BAT-BMS app hits battery 3-wheelers with prank, but how does it switch off vehicles

A series of viral videos showing people stopping moving e-rickshaws using a smartphone has sparked fresh concerns about the security of electric vehicles in India. The clips, which have been widely shared on X, claim that a mobile application called BAT-BMS can connect to nearby battery-powered three-wheelers and switch them off while they are on the road. While the videos have alarmed many users, the reality is more complicated than the claims being made online.

The BAT-BMS app is real and is designed for a genuine purpose. Developed by Chinese company Shenzhen Grenergy Technology, it is a Battery Management System (BMS) monitoring app that allows users to keep track of Bluetooth-enabled lithium batteries. It displays information such as battery charge, voltage, current, temperature, cycle life and the health of individual battery cells. It also lets users control charging and discharging functions on compatible batteries.

The growing concern is not about the app itself, but how some people are reportedly misusing it. According to explanations shared by Grok to some of the X users, several low-cost lithium battery packs used in some Indian e-rickshaws come with Bluetooth-enabled BMS units that have little or no password protection. If such a battery is left unsecured, anyone standing within Bluetooth range—roughly 10 to 15 metres—may be able to connect to it and turn off the battery's discharge function. Since the discharge function supplies power to the motor, disabling it can immediately stop the vehicle.

This is exactly what many of the viral prank videos appear to demonstrate. Drivers suddenly lose power in the middle of traffic, leaving them stranded and potentially creating a safety risk for themselves and other road users.

Despite the panic on social media, there is no evidence that BAT-BMS can connect to every electric vehicle. The app only works with batteries that have a compatible Bluetooth-enabled Battery Management System.

Many e-rickshaws still run on traditional lead-acid batteries, which do not support Bluetooth connectivity. Even among lithium-powered vehicles, several manufacturers use proprietary battery management systems that require their own dedicated apps rather than BAT-BMS. In such cases, the application simply cannot communicate with the battery.

The app also does not automatically discover or take control of every nearby vehicle. The battery itself must support Bluetooth Low Energy (BLE), broadcast its presence and be compatible with the BAT-BMS platform before any connection can be made. This means the viral claims suggesting that anyone can instantly switch off any nearby e-rickshaw are misleading. Only vehicles fitted with compatible Bluetooth-enabled battery systems are potentially exposed.

A security issue rather than sophisticated hacking

The incident has nevertheless raised an important cybersecurity question for the growing electric mobility industry. The issue is not sophisticated internet hacking but poor security settings on certain battery systems. According to Grok's explanation, many inexpensive Bluetooth-enabled BMS units are shipped with weak authentication or no password at all. This makes it possible for someone nearby to pair with the battery and access controls that should ideally remain restricted to the owner.

The misuse shown in the viral videos appears to rely on this weakness rather than exploiting any advanced software vulnerability. The app itself was created to help battery owners monitor and manage their batteries, but if the hardware lacks proper authentication, it can be abused by others within Bluetooth range.

Cybersecurity experts have long argued that connected battery systems should include stronger pairing mechanisms, encryption and user authentication to prevent unauthorised access. As electric vehicles become more connected, securing battery communication will become increasingly important.

Drivers using Bluetooth-enabled lithium batteries are also advised to enable strong passwords if their system supports it and avoid leaving the battery open to unrestricted Bluetooth connections.

Meanwhile, India Today Tech has noticed that the BAT-BMS app is no longer available on Apple's App Store, although similar battery management apps continue to exist. The original BAT-BMS application, however, remains visible on Google's Play Store.

- Ends