Ghanshyam Kumar, a twenty-eight-year-old e-rickshaw driver in New Delhi, was pushing his heavy metal vehicle through suffocating, forty-degree heat. He had to push it alone for nearly seven kilometers.
Moments earlier, his e-rickshaw had died right in the middle of a chaotic, horn-blaring street. His passengers refused to pay their fares, stepped out, and walked away. Ghanshyam thought the motor had fried. He did not know that a teenager standing on the sidewalk had just used a free smartphone app to switch off his battery with a single tap.
This is not a scene from a cyberpunk thriller. It is the reality on Indian streets in July 2026.
A wave of bizarre wireless hijacks has hit India's massive fleet of budget electric vehicles. It has exposed a massive security blind spot in the country's clean energy migration. It has also slammed the brakes on a fragile economic thaw between New Delhi and Beijing.
The App that Froze New Delhi's Streets
Over the last few weeks, social media feeds in India have been flooded with viral videos. They show pranksters approaching moving e-rickshaws, tapping their phones, and watching the vehicles stall instantly.
The technical exploit is embarrassingly simple.
Most low-cost electric three-wheelers in India rely on lithium-ion batteries imported from China. To keep costs low, Indian importers buy budget batteries that use cheap Chinese Battery Management Systems (BMS). These systems feature built-in Bluetooth transmitters meant to let owners monitor voltage and temperature.
But there is a fatal flaw. The manufacturers forgot to include basic authentication.
Anyone within a fifteen-meter range can download standard utility apps. Apps like BAT-BMS, Epoch Li-ion, or SMART BMS automatically scan for nearby batteries. Because there are no passwords or PINs, anyone can connect to the vehicle's battery pack. With one click on the virtual "discharge switch," the power to the motor is cut.
The driver is left stranded. The vehicle will not turn back on unless the person with the app toggles the switch again.
From Internet Prank to Street Extortion
What started as an obnoxious social media trend quickly turned into a racket.
In Ujjain, Madhya Pradesh, local police caught a group targeting struggling drivers. The crew would remotely disable an e-rickshaw, wait for the panicked driver to check the engine, and then offer to "fix" the problem for a cash fee of two hundred rupees. To a driver who earns barely five hundred rupees a day, that is a devastating blow.
The Ministry of Electronics and Information Technology (MeitY) quickly ordered Google and Apple to pull seven of these battery management apps from their Indian stores.
This ban is a temporary patch. It does not fix the physical hardware already running on Indian roads.
Anyone who has already downloaded the app can still use it. It does not even require an internet connection to work. Sideloading the software takes seconds. The underlying issue is not the software. It is the insecure, unencrypted physical hardware spinning through Indian cities.
The Geopolitical Irony of India's EV Push
This security mess arrives at a highly sensitive diplomatic moment.
New Delhi has spent the last few years attempting to decouple its critical supply chains from Beijing. Following the deadly border clashes in 2020, India implemented strict rules requiring government approval for any investments from countries sharing a land border.
These rules successfully blocked major Chinese EV giants. BYD's proposed one-billion-dollar manufacturing plant was flatly rejected.
Indian leaders wanted to protect local auto giants like Tata Motors and Mahindra & Mahindra. They wanted to build a domestic supply chain.
But while India successfully blocked the front door to multi-billion-dollar Chinese car factories, it left the back door wide open.
Cheap, unvetted Chinese components flooded the grey market. Budget three-wheeler assemblers relied entirely on cheap Chinese imports to meet the skyrocketing demand for green mass transit.
It created a bizarre paradox. The premium electric SUV sector is heavily guarded and protected. Meanwhile, the actual workhorses of India’s mass electric migration are running on unencrypted Chinese logic boards.
Why Indian Safety Testing Failed
How did thousands of wirelessly hijackable vehicles get certified for public roads?
The blame lies with outdated regulatory frameworks. India’s current automotive safety standards focus almost entirely on physical and thermal safety. Testing facilities check if a lithium battery will catch fire in extreme summer heat. They check if it can survive a crash.
They do not check if the battery can be hacked by a teenager with a basic smartphone.
As vehicles become more connected, the line between consumer electronics and heavy machinery is dissolving. A battery is no longer just a chemical tank. It is an internet-of-things device. Treating it as a dumb component is a dangerous mistake.
What Needs to Happen Next
Banning apps on the Google Play Store is like trying to stop rain with a paper napkin. If India wants to secure its electric vehicle ecosystem, it needs to take direct, aggressive action.
First, the Ministry of Road Transport and Highways must mandate basic cybersecurity baselines for all electric vehicles. No vehicle should receive road-worthiness certification if its wireless communication systems lack cryptographic authentication. If a battery has Bluetooth, it must require a unique, physical PIN code to pair.
Second, local manufacturers need to step up. Indian battery pack assemblers must stop importing bottom-shelf, unencrypted BMS units from overseas.
They need to transition to secure local alternatives or demand that their Chinese suppliers patch the firmware on existing inventory.
Finally, there must be a recall and patch system. The government should collaborate with local service centers to flash the firmware of vulnerable batteries already on the street.
If we do not secure these basic systems, the transition to green energy will remain incredibly fragile. A smart country cannot build its transport future on unencrypted foundations.
