A prank can kill your e-rickshaw mid-road

BAT-BMS is a real app for monitoring e-rickshaw batteries: charge, voltage, temperature, cycle life, over Bluetooth. It also has a discharge switch, meant for the owner. On budget battery packs that switch has no password, so anyone within roughly 15 metres can connect and flip it. Videos of teenagers doing exactly that, killing e-rickshaws mid-road for laughs, went viral across India this week. The Ministry of Electronics and IT ordered the app pulled from both app stores days later. The switch it exploited is still open on every vehicle that shipped with it.

What is actually going on

The trend has a name on social media: tirri control, after the Hindi slang for e-rickshaw. Someone opens BAT-BMS, waits for a nearby e-rickshaw's battery to show up over Bluetooth, connects with no password prompt, and taps discharge switch. The vehicle loses power on the spot, sometimes in the middle of traffic. Drivers on Delhi's Metro corridors have described paying strangers Rs 100 to 200 to reconnect and switch the power back on, because that is faster than waiting for roadside help.

Online, it is framed as karma for reckless driving. Offline, a driver stuck mid-lane with no power is also a driver the vehicle behind him cannot predict.

How a monitoring app becomes a kill switch

BAT-BMS is made by Shenzhen Grenergy Technology and does what it says: it reads a lithium battery's state of charge, voltage, current, temperature, and cycle count over Bluetooth 5.0, at a range of roughly 15 metres. Inside the battery, that data comes from the same Battery Management System that also controls a MOSFET, a transistor switch that gates power leaving the pack. The app exposes that switch as "discharge switch," for an owner who wants to immobilise their own vehicle against theft.

The problem is what that interface leaves out: no pairing, no password, no check that the phone asking to flip the switch belongs to the vehicle's owner. Whoever is in range gets the same access as the owner. And because the switch cuts power at the battery, not at the motor controller, there is no speed check either. It can fire while the vehicle is moving.

The government moved on the app. Not on the switch.

The Ministry of Electronics and Information Technology ordered BAT-BMS removed from the Play Store and App Store, along with three other apps built on the same kind of BMS: SMART BMS, LOSSIGY, and Epoch Li-ion. MeitY secretary S Krishnan confirmed the apps had been pulled as a precaution while the ministry investigates. Delhi's transport department opened its own inquiry, and state transport minister Pankaj Singh said switching off someone's vehicle without consent is illegal, and that police were expected to act on it. BAT-BMS alone had crossed 100,000 downloads on Google Play before it came down.

This is an IoT bug wearing a prank costume

Strip away the e-rickshaw and this is a familiar shape: an actuator reachable over Bluetooth with no authentication. Early smart locks and smart plugs had the same flaw, open GATT writes and no bonded pairing, and researchers walked up and unlocked doors that were never supposed to be reachable from the sidewalk. The difference here is what the actuator is attached to. Cutting power to a smart plug is annoying. Cutting power to a moving vehicle's motor is a physical safety event.

India already has a real safety standard for these batteries. AIS-156, enforced through the Central Motor Vehicles Rules since December 2022, covers thermal runaway, IP67 water and dust protection, and cell-level protection circuits. It says nothing about who is allowed to send the battery a command over the air. Fire risk and range are regulated. The remote-access risk was not on anyone's checklist until a viral trend put it there.

What actually fixes it

None of this needs new physics. It needs the BMS to stop trusting whoever is nearest:

• Bonded, encrypted pairing instead of an open Bluetooth GATT connection anyone can write to
• The discharge command gated behind an owner key or a physical presence check, not a bare app button
• A motion interlock that refuses any discharge cutoff above 0 km/h and only allows a controlled ramp down
• Signed firmware, with remote discharge switched off by default instead of on

The reporting on this trend already found the fix sitting on shelves. Newer, better battery packs ship with a "Remote Control Lock" or "App Control Lock" that blocks unpaired devices, plus a password an owner can set. The gap is not that the fix is unknown. It is that the cheapest packs, the ones running the largest share of India's e-rickshaw fleet, ship with it off.

Why a build studio cares

Delhi alone has 232,000 registered e-rickshaws on the road, out of 620,718 registered three-wheelers total, and industry forecasts put India's electric three-wheeler fleet near 4 million by 2030. Every one of those vehicles is a candidate for whatever BMS its cheapest supplier used. That is the same math as any product with a shared, unpatched component: the risk does not scale with how many people know about it, it scales with how many units shipped.

We build products that talk to hardware over Bluetooth and other short range radios more often than clients expect. The checklist above is the one we run before anything ships: authenticate the connection, gate the dangerous command, default to the safe state, and never let "off" be a feature a stranger can reach for free. Cheap hardware treats security as an upgrade. It has to ship as the default, because the discount version is the one that ends up in the largest fleet.

Next step: if your product wires up any actuator, a lock, a switch, a motor, over Bluetooth or another short range radio, run it against the four points above before it ships, not after a viral trend finds the gap for you. Read more on the takedown from Business Standard and the original report from Times of India. If you want a second pair of eyes on your own Bluetooth-connected product, write to us at hello@gattyworks.com.