Train ticket scams: fake IRCTC apps, 'confirmed Tatkal' agents and refund calls

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Diwali and Chhath trips bring fake booking apps, social media agents promising confirmed seats and callers offering to speed up refunds. Book only on IRCTC or at railway counters, and know how refunds really reach you.

01 / Why the festive rush draws ticket scams

Diwali and Chhath trips in October and November mean long waiting lists and a scramble for Tatkal seats. Scammers sell the one thing you want most: a confirmed berth.

Most reserved tickets are now bought online. The Railways Ministry told Parliament in March 2026 that about 88% of reserved tickets are booked online, and that IRCTC deactivated 3.04 crore user accounts in 2025 while weeding out fake and suspicious IDs. The ministry says its checks on ticketing touts are stepped up during festivals and holidays, and it advises the public not to buy tickets from unscrupulous elements.

02 / The scams to expect

• Fake booking apps and APK files. In August 2023 IRCTC warned that fraudsters were mass-sending phishing links urging people to download a fake "IRCTC Rail Connect" app. IRCTC said the fake app and website were used to steal net banking, UPI and card details. See how APK malware spreads on WhatsApp.
• "Confirmed Tatkal" agents on social media. A WhatsApp, Telegram or Instagram contact takes an advance for a "guaranteed" seat, then sends nothing or a ticket that isn't real. Remember that authorised agents are barred from booking opening-day Tatkal in the first 30 minutes of the window.
• Tickets booked on someone's personal ID. IRCTC has warned that it is illegal for agents to book on personal user IDs, and such tickets can be cancelled.
• Fake customer care and refund calls. After you cancel, someone "from IRCTC" offers to speed up your refund if you share an OTP, scan a QR code or install an app. RBI warns that helpline numbers shown by search engines may be fake.

03 / Book only through official channels

• Use irctc.co.in or the official IRCTC Rail Connect app from Google Play or the Apple App Store, as IRCTC advises. Type the address yourself. Never install an app from a link.
• Link Aadhaar to your IRCTC profile. Since 1 July 2025, only Aadhaar-authenticated users can book Tatkal on the IRCTC website and app, and since 15 July 2025 an Aadhaar OTP is also needed for online Tatkal.
• At a counter or authorised agent, Tatkal needs an OTP sent to the mobile number you give. Read the SMS first. A bank, UPI or card OTP is never part of booking a ticket.
• Check an agent's ticket. IRCTC says a ticket from an authorised agent carries the agent's name, address and agency code on the first page. "Normal User" at the top means it was booked on a personal ID.
• Verify the PNR yourself on the IRCTC app or by calling Rail Madad on 139, whose enquiry menu gives PNR status.
• Take IRCTC helpline numbers only from irctc.co.in, as IRCTC advises.

04 / How IRCTC refunds actually work

Under IRCTC's published refund rules, refunds go back automatically to the account you paid from. Nobody needs your card, PIN or phone to send them.

• You cancel an e-ticket online, up to chart preparation. The fare, minus cancellation charges, is credited to the account used for booking.
• Fully waitlisted e-ticket after the chart is made: your name is dropped and the fare, minus a clerkage charge, is refunded to the same account.
• Train cancelled: a full refund is credited automatically. You don't need to cancel or file a TDR.
• After the chart, you claim through an online TDR (Ticket Deposit Receipt) from your own IRCTC login. The zonal railway decides the claim, not IRCTC.
• Confirmed Tatkal tickets get no refund on cancellation.

If a caller says your refund is stuck and needs a "verification" payment, a QR scan or a screen-sharing app, hang up. RBI says receiving money never needs a QR scan or PIN.

05 / Paid a fake agent or installed a fake app?

• Call 1930 at once and file under Financial Fraud on cybercrime.gov.in. The government says 1930 helps with prompt reporting and, where possible, freezing of fraudulent transactions. See our 1930 complaint guide.
• Call your bank on its official number to block cards and UPI. Our list of bank fraud helpline numbers can help.
• Keep evidence: the agent's number and profile, chats, payment screenshots and UTR numbers.
• Uninstall any app a stranger sent you, and change your IRCTC, email and banking passwords from a clean device.
• No money lost? Report the number or link on Chakshu, or check a message first with our scam check.
• Railway complaints go to Rail Madad: 139, the Rail Madad website or app, or SMS.

06 / Your train ticket checklist

• Book on irctc.co.in, the official Rail Connect app or a railway counter.
• Never install an app or APK sent in a message.
• Link Aadhaar to your IRCTC profile before Tatkal day.
• Don't pay social media "agents" for confirmed seats.
• Check agent tickets for the agent's name and code, not "Normal User".
• Verify every PNR yourself.
• Refunds return to the account you paid from, with no call needed.
• Never share a bank, UPI or card OTP, or your PIN.
• Lost money: 1930 and cybercrime.gov.in, then your bank.