Fake RTO e-challan APK drains ₹24.4 lakh; Gujarat Police arrest Bengal man
Synopsis
A fake RTO e-challan Android app was all it took to drain ₹24.4 lakh from a Gujarat resident's account — and the Surat Cyber Crime Branch has now traced the fraud's money trail to a West Bengal man who reportedly rented out a charitable trust's bank account for ₹50,000. With three arrests across three states and one accused still at large, the case exposes the multi-state account-mule networks that power India's growing APK fraud ecosystem.
Key Takeaways
Arikul Islam, 54 , of Hooghly district, West Bengal , was arrested for allegedly providing a bank account used to launder proceeds from a ₹24.4 lakh cyber fraud.
The fraud was executed via a fake RTO application — E-Chalan.apk — sent to the victim to hack their mobile phone. ₹12,42,117 was transacted through Islam's Ujjivan Small Finance Bank account between 29 November 2025 and 3 May 2026 .
Islam allegedly received a commission of ₹50,000 for handing over the account linked to a charitable trust he had registered.
Earlier arrests in the case include Ritik Bali, 26 , and Tinku Parmar, 44 , both from Badnagar, Ujjain, Madhya Pradesh ; one accused remains absconding.
Police urge victims of financial cyber fraud to call the national helpline 1930 immediately to improve chances of freezing stolen funds.
The Surat City Police Cyber Crime Branch has arrested a 54-year-old man from West Bengal for allegedly furnishing a bank account to cyber criminals who used a fake Regional Transport Office (RTO) e-challan application to hack a victim's mobile phone and siphon ₹24.4 lakh. The arrest was confirmed by officials on Wednesday, 14 October 2026.
How the Fraud Was Carried Out
According to police, the fraudsters sent the complainant a counterfeit digital RTO e-challan application named E-Chalan.apk and persuaded them to download it. Once installed, the application was used to compromise the victim's mobile phone, enabling the accused to transfer ₹24.4 lakh from the complainant's bank account across three separate accounts — all without the victim's knowledge or consent.
Investigators established that ₹12,42,117 alone was transacted through a current account held at Ujjivan Small Finance Bank between 29 November 2025 and 3 May 2026.
Who Was Arrested and What Was Their Role
The arrested accused, Arikul Islam, a resident of Basubati village in Hooghly district, West Bengal, allegedly opened a current bank account in the name of a charitable trust he had registered. He then reportedly handed over that account to an absconding co-accused in exchange for a commission of ₹50,000. Such 'account mule' arrangements are increasingly common in organised cyber fraud networks, where individuals profit by lending financial infrastructure to criminal operations.
Two earlier arrests in the same case — Ritik Bali, 26, and Tinku Parmar, 44, both residents of Badnagar in Ujjain district, Madhya Pradesh — had already been made before Islam was apprehended. At least one accused remains absconding.
Legal Sections and Investigation Details
A case was registered at the Cyber Crime Police Station under Sections 318(4), 336(2), 338, 336(3), 340(2), 61(2) and 3(5) of the Bharatiya Nyaya Sanhita, 2023, as well as Sections 66(C) and 66(D) of the Information Technology Act (amended 2008). The arrest was made following technical investigations led by Police Inspector M.C. Nayak, acting on directions from senior officials.
Cyber Crime Branch Advisory to the Public
The Cyber Crime Branch issued a public advisory urging citizens not to download APK files or applications sent by unknown individuals under the guise of RTO challans, banking services, customer support, KYC updates, government schemes, appointment bookings, or grocery delivery. Police also cautioned against clicking on suspicious links received via SMS or email.
Victims of financial cyber fraud were advised to immediately dial the national cybercrime helpline 1930, as prompt reporting significantly improves the chances of freezing funds in beneficiary accounts before they are withdrawn. This case is part of a broader surge in APK-based mobile fraud across India, where fake government or utility apps are weaponised to gain remote access to personal devices.
Point of View
Another recruits account mules, and a third handles the cash-out — all operating across different states. The ₹50,000 commission paid to Islam for a current account is negligible relative to the ₹24.4 lakh haul, yet it is enough to attract participants who may not fully grasp their legal exposure. The involvement of a charitable trust account raises a harder question — how easily can financial infrastructure meant for public good be co-opted by criminals, and are banking KYC norms adequate to flag unusual current-account activity in small trusts? The Surat Cyber Crime Branch's cross-state reach is commendable, but with one accused still absconding, the case is not closed.
NationPress
14 Oct 2026
Frequently Asked Questions
How did the fake RTO e-challan APK fraud work?
The fraudsters sent the victim a counterfeit RTO e-challan application called E-Chalan.apk and persuaded them to download it. Once installed, the app was used to hack the victim's mobile phone, enabling the accused to transfer ₹24.4 lakh across three bank accounts without the victim's knowledge.
Who has been arrested in the Surat RTO APK fraud case?
Three people have been arrested so far: Arikul Islam, 54, from Hooghly district in West Bengal, and earlier, Ritik Bali, 26, and Tinku Parmar, 44, both from Badnagar in Ujjain district, Madhya Pradesh. At least one accused remains absconding.
What was Arikul Islam's role in the fraud?
Islam allegedly opened a current bank account in the name of a charitable trust he had registered and handed it over to a co-accused in exchange for a commission of ₹50,000. The account at Ujjivan Small Finance Bank was used to route ₹12,42,117 of the stolen funds.
What should people do to protect themselves from APK-based scams?
Police advise citizens never to download APK files or apps sent by unknown persons under the pretext of RTO challans, KYC updates, banking services, or government schemes. Suspicious SMS or email links should not be clicked. Victims should immediately call the national cybercrime helpline 1930 to improve the chances of freezing stolen funds.
Under which laws were the accused charged?
The case was registered under Sections 318(4), 336(2), 338, 336(3), 340(2), 61(2), and 3(5) of the Bharatiya Nyaya Sanhita, 2023, as well as Sections 66(C) and 66(D) of the Information Technology Act, as amended in 2008.
