Festive sale scams: how to spot fake shopping sites, gift links and delivery tricks

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Big sales bring lookalike websites, 'spin the wheel' links, fake courier SMS and refund cons. Shop only inside the official app, never share an OTP or UPI PIN, and know when to call 1930 and when to call 1915.

01 / Why festive sales draw scammers

Diwali falls on Sunday, 8 November 2026, according to the government's holiday list, and the big online sales run in the weeks before it. Scammers work to the same calendar. More orders mean more delivery messages, refunds and deal-hunting, and each is a cover story. Navratri garba has its own: fake passes, 'rent a garba partner' ads and pay-first links. For the festival and deadline dates to watch until 30 November, and the scam to expect on each, see our festival scam calendar.

In September 2025 the Indian Cybercrime Coordination Centre (I4C), part of the Home Ministry, ran a "Scam-Free September" awareness drive with Amazon India. Its core warning: if a message pushes you to act now, pay a fee or confirm a purchase you don't recognise, treat it as a red flag, not a reason to click.

02 / The scams to expect this season

• Fake sale ads with brand logos. I4C's CyberDost account warned on 21 October about ads that copy well-known brands' names, logos and sale designs and lead to lookalike sites, where 'any payment made through them may go directly to scammers', Digit reported.
• Fake '₹8,000 Diwali cash benefit'. The Telangana Cyber Security Bureau warned on 30 October about a WhatsApp message in the Prime Minister's name offering every citizen ₹8,000 through a link. There is no such scheme; do not click or forward it (Telangana Today, The Hans India).
• State police advisories on fake festive sales came from Rajasthan, Panchkula and Jammu and Kashmir police in October (UdaipurTimes, The Tribune, Kashmir Life).
• Digital gold before Dhanteras (6 November): SEBI's caution of 8 November 2025, that 'digital gold' products are outside its regulation, is still the latest regulator statement we found. Several mutual funds paused new investments in gold fund-of-funds from 16 October (fund notices; Business Today). Our view, not an official warning: expect 'gold scheme' pitches to fill that gap, so buy only regulated products.

• Lookalike shopping sites and ads. Ads and forwards lead to sites that copy a well-known brand's look, with prices far below the real sale. You pay, and nothing arrives. The Amazon and I4C advice warns about typo-squatted addresses that differ from the real one by a letter.
• "Lucky draw" and gift links. Before Diwali 2022, CERT-In, the national cyber security agency, warned about festive-offer messages on WhatsApp, Telegram and Instagram linking to sites mostly on .cn, .top and .xyz domains. The senders asked people to share the links with friends. CERT-In said such campaigns put sensitive data at risk and can lead to financial fraud.
• "Dak Seva Gifts" quizzes in India Post's name. In August and again in September 2026, PIB's Fact Check Unit said a message claiming that India Post was handing out gifts under a "Dak Seva Gifts" scheme was fake. It said India Post has no connection with any gift, reward or lucky draw scheme by that name. The September version, as Outlook Money described it, promises a chance to win up to ₹10,000 for answering a four-question quiz that asks whether you know India Post. You are then told to pick a box, with three tries. The reports do not say what the page asks for after that. If a prize page then asks you to pay anything to claim it, it is the prize-fee scam below; if it asks for bank details, an OTP or your Aadhaar number, stop there. PIB's advice is not to click such links and never to share those details. Practise on the fictional pay-to-claim-a-prize demo in our Scam Lab.
• Fake shopping or reward apps. A link asks you to install an app file (APK) to claim cashback or track an order. RBI warns that such apps can read all the data on your phone. See how APK malware spreads on WhatsApp.
• Prizes that need a "fee". CERT-In's 2024 advisory describes prize scams where you must pay a processing fee or tax to claim a win.

03 / Delivery, cash-on-delivery and refund tricks

• "Address update" SMS. A message says your parcel is stuck and you must update your address through a link. PIB's Fact Check Unit has repeatedly called such messages in India Post's name fake, and said India Post never sends them. See our courier and parcel scam explainer.
• Cash-on-delivery stores. CERT-In describes fake stores that take COD orders, then deliver a counterfeit or a different product. Paying on delivery does not make an unknown seller safe.
• OTP on the phone. A "delivery agent" asks you to read out a code. Read the SMS first: if it mentions a payment, bank, UPI or login, it is not a delivery code. RBI's rule is never to share an OTP, PIN or UPI PIN with anyone.
• Fake customer care. You search for a helpline to chase a refund and reach a planted number. RBI warns that numbers shown by search engines may be fraudulent. See fake customer care scams.
• "Refunds" by QR or collect request. RBI and CERT-In both say receiving money never needs a QR scan or your UPI PIN. Entering the PIN sends money out. See UPI QR and collect fraud.

04 / How to check a website or seller before you pay

• Start from the app or a typed address, not a link in an ad, SMS or forward. If a message claims an order problem, check your orders in the app.
• Read the domain letter by letter. CERT-In advises checking links for spelling errors.
• Check the seller, not just the product. Look at who is selling, their ratings and recent, specific reviews. NPCI's festive advice is to research unfamiliar sellers before buying.
• Pay on the platform only. Never pay a seller directly by UPI, bank transfer or a WhatsApp link. Amazon's advice with I4C says it never asks for payment by phone or email, or asks you to install software for support.
• A padlock is not proof. https means the connection is encrypted, not that the shop is honest.
• Skip public Wi-Fi for payments, as RBI and NPCI advise.
• Buying "digital gold" for Dhanteras? SEBI warned on 8 November 2025 that digital gold or e-gold offered by online platforms is neither notified as a security nor regulated as a commodity derivative, and sits entirely outside its oversight. None of the securities market's investor protections apply, and SEBI flagged counterparty and operational risks. Its regulated gold options are gold ETFs from mutual funds, Electronic Gold Receipts and exchange-traded commodity derivative contracts, bought through SEBI-registered intermediaries.

05 / What official agencies advise

• CERT-In (advisory CIAD-2024-0050, 24 October 2024): don't click links from unknown senders; install apps only from official app stores; check the payee's banking name before paying by QR; you don't need a UPI PIN or OTP to receive money.
• RBI: never share your PIN, UPI PIN or OTP, "not even with bank officials"; take contact numbers only from official websites; if an OTP or debit SMS arrives for something you didn't do, tell your bank and block all modes of debit, including UPI.
• NPCI (October 2024): resist impulse buys on unfamiliar platforms and share only the details a deal needs.
• DoT's Chakshu, on the Sanchar Saathi portal, takes reports of suspected fraud calls, SMS, WhatsApp messages and web links within 30 days. It is for reporting, not recovering money.
• Department of Consumer Affairs: the Guidelines for Prevention and Regulation of Dark Patterns, 2023, list 13 banned tricks, including false urgency, basket sneaking and drip pricing. In June 2025 the Central Consumer Protection Authority told e-commerce platforms to self-audit for them within three months.

06 / Caught out? Fraud or consumer complaint

The right helpline depends on what happened.

• Money taken by a scammer (fake site, gift link, fake agent, collect request, APK): call 1930 at once, file under Financial Fraud on cybercrime.gov.in, and call your bank's official helpline to block cards and UPI. Our UPI fraud first-hour guide has the full steps.
• Details shared, no money lost: change passwords and PINs, uninstall any app a stranger asked you to install, and report the number or link on Chakshu.
• A genuine seller let you down (refund not given, wrong or defective item, hidden charges, a dark pattern): this is a consumer dispute, not cyber fraud. Complain to the platform, then to the National Consumer Helpline on 1915 or 1800-11-4000, WhatsApp or SMS 8800001915, or consumerhelpline.gov.in. It works in 17 languages, 8 am to 8 pm daily except national holidays.

07 / Your festive shopping checklist

• Shop from the official app or a typed address.
• Check the domain spelling and the seller's ratings.
• Pay only inside the platform's checkout.
• Ignore and don't forward gift, lucky-draw, "spin the wheel" or "Dak Seva Gifts" links.
• Never install an APK sent in a message.
• Never share an OTP, PIN or UPI PIN.
• No QR scan or UPI PIN is needed to receive a refund.
• Take helpline numbers from the official website or app.
• Lost money: 1930 and cybercrime.gov.in, then your bank.
• Seller dispute: the platform, then NCH on 1915.

08 / Sources and updates

Confirmed (official documents): CERT-In's 2024 advisory; RBI's consumer awareness release; the DoPT holiday list for Diwali's date; the Consumer Affairs releases on dark patterns and the National Consumer Helpline; DoT's Chakshu page; and SEBI's press release of 8 November 2025 on digital gold. Reported (media and company pages): PIB Fact Check's alerts on messages in India Post's name, including "Dak Seva Gifts" in August and September 2026 (Akashvani, Outlook Money, Business Standard); CERT-In's 2022 Diwali warning (Outlook Business); NPCI's 2024 festive advice (Outlook Money); and the Amazon India and I4C tips (About Amazon India).

Update, 2 October 2026: section 02 adds the "Dak Seva Gifts" message that PIB Fact Check called fake in August and September 2026, with a link to our Scam Lab prize demo. Section 04 adds SEBI's caution on digital gold for Dhanteras buyers, and the checklist in section 07 now names "Dak Seva Gifts".