India Asks Google and Apple to Drop BAT-BMS and 6 Other Apps

India’s IT Ministry has ordered Google and Apple to remove seven battery management apps from their stores, including the Chinese-made BAT-BMS, after viral videos showed pranksters using the apps to remotely switch off moving e-rickshaws over Bluetooth.

MeitY Secretary S Krishnan confirmed on Friday, July 3, 2026, at the CII Cybersecurity Summit in New Delhi that two of the apps had already been taken down. Government sources told Indian outlets that notices covering all seven had gone out to both the Google Play Store and the Apple App Store. The move targets an unusual intersection of consumer app misuse and weak default security on low-cost electric vehicle batteries, and it puts the spotlight on a single setting that e-rickshaw drivers were never told to change.

What BAT-BMS and the Other Six Apps Actually Do

BAT-BMS is the app at the centre of the controversy. It is a real, legitimate battery management tool developed by China’s Shenzhen Grenergy Technology, and it has been listed on both Google Play and Apple’s App Store for years. The app pairs over Bluetooth Low Energy with compatible lithium battery packs, displays live voltage, current, temperature, charge cycles and per-cell health, and lets the user toggle the battery’s discharge function on or off.

That last control is what makes BAT-BMS useful, and what makes it dangerous in the wrong hands. It is the same toggle a battery technician flips when servicing a solar array or a marine battery bank. India Today’s reporting, citing explanations circulating on X, says some low-cost lithium battery packs used in Indian e-rickshaws run Bluetooth-enabled BMS units with little or no password protection, so anyone within range can pair with the battery and write the discharge-off command.

The other apps named in the MeitY notice are SMART BMS, LOSSIGY, Epoch Li-ion (also reported as Epoch-i-ion) and three further applications that sources did not publicly identify by name. The Indian Express named BAT-BMS, Lossigy and Epoch Li-ion as the apps it could confirm in the takedown. Times of India, citing PTI, listed BAT-BMS, Lossigy and Epoch-i-ion as the three it had confirmed.

How a Single App Switches Off a Moving E-Rickshaw

The viral videos show a smartphone, a Bluetooth scan and a tap on a discharge switch. The e-rickshaw’s dashboard then goes dark and the driver is left stranded in traffic. There is no malware, no network attack and no spoofed tower. The app is doing exactly what its developer designed it to do.

The vulnerability sits in the hardware, not the app. Many low-cost lithium battery packs sold for Indian e-rickshaws use Chinese BMS chips that ship without authentication turned on. Dealers hand over the vehicle without configuring a password. The pack broadcasts itself over Bluetooth Low Energy, and any compatible app can pair with it on demand. Once paired, the app exposes the master discharge switch. Flipping that switch cuts power to the motor and the vehicle stops. The full mechanics of the Bluetooth trick are laid out in how the BAT-BMS Bluetooth trick works in practice.

1. Open the BAT-BMS app within roughly 15 metres of a parked or slow-moving e-rickshaw whose BMS has no password set.
2. Select the exposed battery from the Bluetooth scan list inside the app.
3. Tap the discharge function toggle to write the discharge-off command to the BMS.
4. The e-rickshaw’s motor loses power, the dashboard goes dark and the driver is stranded until the battery is toggled back on.

Catching a moving rickshaw on Bluetooth is hit and miss. India Today notes the attacker has to be close, stationary and lucky enough to find an unsecured compatible battery. Drivers stopped at lights or in slow traffic are the easiest targets, because the Bluetooth handshake completes faster than the vehicle moves out of range. A driver pushing through dense traffic at speed usually outpaces the connection.

Which E-Rickshaws Are Actually Exposed

The viral clips make it look as though any e-rickshaw on the road can be stopped at will. That is not what is happening. The vulnerability sits at the intersection of three conditions: a lithium battery, a Bluetooth-enabled BMS, and no password set. Without all three, BAT-BMS has nothing to talk to.

Lead-acid battery e-rickshaws, which still make up a sizeable share of the Indian fleet, have no Bluetooth at all and are unaffected. Many lithium-battery e-rickshaws use proprietary battery management software that talks only to the manufacturer’s own app. Those are also unaffected. The vulnerable pool is narrower than the videos suggest, but it is still large, made up of budget lithium packs imported with default-open Chinese BMS firmware. The full technical breakdown is laid out in the BMS hardware flaw behind the prank.

The Drivers Paying the Price for the Prank

The prank is not abstract for the drivers caught in it. India Today NE reported that drivers across multiple cities had lodged complaints about sudden vehicle stoppages, and that the action traces its origins to complaints from e-rickshaw operators about unexplained battery-related disruptions. Some drivers were paying bystanders and mechanics out of pocket to fix vehicles that had nothing mechanically wrong. The dashboard clears the moment the battery parameters are toggled back on through the app.

Delhi Transport Minister Pankaj Singh said officials had been directed to examine the matter after complaints reached the department, India Today NE reported, even though no formal written complaint had been submitted. Times of India, citing PTI, said some drivers had claimed they had to pay strangers to help restart their vehicles after being targeted. Delhi’s Transport Department has launched an inquiry covering BAT-BMS and a second app called Epoch Li-ion, according to Delhi’s parallel inquiry into the BAT-BMS app.

The notice from MeitY itself, framed by sources who spoke to the MeitY notice covering BAT-BMS and six other apps, told Google and Apple the applications were being misused in ways that could enable the remote disabling of batteries in e-rickshaws and other vehicles.

There are a couple of apps which came to our notice yesterday. Both of them have been taken down from the app stores. The idea is that this is due care that the app stores have to exercise, and we will take it up with the app stores to see that possibly damaging apps do not come up.

MeitY Secretary S Krishnan, speaking at the CII Cybersecurity Summit on 3 July 2026.

MeitY’s Notice and What Happens Next

The notices tell Google and Apple to delist BAT-BMS, SMART BMS, LOSSIGY, Epoch Li-ion and three further apps from their stores. Sources told India Today that the action is aimed at preventing the misuse of software that can interfere with EV batteries and pose risks to vehicle owners and operators. The government’s notice to Google and Apple lays out the broader BAT-BMS crackdown.

Government officials told CNBC TV18 that unauthorised access to a vehicle’s battery management system can already be prosecuted under Sections 43 and 66 of the IT Act, with penalties of up to three years’ imprisonment and a Rs 5 lakh fine. MeitY is also assessing whether restrictions on unsecured BMS hardware should be put in place for safety, sources told The Indian Express. How BAT-BMS connects to a lithium battery over Bluetooth is detailed in CNBC TV18’s reporting.

Neither Google nor Apple had issued an immediate public response. India Today Tech reported on 1 July 2026 that BAT-BMS was no longer available on Apple’s App Store, though similar battery management apps continued to exist, and that the original BAT-BMS application remained visible on Google Play at the time of that report.

A Broader EV Security Gap

The BAT-BMS episode has drawn cybersecurity specialists into a wider argument about how India’s electric mobility stack is being assembled. The issue is not a sophisticated cyberattack, sources told The Indian Express, but the exploitation of weak security settings on connected battery systems. India Today reached the same conclusion: the misuse stems from gaps in the hardware, not from flaws in the BAT-BMS application itself.

Cybersecurity specialists have argued for years that connected battery systems should include stronger pairing mechanisms, encryption and user authentication to prevent unauthorised access. India Today notes that electric scooters, motorcycles and cars sold by established manufacturers use more secure BMS hardware that requires authenticated access through authorised applications and encrypted communication, and cannot be reached simply by downloading BAT-BMS. The risk is concentrated in the low-cost segment where connected battery systems are increasingly common but security protocols are weak or inconsistently implemented.

Krishnan told NDTV Profit that the government would take up the broader issue with app stores to ensure damaging applications do not come up in the public domain. The takeaway for now is narrow. BAT-BMS and its six sibling apps are being pulled from stores, but the unconfigured BMS chips already inside thousands of budget e-rickshaws will still be there tomorrow.

Frequently Asked Questions

Should I delete the BAT-BMS app from my phone?

Removing the app removes the immediate tool, but the underlying risk sits in any e-rickshaw or two-wheeler with an unsecured Bluetooth-enabled BMS, not on the user’s phone. Deleting BAT-BMS does not lock down the battery it was paired with.

Does BAT-BMS work on every e-rickshaw?

BAT-BMS only works against batteries that have a compatible Bluetooth-enabled BMS and no password protection. Lead-acid battery e-rickshaws and most proprietary lithium systems are unaffected, so the vulnerable pool is narrower than the viral clips suggest.

What should I do if my e-rickshaw suddenly stops mid-ride?

Toggle the battery’s main circuit breaker off and back on after a few seconds before cycling the ignition. If the problem persists, reconnect through BAT-BMS and re-enable both the charge and discharge functions, CNBC TV18 reports.

Have Google or Apple responded to the MeitY notice?

Neither Google nor Apple had issued an immediate public response as of 3 July 2026, India Today reported. BAT-BMS was no longer available on Apple’s App Store, though the original application remained visible on Google Play.