Festive sale scams: how to spot fake shopping sites, gift links and delivery tricks

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Big sales bring lookalike websites, 'spin the wheel' links, fake courier SMS and refund cons. Shop only inside the official app, never share an OTP or UPI PIN, and know when to call 1930 and when to call 1915.

01 / Why festive sales draw scammers

Diwali falls on Sunday, 8 November 2026, according to the government's holiday list, and the big online sales run in the weeks before it. Scammers work to the same calendar. More orders mean more delivery messages, refunds and deal-hunting, and each is a cover story.

In September 2025 the Indian Cybercrime Coordination Centre (I4C), part of the Home Ministry, ran a "Scam-Free September" awareness drive with Amazon India. Its core warning: if a message pushes you to act now, pay a fee or confirm a purchase you don't recognise, treat it as a red flag, not a reason to click.

02 / The scams to expect this season

• Lookalike shopping sites and ads. Ads and forwards lead to sites that copy a well-known brand's look, with prices far below the real sale. You pay, and nothing arrives. The Amazon and I4C advice warns about typo-squatted addresses that differ from the real one by a letter.
• "Lucky draw" and gift links. Before Diwali 2022, CERT-In, the national cyber security agency, warned about festive-offer messages on WhatsApp, Telegram and Instagram linking to sites mostly on .cn, .top and .xyz domains. The senders asked people to share the links with friends. CERT-In said such campaigns put sensitive data at risk and can lead to financial fraud.
• Fake shopping or reward apps. A link asks you to install an app file (APK) to claim cashback or track an order. RBI warns that such apps can read all the data on your phone. See how APK malware spreads on WhatsApp.
• Prizes that need a "fee". CERT-In's 2024 advisory describes prize scams where you must pay a processing fee or tax to claim a win.

03 / Delivery, cash-on-delivery and refund tricks

• "Address update" SMS. A message says your parcel is stuck and you must update your address through a link. PIB's Fact Check Unit has repeatedly called such messages in India Post's name fake, and said India Post never sends them. See our courier and parcel scam explainer.
• Cash-on-delivery stores. CERT-In describes fake stores that take COD orders, then deliver a counterfeit or a different product. Paying on delivery does not make an unknown seller safe.
• OTP on the phone. A "delivery agent" asks you to read out a code. Read the SMS first: if it mentions a payment, bank, UPI or login, it is not a delivery code. RBI's rule is never to share an OTP, PIN or UPI PIN with anyone.
• Fake customer care. You search for a helpline to chase a refund and reach a planted number. RBI warns that numbers shown by search engines may be fraudulent. See fake customer care scams.
• "Refunds" by QR or collect request. RBI and CERT-In both say receiving money never needs a QR scan or your UPI PIN. Entering the PIN sends money out. See UPI QR and collect fraud.

04 / How to check a website or seller before you pay

• Start from the app or a typed address, not a link in an ad, SMS or forward. If a message claims an order problem, check your orders in the app.
• Read the domain letter by letter. CERT-In advises checking links for spelling errors.
• Check the seller, not just the product. Look at who is selling, their ratings and recent, specific reviews. NPCI's festive advice is to research unfamiliar sellers before buying.
• Pay on the platform only. Never pay a seller directly by UPI, bank transfer or a WhatsApp link. Amazon's advice with I4C says it never asks for payment by phone or email, or asks you to install software for support.
• A padlock is not proof. https means the connection is encrypted, not that the shop is honest.
• Skip public Wi-Fi for payments, as RBI and NPCI advise.

05 / What official agencies advise

• CERT-In (advisory CIAD-2024-0050, 24 October 2024): don't click links from unknown senders; install apps only from official app stores; check the payee's banking name before paying by QR; you don't need a UPI PIN or OTP to receive money.
• RBI: never share your PIN, UPI PIN or OTP, "not even with bank officials"; take contact numbers only from official websites; if an OTP or debit SMS arrives for something you didn't do, tell your bank and block all modes of debit, including UPI.
• NPCI (October 2024): resist impulse buys on unfamiliar platforms and share only the details a deal needs.
• DoT's Chakshu, on the Sanchar Saathi portal, takes reports of suspected fraud calls, SMS, WhatsApp messages and web links within 30 days. It is for reporting, not recovering money.
• Department of Consumer Affairs: the Guidelines for Prevention and Regulation of Dark Patterns, 2023, list 13 banned tricks, including false urgency, basket sneaking and drip pricing. In June 2025 the Central Consumer Protection Authority told e-commerce platforms to self-audit for them within three months.

06 / Caught out? Fraud or consumer complaint

The right helpline depends on what happened.

• Money taken by a scammer (fake site, gift link, fake agent, collect request, APK): call 1930 at once, file under Financial Fraud on cybercrime.gov.in, and call your bank's official helpline to block cards and UPI. Our UPI fraud first-hour guide has the full steps.
• Details shared, no money lost: change passwords and PINs, uninstall any app a stranger asked you to install, and report the number or link on Chakshu.
• A genuine seller let you down (refund not given, wrong or defective item, hidden charges, a dark pattern): this is a consumer dispute, not cyber fraud. Complain to the platform, then to the National Consumer Helpline on 1915 or 1800-11-4000, WhatsApp or SMS 8800001915, or consumerhelpline.gov.in. It works in 17 languages, 8 am to 8 pm daily except national holidays.

07 / Your festive shopping checklist

• Shop from the official app or a typed address.
• Check the domain spelling and the seller's ratings.
• Pay only inside the platform's checkout.
• Ignore and don't forward gift, lucky-draw or "spin the wheel" links.
• Never install an APK sent in a message.
• Never share an OTP, PIN or UPI PIN.
• No QR scan or UPI PIN is needed to receive a refund.
• Take helpline numbers from the official website or app.
• Lost money: 1930 and cybercrime.gov.in, then your bank.
• Seller dispute: the platform, then NCH on 1915.