Indian Railways has revealed that more than half of all online train ticket booking requests received in the last six months were generated by bots. (Image enhanced using AI)
IRCTC online train ticket booking: Indian Railways said it has taken several steps to protect its online reservation ticket booking system from cyber attacks and hacking tools that automatically fill booking forms. In the last six months, the system received an average of 15.38 billion requests, of which 8.88 billion were identified as bots. This means more than half of all online ticket booking requests were generated by bots.
In a written reply in the Lok Sabha on July 22, Railway Minister Ashwini Vaishnaw shared details of suspicious attempts that were blocked from accessing the IRCTC e-ticketing system during the last six months. “Average for last six months: Out of 15.38 billion requests, 8.88 billion were bots(57.74%),” he said. Here is a look at the official data:
The Railway Minister also informed the Lok Sabha that the Railway Protection Force (RPF) arrested 22,676 touts between 2021 and June 2026. He said legal action was taken against them under the relevant provisions of the Railways Act, 1989.
The Union Minister also shared details of the measures taken to curb fraud in online Tatkal ticket bookings:
- Aadhaar authentication to book tatkal tickets
Indian Railways now allows only Aadhaar-authenticated passengers to book Tatkal tickets online. Aadhaar OTP verification has also been introduced to prevent fake accounts, agent misuse, and automated bookings, and to make Tatkal ticket allocation more fair and transparent.
- Application layer Security Control
The national transporter also introduced multiple security measures to stop hacking, brute-force and DDoS attacks on the online ticket booking system. The Railways has also deployed anti-bot tools, firewalls, intrusion prevention systems and web application security layers to block suspicious users and ensure smoother booking for genuine passengers.
Also Read | New IRCTC website beta version is now live: Here’s how to access it
- Network and Infrastructure Layer Security Controls
Vaishnaw further said that online ticket booking system is protected by high-availability infrastructure, firewalls, intrusion prevention systems, anti-bot tools and other cybersecurity measures. The system is also equipped with DDoS (Distributed Denial of Service) protection with a capacity of nearly 30 Gbps, while specialized agencies monitor the deep and dark web and provide digital risk protection and cyber threat intelligence support.
Story continues below this ad
- Physical Security Controls
The e-ticketing system is hosted at a dedicated data centre in Chanakyapuri, New Delhi. The facility is secured with CCTV surveillance, restricted physical access, and is ISO 27001-certified for information security management.
- Security Audit and Monitoring
The IRCTC ticketing system is connected to CERT-In for round the clock monitoring of security incidents and cyber threats. A dedicated on-site security team also continuously monitors system logs to detect and respond to suspicious activities.