Back at Baruch: our latest Scam Search Party with the ISACA Cybersecurity Club

On Tuesday, November 10, 2026, students from Baruch College's ISACA Cybersecurity Club met in person for a Scam Search Party and worked two live scams. One is a fake India traffic-fine site that asks for a vehicle registration number and then tries to install an Android app. The other is a Fortnite V-Bucks offer that hides a fake Epic Games login behind a puzzle.

Thank you to Baruch College's ISACA Cybersecurity Club for hosting the party with us.

A group of students and CSRF team members standing and kneeling together in a classroom after a Scam Search Party, with a Cybersecurity Reach Foundation banner and an investigation board on a screen behind them. — Participants at the November 10, 2026 Scam Search Party with Baruch College's ISACA Cybersecurity Club.

A fake e-challan text that tries to install an app

The scam starts with a text message. It says a vehicle was caught on CCTV and tells the recipient to pay the fine online through an ln[.]run short link.

That link leads to a fake "Road Transport Digital Verification Portal," with Indian government and e-challan branding. Students found that it copies three logos from the official site. The same kind of text has been reported with different links and plate numbers from several Indian states since November 5, 2026. The page's domain, 3tyo6ms[.]garden, was registered that same day.

A webpage titled Road Transport Digital Verification Portal, with Indian government and e-challan logos, a registration number field, and a blue VERIFY NOW button. — The fake site is titled "Road Transport Digital Verification Portal." It shows government and e-challan logos and a box that says "Enter Registration Number" and "VERIFY NOW."

The page asks for a vehicle registration number. Enter one, and it starts a download of Challan.apk. After that, it gives step-by-step instructions to allow installs from unknown sources. The page says, "If Play Protect shows a warning, choose “Install anyway” to continue."

A prompt with a red heading Additional Check Needed, the vehicle number 7777777, the status Review in progress, the text Please install the official app to finish the process, and Cancel and Proceed buttons. — After a number is entered, a prompt headed "Additional Check Needed" says "Please install the official app to finish the process." The number 7777777 was typed by students as a test, not a real plate.

Scam Search Party board for the Traffic fine CCTV footage case, investigated live on Tuesday, November 10, with 8 of 8 questions answered on the left, credited to Sultan, Diyora, Dhruv, Pammi, and Daniel, and a map of the evidence on the right. The board shows 36 cards, 23 connections, and 10 investigators. — The Scam Search Party board for the Traffic fine "CCTV footage" case: 8 of 8 questions answered, 36 cards, 23 connections, and 10 investigators.

Students ran Challan.apk through VirusTotal, a public service that checks files against many security vendors. Seven of those 65 vendors flagged the app as a banking trojan, including Kaspersky and ESET. A similar fake e-challan text urging people to download an APK had already been reported on r/pune.

A VirusTotal file report for Challan.apk with a score of 7 out of 65 and a red banner reading 7/65 security vendors flagged this file as malicious. Threat categories listed are dropper, trojan, and banker. — VirusTotal's report for Challan.apk shows that 7 of 65 security vendors flagged the file as malicious, with the threat categories dropper, trojan, and banker.

Do not install an app from a link in a traffic-fine text. If you need to pay a fine, open the official site by typing the address yourself. Do not use a link from a message.

See the full investigation on the Scam Search Party board.

Read how this scam works in the ScamArchive entry on fake e-challan texts.

A Fortnite V-Bucks offer that hides a fake Epic login

The second case is epic-treasure[.]info, registered on November 6, 2026, four days before the party, with the owner's identity hidden behind privacy masking.

The page's lure is, "Get 13,500 V-Bucks for your first check." A "Tap the targets" puzzle sits in front of the real page. The puzzle is there to keep out automated visitors, including security scanners and the bots that Google Safe Browsing and antivirus companies use. Behind it is a fake Epic Games login page. Students found that only the email login option works. Students also ran the page through VirusTotal, which flagged the URL as phishing.

A dark page headed Tap the targets, asking the visitor to click shapes in the order shown in a thumbnail strip, with a noisy puzzle image and a progress reading 0 / 4. — A "Tap the targets" puzzle appears in front of the page, with the instruction "Click the shapes in the order shown in the thumbnail strip."

Behind the puzzle, the site shows a page headed "Sign in to Epic Games," with an email field, a Continue button, and buttons for other sign-in methods.

A dark box with a warning icon, the heading Method Not Eligible, the text This login method is not participating in the current promotion. Please sign in using your Epic Games email and password to claim the reward, and a Sign in with Email button. — Choosing a console or other sign-in method brings up "Method Not Eligible" and the line "Please sign in using your Epic Games email and password to claim the reward."

Scam Search Party board for the Epic Treasure case, dated Monday, November 9, with 4 of 4 questions answered on the left, credited to akin and Gent, and a map of the evidence on the right. The board shows 30 cards, 24 connections, and 10 investigators. The hosting IP address on two cards is blurred. — The Scam Search Party board for the Epic Treasure case: 4 of 4 questions answered, 30 cards, 24 connections, and 10 investigators. The hosting IP address on two cards is blurred.

A free V-Bucks offer that asks you to sign in with your Epic Games account is phishing. Do not enter your Epic login, and do not pay. Open Fortnite or Epic Games only through the official app or an address you type yourself.

See the full investigation on the Scam Search Party board.

Read how this scam works in the ScamArchive entry on the fake Epic Games login.

What you can do

Do not install apps from links in traffic-fine texts, including Challan.apk. If your phone or Play Protect warns you not to install an app, stop.
Pay traffic fines only on the official site you type in yourself. Do not use a link from a text or email.
Treat any free V-Bucks offer that asks for an Epic Games login as phishing. Use the official Fortnite or Epic Games app, or type the official address yourself.

Join the next Scam Search Party

Scam Search Party is a free, live group investigation. Each session, we pick a real suspected scam and trace it together on a shared board. No experience is needed.

The next party is on Tuesday, November 17, 2026, from 7 to 8 PM ET, on Zoom. Anyone can join: Sign up for the November 17 Scam Search Party.

Thank you

Thank you to Baruch College's ISACA Cybersecurity Club, and to everyone who took part:

Maria Antonov (president, Baruch College ISACA Cybersecurity Club), Sam Karasev (secretary), Omar Portillo-Carrillo (vice president), Aaron Ramawad, Antony Wu, Arib Khan, Dahshur Utley, Daniel Beltran-Vera, Diyora Alimukhamedova, Hayley Penafiel, Jasmin Cruz, Kelvin Ng Mo, Mirsultan Murakhmedov, Rawnak Chowdhury, Syeda Rahman, Tahmid Hossain, Vincent Do, and CSRF team members Leonard Melnik, Gent Gazheli, Stefanie Cohen, and Pammi Balani (also a Baruch ISACA member).