Diwali and Festival-Season Online Shopping and Payment Scams in India: Warning Signs, the First Hour and Where to Report

Every year, as Diwali shopping picks up, the same few tricks come back wearing new clothes: a sale that is too good on a website you have never heard of, a text about a parcel you did not order, a “payment request” that asks for your PIN, a customer-care number picked off a search page. This page explains, in general terms, how those tricks work, what the warning signs look like, what to do in the first hour if you have been caught, and where to report. It is not about any one case. Updated 26 October 2026. We opened the government and regulator pages named below on or before that date, and we list at the end what we could not open or confirm.

In short

• Money coming in never needs your UPI PIN, an OTP or a QR scan. RBI, NPCI and CERT-In all say so. If a screen asks for your PIN, money is going out.
• If you have paid or shared a PIN or OTP, call 1930 and your bank’s official number at once. Speed matters. The Ministry of Home Affairs says its system stops fraudsters’ fund movement, and the helpline helps with “prompt reporting and, where possible, freezing”. Nothing is guaranteed.
• Report the same day at cybercrime.gov.in and keep the acknowledgement number.
• Never use a number from a search page or an ad for “customer care”. Use the number on your card, passbook or the company’s own app.
• This Diwali’s payments are not covered by RBI’s new compensation framework. It applies only to transactions on or after 1 January 2027.

Why this season

Festival sales put real discounts, real parcels, real refunds and real bank messages in everyone’s phone at the same time. That makes fake ones easy to hide among them. On 22 October 2026, Digit and The Live Nagpur reported that CyberDost, the awareness wing of the Indian Cyber Crime Coordination Centre (I4C), had warned about fake festive ads that borrow well-known brand names, logos and product photos and lead people to lookalike shopping sites where the payment goes straight to the scammers. We could not open CyberDost’s own post, so please treat that as reported.

Eight common patterns

1. Fake sale ads and lookalike shops. How it works: an ad, a forwarded link or a sponsored search result shows a famous product at a price nobody else offers. The site looks right, but it is a copy, or a shop that exists only to take payments. CERT-In’s advisory on online scams also describes fake online stores that take cash-on-delivery orders and then send a counterfeit or different product. Warning signs: a price far below every other seller, a web address with odd spelling, payment asked by direct transfer or to a personal-looking UPI ID, “only two left” pressure. What to do: open the brand’s own app or type its website yourself instead of tapping the ad; avoid advance payment on unfamiliar sites; CyberDost’s advice, as reported, is to choose cash on delivery where possible so you can see the goods first. Remember that CERT-In warns even cash-on-delivery can be abused by a fake store, so it is a help and not a guarantee.

2. Fake delivery and courier messages. How it works: a text or call says your parcel is stuck, the address is incomplete, or a small fee is due, and gives a link. The page then asks for card details or an OTP. Business Standard described this pattern for India Post-style messages in September 2024: a link to “update the address”, a small payment, then a request for card details, often followed by a phone call urging you to hurry. CERT-In lists a harsher version: a caller or message says a parcel in your name has been seized and threatens arrest unless you pay. What to do: if you ordered nothing, ignore it. If you did, check the order status inside the shopping app or with the courier’s tracking number on its official site, not through the link. A threat of arrest by phone or video is not how any agency works; see our guide to digital-arrest calls.

3. UPI collect and approval requests. How it works: you are told money is waiting for you and a request appears in your UPI app. You are asked to approve it and enter your PIN. Approving a request sends money out. RBI’s consumer-awareness release of 28 January 2022 lists misuse of the “collect request” feature, with messages like “Enter your UPI PIN” to receive money, among the typical frauds. Business Today, quoting an NPCI circular of 29 July 2025, reported that person-to-person collect requests were to stop from 1 October 2025, with merchant collect requests staying for genuine business such as checkout payments. We have not opened that circular ourselves. So an approval request from an individual should now be treated with extra suspicion, and a merchant request is safe only when you started that purchase yourself. Rule: read what the screen says; if it says you are paying, you are paying.

4. QR code scams. How it works: a person you do not know sends a QR code or link and promises a refund, cashback or reward. NPCI’s fraud-awareness page says scanning a QR code and entering a UPI PIN is meant for making payments and not for receiving them. RBI’s 2022 release says the same: receiving money does not need scanning a QR code or entering an MPIN. CERT-In adds a useful habit: check the name of the receiver shown in your app before you pay through a QR code. Do that at shops too, since the name on the screen should match the shop in front of you.

5. Fake customer-care numbers. How it works: after a delivery problem or a failed payment, you search for the helpline and call the first number you see. The “agent” sounds helpful and then asks for an OTP, a card number or for you to install a screen-sharing app “to cancel the order”. RBI’s 2022 release lists fake bank and wallet numbers on web pages, social media and search engines, and says contact numbers found through search engines may be fraudulent. In an RBI awareness clip released on 2 October 2026, the message is to use only the customer-care number listed on your bank’s official website. CERT-In says never to install remote-access software for anyone. What to do: use the number printed on your card or passbook, or the help section inside the official app.

6. Gift, reward and cracker offers. How it works: “you have won a prize”, a gift voucher for a festival survey, or a cracker combo offered on a forwarded link. CERT-In describes lottery and prize scams in which you must first pay a processing fee or “tax”. We did not find an official advisory in 2026 that is specific to online cracker sellers or to gift-card payments, so what follows is our own suggestion: treat any seller who asks for advance payment to a personal account as a stranger, and do not pay any fee in gift-card codes to anyone, ever. Buying crackers from a licensed shop is better for another reason too; our guides Diwali firecracker safety and illegal home firecracker units and cracker storage explain the physical risk of unlicensed stock.

7. Loan-app offers. How it works: festival-time “instant loan” ads promise a quick approval, then ask for an upfront fee, or for access to your contacts and photos. CERT-In describes loan and card scams with attractive terms and advance fees. RBI’s caution of 25 December 2020 says people have fallen prey to unauthorised lending apps with excessive interest, hidden charges, high-handed recovery methods and misuse of agreements to access phone data. It advises verifying the company, never sharing KYC copies with unverified apps, and reporting such apps to law enforcement or on the Sachet portal. RBI also said that a public directory of digital lending apps used by regulated lenders would be on its website on or before 1 July 2025. RBI is clear that this list is only for checking whether an app’s claim to be linked to a regulated lender holds, and that it is based on what lenders submit, without further validation by RBI. We did not open the live directory.

8. Fake gold schemes. How it works: Dhanteras and wedding-season gold buying attracts offers such as “pay now, get extra gold later”, “assured fixed returns in gold” or a digital-gold platform nobody has heard of. SEBI issued a press release on 8 November 2025 (PR No. 70/2025) titled “Caution to public regarding dealing in ‘Digital Gold’”. We could see its title, date and number on SEBI’s site but not the text; news reports of it say SEBI told investors that such products are not securities or regulated commodity derivatives and that its investor protections do not apply. Treat that as reported. RBI’s Sachet portal, launched in 2016, lets the public check which entities are allowed to accept deposits and report illegal deposit-taking. Our suggestion: if a scheme promises a fixed return, ask who regulates it; if the answer is vague, walk away, and get written terms and a proper bill for anything you buy.

Warning signs that repeat

• A deadline or threat: “within one hour”, “your account will be blocked”.
• You are asked for a PIN, an OTP, a CVV, or to scan a code or approve a request to receive money.
• You are asked to install an app, or to share your screen.
• You reached the offer through an ad, a forward or a sponsored result, and you did not start the purchase.
• Payment is to a personal account or a UPI ID that does not match the brand.
• The price, the interest or the return is better than anyone else’s.
• Someone asks you to keep it secret or not to call your bank.

The first hour after a mistake

If you have paid, shared a PIN or OTP, or installed an app, do not spend time feeling foolish. These scams are designed by professionals. Do this, in this order. Steps marked “our suggestion” are our own and not an official rule.

• First minutes: stop. Do not pay anything more, including a “refund fee”, and do not argue with the caller. Our suggestion: if you installed a screen-sharing or unknown app, turn on flight mode or switch off mobile data and Wi-Fi to cut it off, and use another phone for the next calls.
• Call 1930, the national cybercrime helpline. The Ministry of Home Affairs says it was set up to help lodge online cyber complaints, and PIB describes it as helping with prompt reporting and, where possible, freezing of fraudulent transactions.
• Call your bank on its official number and ask to block cards, UPI and net banking. RBI’s guidance is to tell your bank immediately about an unexpected debit and to block all modes of debit, including UPI, and to check whether a new beneficiary was added to your net banking list.
• File the complaint at cybercrime.gov.in and save the acknowledgement number. Have ready the transaction ID or UTR, amount, time, the receiver’s UPI ID or account, phone numbers, links and screenshots. Our suggestion: take the screenshots before you delete anything.
• Same day: change the passwords and PINs you used on that phone, starting with email and banking; remove any app you do not recognise; watch for a sudden loss of mobile signal, which CERT-In says may point to a SIM swap, and call your operator if it happens.
• In writing: send your bank an email or a written complaint with the 1930 and portal reference numbers and ask for a complaint number in return. Time counts under RBI’s rules, as the next section shows.

Where to report

• 1930 and cybercrime.gov.in: any online financial fraud. PIB’s release of 28 July 2026 says I4C’s reporting system has helped save more than ₹11,158 crore in more than 32.80 lakh complaints up to 30 June 2026. That figure counts money stopped from reaching fraudsters in complaints handled, not a promise that any one person will get money back.
• Your bank: on the official number, and in writing. RBI’s Consumer Education pages are at rbikehtahai.rbi.org.in.
• Sanchar Saathi “Chakshu” (sancharsaathi.gov.in): for suspicious calls, SMS or WhatsApp messages where the sender’s number is visible. The portal itself says Chakshu is not for reporting financial fraud or cybercrime where money is lost; use 1930 or the cybercrime portal for that. The Department of Telecommunications says it may act on verified reports.
• Spam calls and messages: Sanchar Saathi says you can report unwanted commercial communication through the portal, the TRAI DND app or by calling or sending an SMS to 1909, and that a complaint made within 7 days of receiving the spam counts as a valid complaint.
• RBI Sachet (sachet.rbi.org.in): for unauthorised digital lending apps and illegal collection of deposits. It is a complaint channel; RBI says complaints are passed to the concerned authorities. Do not wait for it if money has just left your account; call 1930 first.
• National Consumer Helpline 1915 (8 am to 8 pm per its website; WhatsApp +91 88000 01915): for a genuine seller’s non-delivery, a refund dispute or a faulty product. It is not the place to chase a fraudster, and we found no statement of what complaints it takes.
• Police or 112: if you are being threatened, blackmailed or are in danger. See Emergency Numbers in India.

What the rules say about getting money back

Nobody can promise a refund, and rules differ by bank and by how the loss happened. These are the facts we could check. Under RBI’s circular of 6 July 2017, a customer has zero liability for an unauthorised transaction caused by a third-party breach if the bank is told within three working days of its message about the transaction. Between four and seven working days the liability is capped at the amount in a table or the transaction value, whichever is lower. After that it follows the bank’s board-approved policy. Where the loss is due to the customer’s own negligence, such as sharing credentials, the customer bears the loss until the fraud is reported. The bank is to credit the amount back temporarily within 10 working days of being notified. Whether a payment you were tricked into making counts as unauthorised or as negligence is something the bank decides; we could not find a general rule and we give no opinion.

A revised RBI framework was finalised in June 2026. We read the version for payments banks (RBI/2026-27/169, 24 June 2026) on RBI’s site, and Business Standard and MediaNama describe the version for commercial banks. It applies to electronic banking transactions on or after 1 January 2027. It requires reporting to the bank and to the National Cyber Crime Reporting Portal or 1930 within five calendar days, and for gross losses up to ₹50,000 it provides compensation of 85 per cent of the net loss or ₹25,000, whichever is less, once in a customer’s lifetime. It does not cover payments made this Diwali season, and we assume the 2017 rules continue to apply until then. Ask your bank if you are unsure. This is general information, not legal or financial advice for your case.

Everyday safeguards (our suggestions)

• Write your bank’s official helpline and 1930 on paper as well as in your contacts, and put them in the phones of older family members. Our digital-arrest response guide has a family checklist.
• Keep a modest daily UPI and card limit, and switch on alerts, so a single mistake costs less. RBI’s own guidance suggests setting limits on cards.
• Agree a household rule: nobody pays, approves or scans anything in a hurry; take ten minutes and call someone first.
• Do your festival shopping in the shop’s own app or on a website you typed yourself, and pay from there.
• If you are short of money after the festival, read our financial-crisis guide; scammers love people in a hurry for cash.

What we could not confirm

• The home pages of cybercrime.gov.in and sachet.rbi.org.in would not load for us, so the reporting routes come from PIB, RBI and Sanchar Saathi pages. We found no official statement of 1930’s hours of operation and make no claim.
• The CyberDost festive advisory is taken from two news reports of 22 October 2026. The NPCI collect-request circular is taken from a Business Today report. The commercial-bank text of RBI’s 2026 directions did not load for us.
• We could not read the text of SEBI’s digital-gold release, or open the live RBI digital-lending-app directory.
• We found no official 2026 advisory on online cracker sellers, gift-card payments or fake gold schemes beyond what is cited above.
• We looked for Instagram, Facebook and LinkedIn video on these topics. The CyberDost pages there would not open without sign-in, and we could not verify a public URL, so none is listed.

We will update this page as new advisories appear. Updated 26 October 2026. Related reading: digital-arrest calls, how a bank warning interrupted a large digital-arrest fraud, a false director message and large transfers, financial-crisis survival and emergency numbers in India.