India Today’s OSINT investigation has exposed a widespread online racket involving more than 40 Telegram and WhatsApp groups operating in the black market for IRCTC e-ticketing, especially targeting the Tatkal scheme. However, this network is said to be only a fraction of a much larger illegal ecosystem of agents and tech-savvy fraudsters who continue to thrive despite government regulations.
From July 1, the Ministry of Railways mandated Aadhaar-authenticated IRCTC login for Tatkal bookings, hoping to curb fraud. But the announcement triggered a parallel surge in black market activity, with Aadhaar-verified IRCTC IDs and OTPs being openly sold for as low as ₹360.
India Today tracked one group, “Fast Tatkal Software,” for over three months, exposing how bots and browser extensions are sold to agents. These bots:
-
Autofill IRCTC login, train, passenger, and payment details
-
Complete the entire booking process in under a minute
-
Overwhelm the system, giving agents unfair advantages over genuine users
To evade IRCTC’s AI-based anti-bot system, fraudsters use Virtual Private Servers (VPS) and international numbers to mask identities and IP addresses. Some also guide agents on bypassing AI detection systems.
Popular bots like Dragon, JETX, Ocean, Black Turbo, and Formula One are sold on shady websites for ₹999 to ₹5,000, with tutorials hosted on Telegram. India Today found that one bot, disguised as a WinZip APK, was identified as a Trojan malware capable of stealing user data, according to VirusTotal analysis.
In response, the Ministry of Railways reported:
-
Bot traffic accounts for up to 50% of login attempts in the first 5 minutes of Tatkal booking
-
Over 2.5 crore fake IRCTC IDs have been suspended
-
Agents are now banned from booking during the first 30 minutes of Tatkal ticket windows (for both AC and non-AC)
Despite these crackdowns, the underground bot-based Tatkal economy continues to flourish—posing a serious threat to the fairness and security of India’s digital ticketing infrastructure.
