New Delhi: An image obtained by the420 from social media has triggered serious questions about the possible exposure of vehicle-owner information, FASTag balances, transaction histories and time-stamped toll-plaza crossings through an apparently private WhatsApp-based service called “C-TRACE.”
The promotional image claims that users can obtain an RC owner’s details, FASTag balance, complete FASTag history and toll-crossing information through “one quick lookup.” It describes the service as being “built for lawful investigation” and states that it does not encourage leaked or unauthorised data.
However, researchers at the Centre for Police Technology (CPT) have flagged significant techno-legal, privacy and national-security concerns arising from these claims. CPT researchers believe the matter requires immediate examination by the Ministry of Home Affairs, Ministry of Electronics and Information Technology, and Ministry of Road Transport and Highways, along with NPCI, NHAI, Indian Highways Management Company Limited, FASTag-issuing banks and relevant law-enforcement agencies.
The image does not mention any government department, statutory approval, official website, authorisation number, privacy policy, grievance officer or verifiable agreement with a FASTag issuer or transport-data authority.
the420 has not independently confirmed whether the bot is operational, whether the displayed results represent genuine records, or whether C-TRACE has received any restricted governmental or institutional authorisation. The image itself establishes only that such capabilities are being promoted on social media—not that the service functions as advertised.
A “Movement CDR” for Vehicles?
The gravest concern is the claimed ability to reveal toll-plaza crossing history. A single toll record can establish where a vehicle was present at a particular time. Multiple records can reconstruct routes, routines, relationships and sensitive visits.
In effect, this could create a pattern-of-life record comparable to a call-detail record for a vehicle. If made available without lawful authority, such information could potentially be misused for stalking, extortion, corporate espionage, targeted attacks or unauthorised surveillance of police officers, public officials and other protected individuals.
FASTag is part of the National Electronic Toll Collection ecosystem involving NPCI, NHAI, toll operators and issuing banks. Vehicle owners can legitimately obtain their own balances and transaction statements through authenticated bank applications, portals and registered-mobile channels. Police and authorised agencies may seek relevant records through legally sanctioned processes.
That does not automatically authorise an opaque third-party WhatsApp bot to provide another person’s identity, financial information or travel history.
Disclaimer Cannot Replace Authorisation
The statement that the platform was built for “lawful investigation” cannot by itself establish legality. A genuine restricted investigative platform should be able to demonstrate its legal ownership, government or institutional approvals, authorised data sources, user-verification procedures, purpose limitations, supervisory controls and immutable audit logs.
Investigators must determine whether C-TRACE is:
- A legitimately authorised and access-controlled investigative platform
- An unauthorised data aggregator
- Using compromised or insider-enabled credentials
- Combining scraped vehicle data with leaked financial or location records
- Merely making exaggerated or fabricated marketing claims.
If unauthorised access to computer systems or databases is established, Sections 43 and 66 of the Information Technology Act may become relevant. Unauthorised contractual disclosure could also attract Section 72A, depending upon the source of the information and circumstances of disclosure. FASTag-linked financial information may additionally fall within the sensitive-data framework under the 2011 SPDI Rules.
The Digital Personal Data Protection Act also represents an important emerging compliance framework, although most of its core processing provisions are scheduled to become enforceable under the notified phased commencement timeline in May 2027.
CPT Calls for Immediate Government Inquiry
Researchers at the Centre for Police Technology have urged the concerned ministries and agencies to identify the service operator, verify its claimed authorisations and preserve relevant digital evidence before access logs can be altered or deleted.
The inquiry should establish who created C-TRACE, where its servers are hosted, how users are verified, which databases are queried, whether lookups are monetised and how many vehicle records may have been accessed.
Meta and WhatsApp may also be requested, through competent legal authority, to preserve the account’s registration, business-verification and access records.
Until these questions are answered, citizens and investigators should not treat C-TRACE as an official government platform or share vehicle numbers, personal information or payments with the service.
The real investigation is no longer about whether a WhatsApp bot looks sophisticated. It is about whether someone has quietly constructed a private bridge into India’s restricted vehicle, payment and movement-data ecosystem and who authorised that bridge.
Follow the Centre for Police Technology on LinkedIn to stay updated on the latest developments in policing, cybersecurity, digital forensics, investigations, fraud risk management, and technology-driven public safety.
https://www.linkedin.com/company/policetechnology/
