On May 3, 2026, eighteen-year-old Pranvi Ghai wrote the National Eligibility cum Entrance Test (NEET), India’s fiercely competitive entrance exam for aspiring doctors and dentists. She thought the hard part was over.
But around a week later, the country’s autonomous entrance test conducting agency, National Testing Agency (NTA), ordered a retest (on June 21) after allegations of a question paper leak in the media.
“Students in our circle said that questions are being sold on Telegram groups for as high as INR 1 lakh (around 1,036 USD). My friends and I don’t even use it, but some students claimed most of the questions were from the same PDF sold on Telegram,” Pranvi told Class Central.
Pranvi said she didn’t feel like touching books for days. Unfortunately, she didn’t score well in the retest, and now plans to pursue a bachelor’s degree in dental surgery.
Pranvi was among the 2.28 million Indian students who took the NEET entrance exam. At least 12 to 14 cases of suicide have been reported from across the country after the paper leak trail was found and the exam cancellation was ordered on May 12, 2026.
One took place as late as July 19, days after the NEET result was declared on July 16. Nikhil, from a rural town in Jaipur, was found in his hostel room in Sikar’s Udyog Nagar area. He was preparing for NEET for the last two years.
As anger over the leak spread, a parody account called Cockroach Janata Party (CJP), named after the ruling Bharatiya Janata Party, went viral after Chief Justice of India Surya Kant compared a section of unemployed youth to “cockroaches.”
CJP began a protest at Jantar Mantar, Delhi, led by the founder, Abhijeet Dipke, a 30-year-old political communications strategist and a Boston University graduate. Sonam Wangchuk, a renowned engineer, educator and activist from the Indian Himalayan region of Ladakh, started a hunger strike.
The core demands were the removal of Education Minister Dharmendra Pradhan and accountability for paper leaks like NEET. Pradhan resigned on July 25, thirty days into the protests.
The government linked the source of leaks to Telegram and banned the app to prevent the leak during the week of the re-test. But leaks in India don’t work that way. They don’t stop; they move.
Why the Ban?
The Indian government temporarily blocked the Telegram app for a week (June 16 to 22). It disabled the message-editing feature until June 30, a move criticized for its constitutional overreach and exploitation of people’s digital rights.
Telegram, a messaging app that competes with WhatsApp and Signal, is accused of proliferating dozens of large-scale anonymous channels that were charging as low as $50 per NEET paper set to up to $500. India’s NTA said uncontainable cheating networks and paper-leak syndicates are operating across Telegram, making it difficult to catch hold of them.
On the other hand, people are accusing the government of cornering a specific app and purportedly punishing its 150 million users in India, many of whom have genuine businesses that depend on Telegram for reach and connectivity.
As the India ban kicked in, Telegram CEO Pavel Durov called it, even temporarily, a “mistake”.
“…the ban hasn’t stopped anything. The leaks just moved to other apps. We’ve done a lot to help fix the problem — even though its source is not Telegram,” Durov said in a Telegram message.
Durov’s comments bore significance as digital rights advocates in India called the government’s action against the app short-sighted.
“This is not the first exam to be leaked, and it won’t be the last. Scammers always find loopholes in the system, and there’s always a human element involved — a junior employee who sits for the exam or an insider. With remote access and bugging devices, paper leaks are very much possible. If you ban Telegram in India, people can always find a way around it — through other messaging apps, server access, or internal leaks,” said Prof. Triveni Singh, former IPS officer, cybersecurity expert, and Chairman of the Future Crime Research Foundation (FCRF).
Telegram is notoriously famous among scammers or threat actors for features that perfectly harbor them — wide reach (one can create 200,000-member groups on Telegram), anonymous usernames, and large data (4-gigabyte) sharing. In NEET’s case, one feature, a backdate stamp, made it easy for scammers to fool anxious students and extort money for access to files.
Experts call this Telegram feature the perfect “forensic blind spot” — a scammer sends a blank PDF to a channel before an exam; after the exam starts, they edit it by replacing it with what looks like a leaked question paper. The timestamp remains the same, and it appears the “leak” occurred before the exam, even if it didn’t actually happen.
“No special tools (are) needed to execute this scam; this is basic Telegram functionality, not hacking. India’s NTA confirmed this exact mechanism in June 2026,” said Juan Mathews, a hacker and a cybersecurity expert based in Brazil.
“Telegram’s design flaw is that the “edited” label disappears when the message is forwarded to another group, making the fabricated timestamp look legitimate to downstream viewers. Any scammer with a Telegram account and basic channel admin access can execute this in under 60 seconds.”
Telegram Ban Debate: What’s Wrong? What’s Right?
Telegram has come under fire multiple times globally – mainly in Russia, Brazil, France, Ukraine, and half a dozen others – because of piracy concerns, illegal content, and features that allow the spreading of misinformation and illegal activities. Durov was also arrested in France in 2024 for failing to stop extremist and terrorist groups from using the messaging app.
But questions are being raised over India’s move to target just one platform, which is used by over 100 million Indians — not just by students but by people running businesses on it. After all, India is the biggest market for Telegram (by a huge margin).
There were also doubts about the legality of the move.
“There are enough design features within Telegram that have been used by people to share pirated content, to hide identity. But it’s not hidden,” said Dhruv Garg, a partner at Indian Governance and Policy Project (IGAP), a Delhi-based policy, advisory, and research company.
“In an emergency, the government had grounds to switch it off under the provisions of the Indian Constitution. We can make a principled argument that the government should not do it. But the government will use all the legal mechanisms to manage a particular situation. There should be proportionality. You have to ensure you are not overdoing it.”
Garg agrees with Durov’s point, and believes the platform ban move might not be the foolproof solution.
“There have been reports suggesting that misuse of other platforms has also happened, including WhatsApp and Signal,” he said. “My point is not that the government is wrong but whether it is enough. Should we look beyond digital platforms or one platform?”
Beyond Telegram: How Scammers Hop Platforms
A major question was: why was one specific platform targeted when there’s credible data around the misuse of all messaging platforms?
Experts we spoke to agree the problem is fundamentally with Telegram, but they assert that scammers migrate between platforms when enforcement increases, and end-to-end encryption makes it increasingly difficult for law enforcement agencies to identify them.
Mathews, the Brazil-based hacker, agrees with Durov’s assertion that paper leaks automatically move to other apps as scam networks can rebuild encrypted channels in under 24 hours.
“WhatsApp — with the platform having 850 million users in India — is the obvious next vector,” he said.
WhatsApp Communities support large groups with admin-controlled broadcasting and end-to-end encryption. On Discord, servers have role-based access and paid tiers get exclusive channels. Signal has disappearing messages and encrypted metadata features.
The challenge for investigators is fragmentation, said Mathews, adding that though Telegram’s centralized channel structure lets authorities monitor public channels, WhatsApp Communities and Discord servers are invitation-only, making them harder to discover. Plus, cross-border takedown requests take weeks.
A network that operated a Telegram channel can spin up five WhatsApp broadcast lists and two Discord servers overnight; and charge premium rates for “verified” access. – Juan Mathews (Hacker)
WhatsApp’s misuse spans initial victim engagement, fake investment groups, malware distribution, and spear phishing (a personalized cyberattack that targets specific individuals or organizations with custom messages).
Experts agree that no platform is immune to scammers, and that criminal groups operate across multiple ones.
“The problem is not Telegram itself. It is the entire ecosystem of encrypted, scalable messaging platforms. Telegram is the current epicenter because of its unmatched group sizes, bot automation and anonymous usernames. But criminals are already testing alternatives like Tox, Session and Signal. Migration is not seamless, but it does happen,” Shobhit Mishra, a threat intelligence researcher at CloudSEK, an Indian firm that monitors cybercrime ecosystems, told Class Central.
But how does platform hopping happen? Shobhit explains criminal networks create backup channels in advance with preloaded audiences, allowing them to move within days of a takedown.
“Several underground communities, including the nearly 8,000-member ‘BreachForums Repository’ group and the ‘Angel Drainer’ malware-as-a-service operation, have begun shifting primary activity to other platforms or proprietary messengers, after repeated disruptions on Telegram,” Shobhit revealed.
Enforcement has scattered these groups and made their work costlier, he said, but most have not left Telegram.
“Discord is popular among younger, low-level actors,” he said. “Tox and Jabber are preferred by ransomware operators and corporate database sellers.”
Tracking The Money Trail
The exam scam economy runs on anonymity: VPNs to mask IP origin, burner SIMs purchased via ghost PoS agents — CBI recovered about 21,000 fraudulent SIMs in a single 2026 operation — and crypto wallets or gift cards for payments.
These elements help scammers stay untraceable as they run their operations via messaging platforms.
“The money trail is deliberately fragmented; scammers rent bank accounts from low-income students for ₹5,000-10,000 per month, split UPI payments across multiple wallets, and convert to gift cards for final withdrawal,” Mathews said.
Criminals recruit money mules — people who knowingly or unknowingly allow their accounts to be used for such activities — through platforms like Telegram and WhatsApp and use their accounts in exchange for some commissions. They also buy banking credentials from financially vulnerable people to transfer and receive payments in bulk.
Mule accounts are a big problem for cybercrime agencies in India. Over 2.47 million Layer-1 mule accounts have been flagged so far in 2026, as per the Indian Cyber Crime Coordination Centre (I4C) data.
For such elements, Telegram, being a privacy-first platform, becomes an obvious option by design: from stock market investment to crypto and exam-related frauds, its misuse is rampant,” said Amit Relan, CEO and Co-Founder, mFilterIt, a Gurugram-based ad fraud detection solutions company.
Once a group is banned, they form another community, with a specific list, and since these platforms are end-to-end encrypted, enforcement agencies can’t track them immediately. – Amit Relan
Relan said that scammers have an on-the-ground network of individuals who move money from one account to another without making the transaction appear suspicious.
“Money moves in rented mule accounts, with transfer rights with scammers, and after six to eight transfer stages, funds are withdrawn as cash, crypto, or moved across borders,” he said.
Ground Reality: How the Medical Seat Crunch Fuels Coaching Factories
Investigators believe a real leak did occur, separate from the fake PDFs sold on Telegram. This actual leak gave coaching hubs exam questions before students sat the test.
India’s coaching center economy is also an important part of this puzzle. Two of India’s biggest NEET coaching hubs are in Rajasthan — Sikar and Kota, where around 2-3 lakh (200-300K) students study in 200+ coaching centers. The leak allegedly originated from Sikar, though the investigation is still ongoing.
These centers are under immense pressure to produce top-ranked students, and often many rogue tutors or local branches act as middlemen between wealthy parents and scammers.
“What we know is that 140 of the 180 questions in NEET were part of a ‘guess paper’ of 410 questions. The modus operandi is simple. In Sikar, the students are called in for a mock test a day before the exam, and they prepare for each question in this ‘guess paper’. The students had 140 of the 180 questions prepared, guaranteeing 600 of the 720 marks even before they entered the exam hall,” Maheshwar Peri, Founder and President of Career360, a data-enabled and technology-driven educational products and services company, said via his social handles.
His latest video explains how NEET toppers are traded among multiple coaching institutes and faculty members, with brokers and parents negotiating deals.
The role of coaching institutes across hubs such as Kota and Sikar has been questioned in the controversy, but coaching operators argue they are not the root problem. Instead, they point to the lack of opportunities and the number of medical seats in India.
Coaching is a by-product of a competitive system. In a country like India, where opportunities are limited, and millions of students compete for a small number of seats, coaching will always exist. The financial stakes are so high, people become desperate, and that creates incentives for wrongdoing. — Manoj Kumar Sharma, ScholarCITY Eduventures (Kota)
Around 30 people were arrested in the NEET paper leak case – three members from a single family from Jamwa Ramgarh near Jaipur and others like Manish Yadav from Jaipur and Rakesh Mandawariya, who ran an MBBS consultancy firm in Sikar, RK Consultancy. Despite these arrests, the coaching business is running as usual, say locals.
CBI’s investigation revealed a nexus between some wealthy parents and intermediaries who paid INR 10-25 lakh (USD 10,000-25,000) to get NEET papers for their children. Agencies suspect these parents might have further leveraged this by selling leaked papers to other parents to make more money.
The Solutions to India’s NEET Problem
Experts believe platforms should be responsible for fixing and redesigning product features that are repeatedly exploited.
“Until the underlying incentives of privacy with scale and frictionless distribution are addressed elsewhere, the threat will simply shift, not disappear,” said Mishra, the threat intelligence researcher.
Mathews, the cybersecurity expert, suggests procedural measures: mandatory verified SIMs linked to Aadhaar — already on paper but poorly enforced — and bank transaction reporting thresholds for exam-period UPI flows. On the crypto side, peer-to-peer and unregistered platform trading is a gap that needs to be fixed, he said.
Dr Ramakrishnan Raman, Vice Chancellor of Symbiosis International University, said there’s a need for a revamp of the entrance exam system.
“Today, a student’s future depends on one exam, one rank, one stressful day. And when that system fails – through paper leaks, unfair competition, coaching dependency, or mental burnout – millions suffer. Why should a three-hour exam decide a student’s destiny?
Look at how the GMAT (Graduate Management Admission Test) works globally. It can be taken almost throughout the year. Students choose their preferred date and (get)…multiple attempts if needed. No national panic. No “do-or-die” exam culture. No dependence on leaked papers deciding futures,” he writes on LinkedIn.
Aswini Bajaj, CEO of Leveraged Growth, a Kolkata-based consulting and research advisory, and a chartered accountant (CA) exam teacher, believes online tests with a randomized pool of questions for each paper can stop leaks like NEET, but they have their own cybersecurity challenges.
The fundamental issue that needs attention is policy-level reforms to rectify the examination system.
“One reform worth considering is adopting the IIT (Indian Institute of Technology) admissions model. For engineering, students must meet minimum board examination criteria before they are eligible for admission. They get opportunities not only in top institutions like IITs but also in state-level engineering colleges as well,” said Bajaj.
Is a GMAT-like format a solution to India’s paper-leak problems? He said it’s not an apples-to-apples comparison.
Around 2 to 3 million students appear for NEET every year, compared with about 1.3 million for the IIT-JEE entrance exams. Managing an examination of this size is extremely difficult.
“We fail to understand the population factor. While we should always incorporate global best practices, India has its own unique challenges and needs a customized solution. India also conducts large-scale online exams like CAT. But the capacity to conduct exams for such a large population needs to be strengthened,” said Bajaj.
Sharma of ScholarCITY Eduventures calls for an engineering-like system in medical as well if the government wants to reduce the excessive dependence on a single high-stakes examination like NEET.
“Improve educational infrastructure and bring examination reforms rather than focus on eliminating the coaching business,” he said.
Disclaimer: AI has been used to make infographics and clean transcripts of interviews done with speakers for the story.
The post Banning Telegram Can’t Stop Paper Leaks: Inside India’s NEET Exam Scandal appeared first on The Report by Class Central.