Every October, two things arrive together in India — Diwali sales and Diwali online shopping scams. The moment Flipkart’s Big Billion Days and Amazon’s Great Indian Festival go live, fraudsters roll out fake websites, WhatsApp lucky draws, and UPI traps built to empty your bank account while you’re busy hunting for discounts. Police cyber cells issued fresh advisories on October 9, 2026, warning shoppers about the spike. I’ve watched these scams evolve every festive season, and this year’s versions are slicker than ever. This guide covers everything: the 9 scams running right now, a 10-point checklist to run before every single payment, and exactly what to do if you’ve already been hit.
Why Diwali Sale Season Is Prime Time for Scammers
Scammers love Diwali sales for the same reason you do — everyone’s buying. Here’s why fraud shoots up every October:
Urgency kills caution. Flash sales, countdown timers, “only 2 left in stock” — sale pages are engineered to make you act fast. Scammers copy the same playbook. When you’re rushing to grab a deal before it vanishes, you stop checking URLs and start clicking. That’s exactly the moment a fake checkout page does its damage.
Volume hides fraud. Millions of transactions happen daily during the sale season. A few thousand fraudulent ones blend right into that noise, and it takes longer for banks and payment systems to flag suspicious patterns when everything is spiking at once.
New shoppers enter the market. Every Diwali, lakhs of first-time online shoppers — often parents and older relatives with new smartphones — make their first digital purchase. They’re the least equipped to spot a fake site and the most likely to trust a “customer care” number pulled from a Google ad.
The discounts are real, so fake ones look real. When genuine stores offer 60% off, a scammer offering 75% off doesn’t trigger alarms the way it would in March. Your mental price anchor is already broken during sale season, and fraudsters know it.
This year the timing is especially hot. With both mega sales live right now and police advisories issued just days ago on October 9, the next few weeks are the peak risk period. Read this guide once, then share it in your family WhatsApp group — seriously, that’s where most victims first encounter these scams.
9 Diwali Online Shopping Scams Running Right Now
These are the frauds cyber cells are actually warning about this season. Learn to recognise each one, because every single one relies on you not looking closely.
1. Fake Lookalike Shopping Websites
The classic that never dies. Scammers clone the look of Amazon, Flipkart, or a popular brand store on a deceptively similar domain — an extra word here, a swapped letter there, an odd ending you’d never notice on a phone screen. The site flashes unbelievable Diwali discounts. You pay, and either nothing arrives or a cheap counterfeit shows up weeks later. The worst of these sites exist purely to harvest your card details for later misuse. The fix is boring but bulletproof: always type the store’s address yourself instead of clicking links from ads, SMSes, or forwarded messages.
2. WhatsApp “Lucky Draw” and Gift Scams
“Diwali Lucky Draw! You’ve won an iPhone — pay ₹99 delivery to claim your prize.” These messages flood WhatsApp groups and Telegram channels every October, often forwarded by well-meaning relatives. The link leads to a payment page designed to steal your card or UPI details, and the so-called delivery fee is just the first theft. Here’s the rule that kills this scam instantly: real brands never announce winnings through random WhatsApp forwards. If you didn’t enter a contest, you didn’t win one.
3. UPI Collect Request Fraud
This one is brutally effective because it flips your expectations. A “seller” on OLX, Instagram, or WhatsApp agrees to your price, then sends a UPI collect request saying “approve this to receive your payment” or “accept to get your refund.” The moment you enter your UPI PIN, money leaves your account. Burn this into your memory: you never need a PIN to receive money — not for refunds, not for payments, not ever. Any collect request asking for PIN approval is a debit. Always. There’s a deeper breakdown of this in the UPI section below.
4. Fake Shopping Apps
Lookalike apps with names like “Flipkart Diwali Sale” or “Amazon Offer Zone” circulate through WhatsApp links and shady download sites, promising exclusive app-only deals. Install one and you’ve potentially handed over SMS access (which means your OTPs), your contacts, and sometimes banking credentials. Genuine sale apps come only from the Google Play Store or Apple App Store, published under the company’s verified developer account. If someone sends you an APK file or a direct download link for a “sale app,” delete it.
5. COD (Cash on Delivery) Order Scams
An unexpected COD parcel arrives at your door, addressed correctly with your name and phone number. A family member pays the delivery person, and inside is a bar of soap, a brick, or an empty box. Your details were likely harvested from a data leak or a previous purchase. This scam works because it exploits trust in the delivery system and the chaos of a busy household during festival prep. The rule is simple: never accept or pay for a COD order that nobody in the house actually placed. When in doubt, refuse the parcel.
6. Social Media Ad Scams
Instagram and Facebook are flooded with slick video ads during Diwali — premium watches at 80% off, designer kurtis for ₹499, “factory clearance” electronics. Many of the stores behind these ads don’t exist in any real sense. They run ads for two weeks, collect prepaid payments, then vanish before the first complaint lands. Before buying from any social media store, check how long the page has existed, look for genuine customer photos (not stock images), and be deeply suspicious of stores that accept only prepaid orders with no COD option.
7. QR Code Refund Scams
“Scan this QR code to receive your refund/cashback.” It sounds convenient, which is why it works. But here’s the technical truth: scanning a QR code and entering your PIN authorises a payment from you, never to you. QR codes are a pay mechanism, not a receive mechanism. Any “refund via QR scan” — whether it comes from a fake seller, a fake customer care agent, or a random caller — is fraud. Full stop. No exceptions.
8. Fake Customer Care Numbers
You face an issue with an order, Google the brand’s helpline, call the top result — and reach a “support agent” who asks for an OTP or remote access to “process your refund.” What you didn’t notice: that top result was a paid ad, and scammers buy those ad slots for major brand names every sale season. Always pull helpline numbers from the official website or the app itself — never from search results, and especially never from the sponsored section at the top.
9. Gift Card and Coupon Fee Scams
“Pay ₹199 to unlock a ₹5,000 Diwali voucher.” The voucher never materialises, or it turns out to be a worthless code that works nowhere. Sometimes the “activation fee” is just a cover for stealing your payment details. Legitimate coupons and cashback offers are always free to claim — any coupon that costs money to unlock is a scam by definition. If a deal needs an entry fee, walk away.
Diwali Scams at a Glance: Red Flags Table
Bookmark this table. If an offer matches any row below, stop and run the 10-point checklist further down before spending a rupee.
| Scam | Biggest Red Flag | What To Do Instead |
|---|---|---|
| Fake shopping website | URL looks almost right but not quite; prices far below market | Type the address manually; check domain age and contact details |
| WhatsApp lucky draw | You “won” a contest you never entered; asks for a fee | Delete and block; real brands don’t do WhatsApp giveaways |
| UPI collect fraud | Asked to enter UPI PIN to “receive” money | Decline immediately — receiving money never needs a PIN |
| Fake shopping app | APK file or download link shared on WhatsApp | Install only from Play Store/App Store verified publishers |
| COD parcel scam | Parcel nobody ordered; pressure to pay at the door | Refuse the parcel; verify with family first |
| Social media ad store | Brand-new page, stock photos only, prepaid-only payments | Check page age and real reviews; prefer COD for unknown sellers |
| QR refund scam | “Scan to receive refund” — QR + PIN combination | Never scan to receive; refunds come to source automatically |
| Fake customer care | Number from a search ad; agent asks for OTP or screen share | Get numbers only from official site/app; never share OTPs |
| Coupon activation fee | Pay a fee to “unlock” a voucher or cashback | Real coupons are free — walk away from paid ones |
Fake vs Genuine: How to Tell the Difference
When you’re staring at a tempting offer, run it through this comparison. Genuine sellers and scammers leave very different footprints.
| What to Check | ✅ Genuine Seller | 🚩 Scammer |
|---|---|---|
| Website URL | Clean, familiar domain you typed yourself | Extra words, misspellings, strange endings (.tk, .xyz, hyphens) |
| Discounts | Big but believable (30–60% during sales) | Absurd (80–95% off premium brands, all year) |
| Contact details | Real address, working helpline, GST info | Only a form, or a mobile number, or nothing at all |
| Payment options | Multiple: cards, UPI, netbanking, COD, EMI | Prepaid only, or pushes you to direct bank transfer |
| Reviews | Mixed reviews over months, detailed complaints and praise | All 5-star, generic, posted within days of each other |
| Pressure tactics | Sale timers, but you can browse calmly | “Offer ends in 10 minutes!”, popups blocking exit |
| Social presence | Old page, real followers, genuine comments | Page created weeks ago, bot-like comments |
The 10-Point Safety Checklist: Run This Before Every Payment
This is the core of this entire guide. Diwali online shopping scams succeed when you skip verification. Make this checklist a habit — it takes two minutes and it works against nearly every fraud type above.
1. Type the URL Yourself — Never Click Sale Links From Messages
If a deal arrives via WhatsApp, SMS, Telegram, or email, don’t tap it. Open your browser and type the store’s address manually, or use the official app. This single habit kills fake-website scams, phishing links, and most lucky-draw frauds in one move. Scammers depend on you clicking; take that away and their whole setup collapses.
2. Inspect the Domain Letter by Letter
On a phone screen, amaz0n-deals.in and amazon.in look nearly identical at a glance. Slow down and read the domain character by character. Watch for swapped letters (rn for m), extra words (amazon-offer-sale), and unfamiliar endings. When in doubt, search the brand name on Google and use the official result — not the ad at the top, the organic result below it.
3. Check for HTTPS — Then Check Everything Else Too
A padlock icon means your connection is encrypted, not that the seller is honest — scammers get free SSL certificates too. So treat HTTPS as the bare minimum, not a trust signal. After confirming the padlock, look for a physical address, a working customer care number, return policies, and GST/company registration details. A legitimate Indian seller will have these; a fly-by-night operation won’t.
4. Verify the Seller, Not Just the Platform
On marketplaces, you’re often buying from a third-party seller, not Amazon or Flipkart themselves. Check the seller’s rating, how long they’ve been active, and read a few 1-star and 2-star reviews — those reveal the real pattern. A seller with 500 ratings and a 4.2 score is usually safer than one with 12 perfect 5-star reviews posted last Tuesday.
5. Question Absurd Discounts on Premium Brands
An 80% discount on a brand that never discounts is not a Diwali miracle — it’s bait. Before buying, check the product’s price on at least two known platforms. If one unknown site is dramatically cheaper than everywhere else, you’re not looking at a deal, you’re looking at a trap. Genuine Diwali discounts are generous but they stay within believable ranges.
6. Never Enter Your UPI PIN to Receive Money
This deserves its own checklist point because it’s the costliest mistake. Refunds, cashback, payments owed to you — none of these ever require you to enter your UPI PIN or approve a collect request. The PIN is only for money going out of your account. If anyone — seller, “bank official,” customer care — tells you otherwise, they’re running a scam. Decline the request and block the number.
7. Don’t Scan QR Codes to Get Refunds
Same principle as above, different wrapper. A QR code you scan authorises a payment from your account. There is no such thing as “scan to receive.” Refunds in India go back to your original payment source automatically — no action needed from you. Anyone asking you to scan something for a refund is lying about what the scan does.
8. Prefer Credit Cards or Capped UPI for Online Shopping
Credit cards offer the strongest buyer protection in India — fraudulent charges can be disputed and reversed through the chargeback process. If you prefer UPI, use an ID linked to an account with a modest balance, or set a low daily transaction limit in your banking app during the sale season. Never shop directly from your primary salary account on unfamiliar websites.
9. Verify Apps Before Installing
Check three things: the developer name (must be the actual company), the download count (real apps have lakhs), and recent reviews (fake apps accumulate 1-star “fraud” warnings fast). Never install shopping apps from APK files or links shared on WhatsApp. And review app permissions — a shopping app has no business reading your SMS unless it’s for OTP auto-fill, and even then, stay cautious.
10. Trust the Pause — Rushed Decisions Are the Real Target
Every scam on this list uses urgency as a weapon: expiring timers, limited stock, “pay now or lose it.” Here’s the truth — genuine Diwali sales run for days, and the same deal (or an equivalent one) will almost certainly still be there in an hour. When you feel rushed, that’s your signal to slow down, not speed up. Close the tab, have some chai, and revisit with fresh eyes. Scammers can’t survive your patience.
UPI Fraud: The One Rule That Protects You
UPI is India’s favourite payment method and, during Diwali, its most abused one. The mechanics are worth understanding because every UPI scam exploits the same confusion.
A UPI transaction needs your PIN only when money leaves your account. That’s it. That’s the whole security model. Scammers survive by convincing you that some incoming payment — a refund, a prize, a buyer’s payment — needs your “approval” via PIN. It never does.
The two weapons are collect requests and QR codes. A collect request is a legitimate UPI feature meant for, say, splitting a dinner bill — your friend requests, you approve, money moves from you to them. Fraudsters weaponise it by framing the approval as “receiving.” A QR code works the same way in reverse of what victims expect: you scan, you pay.
NPCI, which operates UPI, has repeatedly clarified through its awareness campaigns that PIN entry equals payment authorisation. If you remember nothing else from this guide, remember this sentence: PIN dala, matlab paisa gaya.
Practical UPI hygiene for the sale season: keep your primary UPI ID’s daily limit modest, use a separate UPI ID for online shopping if your app supports it, never share your screen during a “support” call, and treat every unexpected collect request as hostile until proven otherwise. For official UPI safety guidance, NPCI’s website publishes updated advisories.
Scammed Already? Your Recovery Playbook — Do This Now
If money has already left your account, speed matters more than anything. Fraud recovery in India has a “golden hour” — the faster you report, the higher the chance of freezing the funds before they’re moved. Follow these steps in order, right now:
Step 1: Call 1930 immediately. This is the national cybercrime helpline, and it’s the single most important number in this guide. Calling within the first hour gives authorities the best chance to freeze the fraudulent transaction. Keep your transaction details handy when you call — UTR number, amount, time, and the fraudster’s account/UPI ID if you have it.
Step 2: File a complaint at cybercrime.gov.in. After calling, register a formal complaint on the National Cyber Crime Reporting Portal. You’ll get an acknowledgement number — save it, because your bank and the police will both ask for it. The portal lets you report financial fraud specifically, and you can track the complaint status online.
Step 3: Inform your bank without delay. Call your bank’s customer care or visit the branch and report the fraudulent transaction. Ask specifically about the chargeback/dispute process for your payment method — credit cards have the strongest reversal mechanism, UPI and netbanking have formal dispute channels too. Get a complaint reference number from the bank as well.
Step 4: Preserve every piece of evidence. Screenshot everything before it disappears: the fake website or ad, chat conversations, payment confirmations, SMSes, the fraudster’s number and UPI ID. Scam sites get taken down fast, and chats get deleted — your screenshots may be the only record. Don’t delete anything, even if it embarrasses you. Investigators have seen it all.
Step 5: Follow up in writing. Visit your nearest cyber cell with your acknowledgement number and evidence if the online complaint doesn’t progress. Keep a written log of every call and visit with dates and reference numbers. Recovery isn’t instant — it can take weeks — but documented, persistent follow-up is what separates resolved cases from forgotten ones.
One honest note: recovery isn’t guaranteed, especially if the money moved through multiple accounts quickly. That’s exactly why the 10-point checklist above matters more than this playbook. Prevention is worth far more than cure here.
5 Safe Shopping Habits for Every Diwali
Beyond the checklist, these habits make you a harder target year after year:
1. Keep sale-season spending on one payment method. Use a single credit card or one UPI ID for all festive purchases. If something goes wrong, you have one statement to audit instead of five. It also makes spotting an unfamiliar transaction instant.
2. Turn on transaction alerts for everything. SMS and email alerts for every debit, no matter how small. Many victims discover fraud days later through statements; real-time alerts shrink that window to seconds. Most banking apps let you set alerts for transactions above ₹1 — do it.
3. Don’t save card details on unfamiliar sites. Yes, it’s convenient. It’s also a stored credential on a server you know nothing about. Use guest checkout or UPI on sites you don’t fully trust, and reserve saved cards for the big platforms you use year-round.
4. Update your apps and phone before the sales. Those pending security updates patch the exact vulnerabilities that fake apps and phishing pages exploit. Ten minutes of updates before Big Billion Days is genuinely protective.
5. Brief your family — especially parents. The most effective scam protection in an Indian household is a five-minute conversation. Show your parents what a fake URL looks like, teach them the PIN rule, and tell them to call you before paying anyone who contacted them first. For more practical guides on staying safe online, browse our latest articles.
Frequently Asked Questions
1. Is it safe to shop on Amazon and Flipkart during Diwali sales?
Yes — the platforms themselves are safe, and their sale prices are genuine. The Diwali online shopping scams don’t happen on Amazon or Flipkart; they happen on fake sites pretending to be them, or through sellers and messages that reach you outside the platform. Shop within the official app or website, check third-party seller ratings, and you’ll be fine.
2. I entered my UPI PIN on a collect request. What now?
Act immediately: call the cybercrime helpline 1930 right away, then file a complaint at cybercrime.gov.in, then inform your bank. Do this within the hour if possible — that’s when fund-freezing has the best chance. Don’t feel embarrassed; this is one of the most common frauds in India and reporting fast is what matters.
3. How can I check if a shopping website is fake?
Run the quick test: read the domain letter by letter, check for a physical address and working helpline, look up the domain’s age, compare prices with known platforms, and check reviews outside the site itself. If the site fails two or more of these checks, don’t buy. When in doubt, stick to platforms you already know.
4. Can I get my money back after an online shopping scam?
Sometimes — it depends on speed and payment method. Reporting to 1930 within the golden hour gives the best chance of freezing funds. Credit card chargebacks have the highest success rate; UPI and bank transfers are harder but still worth pursuing through formal disputes. File at cybercrime.gov.in regardless — your complaint helps pattern-tracking even if individual recovery is uncertain.
5. What is the cybercrime helpline number in India?
1930 — it’s the national helpline for reporting cyber financial fraud, operated under the Indian Cyber Crime Coordination Centre. Save it in your phone right now, before you need it. For non-urgent complaints and tracking, use the National Cyber Crime Reporting Portal at cybercrime.gov.in.
6. Are cash-on-delivery orders safe from scams?
Mostly, but not entirely. COD protects you from paying for nothing — but the parcel scam (unexpected COD packages with junk inside) specifically targets COD trust. Never pay for a COD parcel nobody ordered, and inspect the package before paying when possible. For high-value items, COD from reputed sellers is actually one of the safer options.
Final Word: Shop Smart, Celebrate Safe
Diwali sales are genuinely wonderful — the discounts are real, the festive feeling is real, and there’s nothing wrong with treating yourself and your family. The scammers are simply tax collectors on carelessness, and this guide just made you very expensive to rob.
Remember the three things that matter most: type URLs yourself, never enter a UPI PIN to receive money, and call 1930 the moment something goes wrong. Everything else is refinement.
Now do the most useful thing with this article: share it in your family WhatsApp group — especially with parents and relatives who shop online. The people most at risk from Diwali online shopping scams are the ones least likely to search for a guide like this. You reaching them matters more than any checklist. Happy Diwali, and shop safe.
