India made cash the villain of tolling — and then shadow software on the digital rail itself printed clean-looking receipts for fraud, at ~100 plazas, for two years, while the national system recorded almost none of it. Police caught the scheme; the audit machinery never did. The lesson cuts against the reflex: the deficit was never cash, it was software nobody audits — and digitising further without fixing that just deepens the cyber risk.
India's national highways collect toll electronically. Over 98% of vehicles pay via FASTag — an RFID sticker linked to a prepaid wallet, read by an antenna as the car passes. This is the NETC (National Electronic Toll Collection) system run by IHMCL, a NHAI subsidiary. The barrier lifts, the fee moves digitally. There is no cash and almost nothing for an operator to steal.
The other few percent — vehicles with no tag, a dead wallet, or a blacklisted tag — hit the manual side of the lane:
Two categories in the official software are keyed entirely by human judgment: exempted (ambulances, dignitaries, defence convoys…) and violation (tag-less vehicles). Nobody counts the cars independently. Remember that — it is the whole story.
In January 2025, UP STF raided the Atraila Shiv Gulam plaza on NH-135 near Mirzapur after a citizen complaint about cash being taken from tag-less vehicles without receipts. What they found was not a greedy booth clerk but a small software firm's work.
Alok Kumar Singh, 35, an MCA who had briefly worked at a toll plaza in 2021, had built a pair of applications — later referred to as 'Mobdata' and 'Any' — and rented them out to collection agencies across the country:
| Element | What it did |
|---|---|
| Client app (booth PC) | Ran on the plaza's own computers alongside the official TMS. Computed the same 2× fee from the public toll schedule. Printed identical thermal receipts on the same printer — drivers had no way to tell. |
| The 5% rule | Only ~5% of non-FASTag transactions were keyed into the official TMS — just enough to make the day's exemption/violation numbers look plausible. The rest existed only in the shadow app. |
| Central monitoring | Per-plaza collections streamed to a central portal and the operator's laptop. One person watched ~40 plazas' cash intake in real time. |
| The money | Cash stayed at the plaza; the developer's share moved through multiple bank accounts and wallets. STF estimated ~₹45,000/day from a single plaza. |
This is the part that should worry anyone who builds or audits digital public infrastructure:
A national certification scheme for toll software exists — STQC's CTS mark, which requires exactly the properties that were missing (tamper-proof databases, audit trails, secure code review). There is no evidence it was ever a procurement requirement for plaza software. That question is now the subject of an RTI request.
| Date | Event |
|---|---|
| 2021 | Singh works briefly at a toll plaza; begins building the bypass. |
| ~2023 | Fraud goes live; spreads to agencies across 14+ states. |
| 22 Jan 2025 | FIR 0017/2025 (Lalganj PS, Mirzapur). UP STF arrests Singh near Varanasi airport; plaza manager and operator held at Atraila. Seizures: laptops, phones, a printer, an MUV. |
| 23 Jan 2025 | STF names 42 plazas across 14 states. NHAI orders all regional offices to check their plazas — most find "no significant evidence". |
| Feb 2025 | Fourth arrest; 150–200 plazas under examination; notices to plaza managers in six districts. |
| Mar 2025 | NHAI debars 14 collection agencies, forfeits ₹100+ crore in performance securities; Gadkari tells Parliament the ETC system itself was never breached. AI audit cameras and ANPR pilots announced. |
| 5 Mar 2026 | A driver's complaint in Baghpat (UP) shows a receipt issued 8:46 PM for an 11:30 AM crossing — the shadow-receipt signature, still alive. |
| Apr 2026 | Cash abolished at all national-highway plazas — FASTag only (UPI at 1.25×). The vector is killed, not fixed. |
| Jul 2026 | Delhi High Court quashes NHAI's debarments and the ₹100+ crore forfeitures: a press note, one confession and statistical inference are not evidence. No agency employee was named in any charge sheet; no shadow software was recovered from the petitioners' plazas. |
| 2–3 Sep 2026 | ED raids 14 premises across 6 states under PMLA: ₹1.03 crore cash, 8 bank accounts. Device forensics: the apps and monitoring portals touched ~100 plazas; receipts "running in crores". |
The named human actors: the developer (Alok Kumar Singh), plaza-level arrests (manager Rajeev Mishra, operator Manish Mishra, a fourth accused Saaban Lal Kumhavat), and two "system managers" — Sawant and Sukhantu — who ran day-to-day operations across the ~42-plaza network. The collection agencies' names are public; their culpability is precisely what the High Court said was not proven — and what the ED case is now trying to establish.
| Fix | Status | Verdict |
|---|---|---|
| Cash abolished at plazas (FASTag/UPI-only) | Live since Apr 2026 | Kills this fraud's vector entirely |
| MLFF barriers-free tolling (violations become digital e-notices) | First RFPs issued; one-plaza pilots | Digitises the exception itself — but scales one plaza at a time |
| Unified ATMS (single national toll-software spec) | RFP Vol-2, May 2026 (239 pp) | No manual lane exists in the successor spec |
| TRAS (remittance alerts to NHAI) | RFP Apr 2023; go-live unknown | Reconciles only what agencies choose to report — blind to unbooked cash by design |
| STQC software certification (tamper-proof DB, audit trail) | Scheme exists | Right control; no evidence it was ever procured for plaza software |
| Independent per-lane vehicle counts (AI audit cameras, ANPR) | Announced Mar 2025; deployment unclear | The one control that would have caught this — still not confirmed live |
The DPI lesson: the scam ran on software, not on cash's existence. Deleting cash lanes deletes the one independent cross-check drivers and auditors had, while leaving lane software that no IT audit has ever inspected. Every new layer — unified plaza software, ANPR, digital notices — is more attack surface with the same near-zero audit capability. The next shadow app will not need a printer.
Why the lane stayed dark: the state was buying data, not control. FASTag was designed as a data system, not a control system. Every NETC transaction clears through two centralised hubs (NPCI and IHMCL), building one of India's largest vehicle-movement databases with bank accounts attached. That data now prices the monetisation machine: toll securitisation, toll-operate-transfer (ToT) concessions and the NHAI InvIT all bid on FASTag-measured traffic. What nobody bought was per-transaction integrity at the lane — so a 10%-volume shadow app ran for two years. The state privatised the upside of collection; the shadow app was the operator privatising the leftover cash. This was argued back in December 2019 — before the mandate — in CashlessConsumer's analysis for The Wire, “FASTag: Will Datafication of India's Tolls Boost Highway Development?”, which flagged exactly this: centralised data without a data-protection law, anonymised instruments rejected in favour of traceability, blacklist geo-fencing potential, and the 4% ETC cut baked into every gazetted fee.
What the system knows about you. Every plaza pass generates: vehicle registration number, tag ID, issuing bank account, plaza ID, timestamp, lane, fee class — visible to your bank, NPCI, IHMCL and the agency. Non-FASTag vehicles surrender more data: the ANPR camera photographs your plate, and the receipt demands your details. CCTV images complete the set. The registry below even shows fee discrimination by home district — monthly passes are cheaper for vehicles registered in the district, meaning the system encodes where your vehicle lives. None of this had a data-protection law over it until DPDP 2023 — the mandate shipped in 2019, four years before the law. There are no published retention limits, no purpose limitation, and no public accounting of who queries the movement database. The Wire's parallel analysis — how economic transactions including FASTag were weaponised for mass surveillance after 26/11 — reads differently now that every post-scam fix (ANPR at every lane, MLFF plate-reading, bank-side VRN validation with blacklisting) deepens the same capture.
The scam is now the justification. Each fix is real — and each expands the dataset. None of the post-scam procurements we reviewed contains a consumer data-governance clause: retention limits, purpose limitation, access logs, or independent audit of who queries the movement database. The fraud is real, and so is the risk that it becomes the standing excuse for a surveillance infrastructure nobody chose.
Update (5 Sep): joining the scam plaza list to IHMCL’s March 2023 plaza master — which records the NETC acquiring bank per plaza (1,233 plazas; export: fastag-tracker-acquirer-ihmcl-2023.csv) — one bank sits under most resolvable scam plazas: IDFC FIRST Bank. Strict matching resolves 18 of 42 plazas; 15 of the 18 (83%) are IDFC-acquired against a network base rate of 39.7% — about 1-in-5,200 by chance. The likely mechanism is selection, not detection: IDFC was IHMCL’s largest acquirer exactly in the small public-funded-plaza segment where this scam lived. And the acquirer only routes tagged transactions — the shadow app’s takings were cash from exempt vehicles, flows that never touch the bank. We read it as a map of where the merchant rail was thinnest, not as evidence of bank-side knowledge. The 2023–25 acquirer register and per-plaza exempt-transaction logs remain an RTI away.
To test how far the scam network reached into the official registry, we parsed IHMCL's National Highway Fee Plaza list (August 2025 — the official NETC plaza registry) from PDF into structured data:
| State | Plazas in registry |
|---|---|
| Rajasthan | 164 |
| Uttar Pradesh | 141 |
| Maharashtra | 102 |
| Madhya Pradesh | 90 |
| Haryana | 82 |
| Tamil Nadu | 81 |
| Andhra Pradesh | 79 |
| Gujarat | 62 |
| Karnataka | 62 |
| Bihar | 42 |
| Punjab | 41 |
| + 11 more states | 145 |
1,129 plazas across 22 states. The scam's footprint touches this registry everywhere: for example, the case's ground-zero plaza —
| Scam plaza (from STF/press) | NETC code | In official registry (Aug 2025)? |
|---|---|---|
| Atraila Shiv Gulam (Mirzapur, UP) — ground zero | 320132 | Yes — still listed |
| Patni Pratappur (Shamli, UP) | 536051 | Yes |
| Baleni/Balaini (Baghpat, UP) — site of the 2026 receipt complaint | 320137 | Yes |
| Faridpur (Bareilly, UP) | 520036 | Yes |
| Nainsar (Gorakhpur, UP) — raided Jan 2025 | 320084 | Yes |
| Madanpur (Assam) — agency later debarred | 378006 | Yes |
| Okha Mandi / Okhamadi (Devbhumi Dwarka, GJ) | 336009 | Yes |
A year after the STF case — and months after the debarments — the plazas remained active NETC collection points. Termination of one agency, it turns out, does not remove the plaza: a new contractor takes over the same booth.
Are any of the scam plazas ToT (institutional-leased) assets? No. The July 2026 official plaza master carries a concession-type marker per plaza (TOT / PF / Conc. / STATE). Cross-walking all 42 Jagran-listed plazas: every legible row resolves to PF public-funded or state-highway authority — zero TOT. Atraila: PF/HAM. The master's TOT-flagged plazas (Saurashtra cluster, Godavari belt, Jhansi–Lalitpur–Rae Bareli = real ToT bundles 11–12, Ranchi, Ghaziabad-Maple) share no name with the scam list. The scam lived precisely where institutional money and 30-year P&Ls are absent — low-bid, two-year user-fee contracts on public-funded plazas, plus state roads outside NHAI oversight entirely.
Primary reporting and documents behind this page (full evidence folder + master dossier in the CashlessConsumer research archive):
Corrections welcome. If you hold documents — court records, ED releases, agency contracts — write to us. Attribution: CashlessConsumer Research, September 2026. This page will be updated when the ED press release and court filings become public.