IRCTC Refund Scam 2026: Fake Indian Railways Cancellation SMS and "Agent" Calls

The SMS arrives the day before your train. “IRCTC: Your PNR 6271XXXXXX has been cancelled due to operational reasons. To claim ₹2,140 refund, click: [link]”. You did book a ticket. The PNR looks like a real PNR (10 digits, starts with 6 or 8 like the real ones do). You half-believe it. You tap the link.

The fake-IRCTC-refund scam is one of the highest-volume scam SMS categories in India in 2026. It works because Indian Railways genuinely cancels trains for weather, track work, or operational reasons several times a week, and refund processing is something every traveller has either dealt with or has been told about. The scam structure is parasitic on a legitimate operational reality.

This guide walks through how the scam actually works, what real IRCTC refund processing looks like, the three signals that catch every variant, and what to do if you’ve already engaged.

What the scam looks like end-to-end

Three redacted SMS examples from real submissions to ScanTotal’s SMS Scam Analyzer over the past 30 days:

The PNR changes. The amount changes. The link changes. The structure does not. Three components are always present: a recognised brand (IRCTC or Indian Railways), a refund amount in the plausible-looking range (₹500-₹5,000), and either a link to a non-IRCTC domain or a 10-digit mobile number for a callback. Sometimes all three are in the same SMS.

How real IRCTC refunds actually work

The most important fact to internalise: real IRCTC refunds are automatic and reach the original payment source without you doing anything. Whether you cancelled the ticket, the train was cancelled by Indian Railways, or the journey was disrupted, the refund flows back to the bank account, card, or UPI ID you used to book.

The actual mechanics:

1. For passenger-initiated cancellation, you log in to IRCTC (via the app or website), navigate to “Booked Ticket History”, select the PNR, and tap “Cancel Ticket”. The applicable cancellation charges (per the Indian Railway Conference Association schedule) are deducted, and the balance is credited back to the original payment source.
2. For Railways-initiated cancellation (train cancelled by Railways for any reason), the refund is processed automatically. You don’t need to file a Ticket Deposit Receipt (TDR), claim it, or click anything, the system credits the full ticket amount back to the source within 3-7 working days.
3. For partially-disrupted journeys (train was diverted, you didn’t travel, etc.), you may need to file a TDR online through IRCTC’s own portal. This is the only refund category that requires explicit action, and even this is done by you, on IRCTC’s own website, not through a link in an SMS.

The legitimate IRCTC website is irctc.co.in, and the booking subdomain is www.irctc.co.in or rail.irctc.co.in. The IRCTC Rail Connect app is the only legitimate mobile app (search the Play Store or App Store for “IRCTC Rail Connect”, the publisher is “Indian Railway Catering And Tourism Corporation Limited”). Every other domain, irctc-refund.online, indian-railways-refund.in, irctc-cancel.xyz, railway-pnr-refund.com, is impersonation.

The three signals that catch every variant

The AnyDesk variant, the most damaging

The link-only variant of the IRCTC scam leads to a fake payment page that grabs your card or UPI details, bad, but bounded by the amount you can authorise in one transaction. The call-back variant escalates much further.

Here’s how the call-back scam typically progresses. The victim calls the number in the SMS. A friendly “agent” answers, asks for the PNR, “confirms” the cancellation, and says the refund can be processed immediately if the victim helps with a small system step. The agent then asks the victim to install AnyDesk or TeamViewer (always framed as a “customer-support tool” or “our company app”).

Once installed, the scam operator can see the victim’s screen and remotely control their device. The agent walks the victim through opening their banking or UPI app for a “small ₹2 verification transfer”. While the victim does that, the operator:

• Reads the victim’s account balance and card details visible on the screen.
• Initiates additional transfers in the background using the same authenticated session.
• Captures any OTP that appears on screen, by reading the notification before the victim sees it.
• In some cases, captures the victim’s UPI PIN by typing on their behalf during the session.

The total loss in single AnyDesk sessions regularly exceeds ₹5 lakh in confirmed police FIRs. The scam works because the “agent” is patient, friendly, and never visibly malicious, the victim genuinely believes they’re being helped through a refund process, and the catastrophic transfers happen in the seconds when the victim’s attention is on the “test” transfer.

If you've already engaged

The response steps depend on how far the engagement went:

If you only tapped the link but didn’t enter anything: close the page, don’t enter anything, and you’re probably fine. The risk is low but consider running a quick mobile-malware check and clearing your browser’s recent history just to be cautious.

If you entered card or UPI details: immediately call your bank’s anti-fraud line (on the back of your card or in your banking app) and block the card or UPI. Then call 1930 and file at cybercrime.gov.in.

If you installed AnyDesk / TeamViewer or shared your screen: this is the highest urgency.

1. Disconnect your phone from the internet immediately (turn on aeroplane mode).
2. From a different device (a friend’s phone or a computer), log in to your banking app, freeze the account or block all transactions if your bank offers that.
3. Uninstall AnyDesk / TeamViewer and reboot the phone.
4. Call your bank’s anti-fraud line and report unauthorised access; ask them to immediately freeze the account and dispute any pending transactions.
5. Call 1930. Mention specifically that AnyDesk / TeamViewer was installed, this affects how the helpline classifies the case.
6. File at cybercrime.gov.in with all the evidence.
7. Change every password (banking, email, UPI PIN, work logins) from a different device, not from the compromised phone.
8. File an FIR at your local cyber-crime cell within 24 hours.

The respectful reality about IRCTC

The Indian Railways and IRCTC carry over 23 million passengers a day. Cancellations, delays, and refund processing happen at industrial scale. IRCTC’s own app and website have improved meaningfully over the past five years, the booking flow is fast, the refund flow is automatic, and customer-care channels are answered. The scams exist because the brand is universally trusted and the refund process is well-understood enough that a fake one sounds plausible.

The defence is straightforward. Real IRCTC will never call you to process a refund. Real IRCTC will never send an SMS asking you to click a link to claim a refund, refunds are automatic. Real IRCTC will never ask you to install AnyDesk or any other remote-access tool. Any deviation from this is a scam, full stop, regardless of how official the SMS or the caller sounds.