India’s cybercrime watchdog has flagged a fresh phishing campaign targeting highway commuters searching for FASTag services online.
The National Cybercrime Threat Analysis Unit (NCTAU) under the Indian Cyber Crime Coordination Centre (I4C) has issued an advisory after identifying fraudulent websites impersonating the National Highways Authority of India (NHAI) FASTag Annual Pass service.
According to the advisory, these phishing sites are not spreading through random links alone — they are being promoted via Google Ads and boosted with search engine optimisation (SEO) to appear at the very top of search results, including Rank 1 for keywords such as “fastag annual pass” and “fastag recharge”.
ALSO READ: FCRF Is The Knowledge Partner For India’s AI Impact Summit 2026 On Deepfake Crime
What the advisory says: Why this scam is dangerous
The warning is significant because it highlights a growing trend: criminals are “meeting users where they search” — using advertising and SEO to make fake portals look like the most legitimate option.
The advisory notes that the phishing websites mimic the branding, layout, logo and content of official FASTag services to create authenticity.
On the visual advisory, I4C also illustrates how “Google Ads + SEO” creates high visibility and pushes users into financial fraud.
Modus operandi: How the FASTag Annual Pass scam is executed
I4C’s NCTAU lays out a clear playbook used by the scammers:
- Impersonation of a legitimate government service
The fraudulent portals are designed to look and feel like official NHAI FASTag pages, using similar branding elements to lower suspicion. - Search engine manipulation + paid ads
Cybercriminals use advanced SEO so the fake site ranks prominently on Google. In addition, they run paid Google Ads to further amplify credibility and visibility. - Deceptive payment flow using QR codes
Once a user lands on the phishing site, they are prompted to pay for a supposed FASTag Annual Pass. During payment, a QR code is displayed, and the funds are diverted to mule bank accounts. - Rotation of mule accounts to evade detection
To make tracing harder, the mule accounts linked to the payment page are changed periodically, delaying financial tracking and law enforcement action.
Key safety takeaway: “Top result” doesn’t mean “true”
A central message of the advisory is blunt: high ranking on Google or appearing as a sponsored ad does not guarantee legitimacy. Users must remain cautious, especially while making payments.
This is particularly relevant for FASTag-related searches because users are often in a hurry (recharge, renewal, travel planning) — the exact situation scammers exploit.
What users should do: Precautions recommended by I4C
I4C’s advisory lists practical steps that commuters should follow:
Use only official channels
- Access FASTag Annual Pass services only through the official NHAI website or the Rajmarg Yatra app (available on Google Play Store and Apple App Store)
- The advisory notes the app has a dedicated section for buying, viewing, renewing and tracking the Annual Pass
Verify URLs carefully
- Check the URL before entering any personal or financial details.
Treat ads and search results as “untrusted”
- Don’t assume legitimacy just because the link is on the first page or marked as “Sponsored.”
Independently validate links
- Links found via search results, ads, emails, or messages should be validated through official government portals before making payments
If you’ve paid on a suspicious FASTag site: report immediately
The advisory urges victims or potential victims to report quickly:
- Report to the National Cyber Crime Reporting Portal (cybercrime.gov.in), or
- Call the cybercrime helpline 1930
Why this advisory matters
This case is a textbook example of how phishing has evolved beyond suspicious SMS links. The scam’s strength lies in its distribution: ads + SEO ensure the fraud reaches users at the moment of intent — when they are actively searching for FASTag services.
For commuters, the safest practice is simple: avoid clicking on FASTag-related ads, and rely on verified official portals and the Rajmarg Yatra app for annual pass services.
