Delhi's Electric Rickshaws Are Being Hacked via Bluetooth, and Nobody Has to Be a Programmer to Do It

Key points

• Delhi banned new non-electric auto rickshaws from January 2027, with new petrol motorcycles and scooters following from April 2028.
• IQAir ranked Delhi's urban area the most polluted on Earth in 2025.
• Around half of India's auto rickshaws are already electric, compared with roughly 4 percent of four-wheeled vehicles.
• Starting in July 2025, criminals used free Bluetooth apps to remotely disable electric rickshaw batteries and extort drivers.
• Indian authorities ordered Google and Apple to remove certain Chinese battery management apps, but experts warn dozens of similar tools still exist.

Delhi has roughly 95,000 auto rickshaws registered in its territory, the three-wheeled taxis that dart through every neighbourhood and carry millions of passengers a day. The city also has a severe air pollution problem. In 2025, the air quality monitoring service IQAir ranked Delhi's urban area as the most polluted on Earth.

So Delhi's government decided to act. From January 2027, no new petrol or gas-powered rickshaws will receive licences. From April 2028, the same rule extends to motorcycles and scooters, putting more than six million small vehicles on a slow path to extinction.

How does hacking a rickshaw even work?

Criminals found a startlingly simple method. They downloaded free battery management apps, which are pieces of software originally designed to let mechanics check a vehicle's battery status. Then they walked or drove through traffic scanning for electric rickshaws whose battery packs broadcast an open Bluetooth signal, the same short-range wireless connection that links your phone to a speaker. With no password protecting those signals, the app let a scammer send a command to switch the battery off entirely, stopping the vehicle dead in the street.

Some then approached the stranded driver and demanded cash to switch the battery back on.

Videos of rickshaws stopping suddenly in the middle of Delhi traffic spread widely in July 2025. India's government moved quickly, ordering Google and Apple to pull certain Chinese-made battery management apps from their stores.

But that has not closed the gap. Sandeep Kumar Shukla, director of the International Institute of Information Technology Hyderabad, told ABC News Australia the problem runs deeper than a handful of listed apps: "Anybody can write such an app and share it." He added that battery packs are imported and fitted into vehicles "without any cybersecurity compliance check" and that India currently has no formal standard against which to measure them.

Should ordinary passengers and drivers be worried?

Yes, though the immediate risk falls mostly on drivers. A stopped rickshaw means a stranded passenger, lost earnings, and a potential extortion demand. For now the attacks appear opportunistic rather than organised, but the underlying weakness, open Bluetooth on a battery pack with no authentication, affects a large share of Delhi's electric fleet.

Drivers are also wrestling with the cost of switching. Electric rickshaws run between 250,000 and 300,000 rupees (roughly 3,700 to 4,400 US dollars), and many drivers already carry loans. Charging is another obstacle: Amit Bhatt of the International Council on Clean Transportation says access to home chargers is limited, with resident welfare associations nervous about fire risks and no clear regulations to reassure them. At one Delhi public charging station, a machine's screen listed four batteries as ready; when a driver requested one, a pop-up said none were available.

Rickshaw drivers, led by welfare groups, are planning a legal challenge to the January 2027 deadline. As Indrajeet Sachdeva, who has driven a rickshaw in Delhi for decades, put it: "This policy is like bringing a mongoose to kill a snake. What will we do if the mongoose kills us?"

The city's chief minister's office did not respond to a request for comment.