WTF, you can view anyones paytm balance if you enter their car number in paytm fastag portal?

WTF, you can view anyones paytm balance if you enter their car number in paytm fastag portal?

I don’t know if its just for people who are on paytm fastag, but i have 2 different cars under 2 different people and numbers and their paytm wallet is balance is visible when is search their car number in paytm app fastag recharge portal!

​

This seems like a serious security lapse????? Can someone please confirm this?

Edit: we can view the WALLET balance guys, not fastag balance.

Edit2: India is a privacy nightmare bruh


View on r/India by giratina143


  1. Same on Google Pay. If you know what the license plate number is and the bank from which the fastag is (usually printed on the tag, which is visible through the windshield), you can see anyone’s fastag balance.

  2. When I was in uni, we could pay fees through paytm portal. When you enter your roll no. You had to confirm your name, phone and some other stuff. CONFIRM, NOT WRITE(It was a checkbox).

    Using this exploit, we knew everyone’s phone number and name just by their roll no. I’m not sure if many people knew this, since we kept this exploit a secret so that people can’t use it for wrong reason. I even raised a complaint to my uni, but nothing was done.

    I’m guessing this is fixed now, or this is a serious data breach. This was 6 years ago

  3. Bro download the Official Challan app (or something similar named I forgot) but you can literally enter any vehicle number and see their traffic challan. Their photo, registered name, vehicle, financier info, etc. EVERYTHING is widely available. its insane.

  4. If they happen to have an HDFC FasTag and you happen to know their date of birth, you can then go to fastag.hdfcbank.com and find out their phone number, name and postal address… and PAN number.

    BECAUSE HDFC DOESN’T ASK YOU TO ENTER ANY OF THIS. IT INSTEAD TELLS YOU ALL THIS AND THEN ASKS YOU TO CONFIRM WHETHER IT IS CORRECT.

    (also you can try 366 times if you know their year of birth, for example if they went to college with you)

    Fucking incompetent privacy-retarded Indian tech stack, man.

    EDIT: and if you know their PAN, you can find their Aadhar because of mandatory Aadhar-PAN linkage requirement of our dear Income Tax department.

  5. * Your post title should be an accurate summary of your text post. “Help Needed”, “Rant”, “Unpopular Opinion”, are examples of poor titles.
    * /r/India is not a substitute for Google. Only post your query on /r/India after you have searched for an answer on the web.
    * Self-posts have to be specific to India. Don’t copy/paste questions from /r/AskReddit or other subreddits.
    * For relationship queries, please also consider: https://www.reddit.com/r/RelationshipIndia/

    *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/india) if you have any questions or concerns.*

Your email address will not be published. Required fields are marked *

Zeen is a next generation WordPress theme. It’s powerful, beautifully designed and comes with everything you need to engage your visitors and increase conversions.