIM Swap/Account Takeover (in some cases): Fraudsters may also request victims to share SIM-related information or carry out commands to enable SIM swap, giving them control over mobile number-based banking verifications.

Real Warning Signs to Watch For

• Unsolicited calls or messages claiming urgent FASTag issues.
• Caller ID or number resembling official NHAI or bank contacts but slightly altered.
• Requests for OTPs, PINs, or full card details—officials never ask these.
• Links asking to enter bank/FASTag credentials outside official websites.
• Pressure tactics demanding immediate action or account “locking.”
• Poor grammar or spelling errors in SMS or WhatsApp messages.
• Asking for Aadhaar details or biometric-related information over phone/SMS.

What Happens to Victims

Victims often suffer immediate financial losses through unauthorized debits from their bank or UPI accounts. Recovering these funds can be difficult because UPI payments are usually irreversible. Additionally, sharing Aadhaar-linked info puts them at risk of identity theft, which can affect multiple financial and government service accesses.

Beyond money, many victims experience stress and anxiety due to misuse of their personal information and fear of further fraud. It also causes inconvenience in blocking compromised accounts or re-registering FASTag devices. In serious cases, misuse of SIM cards can block victims from receiving OTPs for legitimate banking, complicating recovery.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has repeatedly cautioned users not to share OTPs, PINs, or full card details over phone or messages, emphasizing that banks never ask for such information. The RBI also encourages users to report unauthorized transactions immediately through their bank’s grievance redressal channels.

CERT-In and I4C urge citizens to report phishing or impersonation attempts via the National Cyber Crime Reporting Portal and to use official helplines to verify any suspicious communication. The 24x7 cybercrime helpline number 1930 is an important resource for victims needing support or to lodge complaints.

How to Protect Yourself

1. Do not share OTPs, PINs, Aadhaar details, or card information over phone, SMS, or WhatsApp.
2. Verify calls or messages by directly contacting official NHAI helpline or your bank using numbers from their official websites.
3. Avoid clicking on links received in unsolicited messages related to FASTag or banking.
4. Enable two-factor authentication (2FA) on your bank and FASTag apps where possible.
5. Regularly check your FASTag account and bank statements for unauthorized transactions.
6. Keep your Aadhaar and bank details private; avoid sharing on social media or non-secure channels.
7. Update your mobile phone’s SIM security settings and beware of SIM swap requests or suspicious OTP delays.

What to Do If You've Been Targeted

• Immediately block your FASTag by contacting your issuer bank or the NHAI helpline.
• Contact your bank’s customer care to freeze cards or accounts and report unauthorized transactions.
• File a complaint at the National Cyber Crime Reporting Portal (cybercrime.gov.in) providing all relevant details.
• Call the 1930 cybercrime helpline for assistance and further guidance on next steps.
• If you share your Aadhaar details or suspect identity misuse, consider alerting UIDAI and watch for suspicious activity.
• Change passwords and enable additional authentication on related accounts.
• Inform your mobile network provider if you suspect or experience SIM swap activity.

Frequently Asked Questions

Q: Can NHAI officials contact me to verify FASTag payments?
A: Official NHAI or your bank usually do not call customers to ask for OTPs, PINs, or Aadhaar details for FASTag. Always verify by calling official helpline numbers before sharing any info.

Q: What if I clicked on a phishing link related to FASTag?
A: Immediately disconnect from the internet, do not enter any details, clear your browser cache, and run a security scan on your device. Change passwords for bank and FASTag portals from a secure device.

Q: Can I get my money back if lost due to this scam?
A: Recovery depends on the bank and transaction type. UPI payments often cannot be reversed easily, so early reporting to the bank and cybercrime authorities improves chances of action.

Be alert and careful with FASTag-related messages and calls to protect your money and data.

For any suspicious FASTag or bank message, verify it with BharatSecure.app and report fraud attempts at the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.