Diwali and festive season scams 2026: fake offers, gifts and delivery links

The most common Diwali and festive season scams in India are fake sale websites, "free gift" and lucky-draw links, fake courier "address update" messages, instant festive loan offers, gift-card payment tricks and greeting messages that install a malicious app. The safe rule is simple: open shopping sites and apps yourself instead of tapping links, never install an APK from a message, and never share an OTP or enter your UPI PIN to "receive" anything.

Police across India issue warnings every festive season. In October 2026, Rajasthan Police warned shoppers about fake festive sale sites, counterfeit apps, refund-PIN tricks, fake customer-care numbers and remote-access apps. In October 2025, Hyderabad Police listed counterfeit shopping sites, look-alike apps, fake reward messages and social media ads for products that never arrive. Here is how each trick works.

1. Fake Diwali sale websites and social media ads

A post or ad shows a branded phone, TV or gold coin at 70–90% off. The link opens a site that looks like a famous store. After you pay by UPI, nothing arrives and the site disappears.

• Check the exact domain. Real stores do not run sales on brand-diwali-offer.top.
• Prices far below every other store are the bait, not a lucky find.
• Use our guide on how to check if a website is safe before paying on any new shop.

2. "Free gift" and lucky draw links on WhatsApp

"Congratulations! You won a Diwali gift from [brand]. Answer 4 questions and share with 5 groups to claim." CERT-In warned about exactly this pattern: festive gift links spread on WhatsApp, Telegram and Instagram that lead to phishing sites imitating popular brands, asking users to answer a questionnaire and forward the link. The goal is your personal and bank details, or to show you adware.

3. Courier and delivery "address update" messages

With so many festive orders, everyone is expecting a parcel. Scammers send SMS such as "Your package is held at the warehouse due to incomplete address. Update within 24 hours" with a link. The page asks for a small "redelivery fee", then captures your card details, OTP or UPI PIN.

• Track orders only inside the official shopping or courier app.
• Couriers do not ask you to pay small fees through random links.
• A related scam is the call claiming a parcel in your name contains drugs or fake passports. That is the start of a digital arrest scam. Hang up.

4. Fake festive loans and "pre-approved" offers

"Diwali special: instant ₹50,000 loan, no documents, 0% interest." These links lead to unregistered loan apps that charge a "processing fee" and disappear, or give a small loan and then harass you and your contacts for repayment. Before borrowing through any app, check that the app appears in the RBI's list of digital lending apps deployed by regulated entities (on the RBI website, Citizen's Corner, as reported by Business Standard). Read more in our guide to dangerous app permissions and loan apps.

5. Gift-card scams

Gift cards are popular Diwali presents, which makes them a favourite payment method for fraudsters because they are hard to trace. Watch for:

• "Boss" or relative messages: someone using a new number and a familiar photo asks you to urgently buy gift cards and send the codes.
• Discounted gift cards sold on social media or Telegram, such as a ₹5,000 card for ₹2,500. They are stolen, already used, or never delivered.
• "Pay the fine or fee with a gift card". No bank, government office or courier accepts gift-card codes as payment.

Once you share a gift-card code, treat it like cash handed over. Verify any such request by calling the person on their old, saved number.

6. E-greetings and invitations that are really APK apps

A message says "Happy Diwali, see your special greeting" or "View our family's invitation", but the attachment is an .apk file. An APK is an Android app. Once installed, it may ask for SMS, notification or accessibility access and then read your OTPs and banking messages. Police in Telangana have warned about such "greeting scams" that steal banking credentials and OTPs and hijack WhatsApp accounts to spread further, and Himachal Police have warned about fake digital wedding invitations.

7. Refund, cashback and fake customer care

Someone calls about a "failed order refund" or "Diwali cashback" and sends a QR code or a collect request, saying "enter your PIN to receive the money". Rajasthan Police's advisory is clear that the UPI PIN is only for authorising payments. Similarly, fake customer-care numbers are planted in search results and social media; use the help section inside the official app instead. Fraudsters may also ask you to install AnyDesk, TeamViewer or a "refund app" to "help" you. Do not.

Festive season safety checklist

1. Open shopping sites and apps by typing the address or using the official app, not from ads or forwards.
2. Install apps only from the Google Play Store or Apple App Store.
3. Never install an APK received in a chat or SMS.
4. Never share an OTP, card CVV or UPI PIN. Never enter your PIN to receive money.
5. Prefer cash on delivery or a card on a well-known store for first-time purchases.
6. Track parcels only inside the official app.
7. Ignore "forward to claim your gift" messages, and do not forward them.
8. Check suspicious links with the Secuvexa link checker before opening them.
9. Avoid banking and large payments on public Wi-Fi at malls and stations.
10. Talk to elderly parents about these scams before the festive rush.

What to do if you fell for a festive scam

1. Money lost? Call 1930 or report at cybercrime.gov.in right away. See how to file a 1930 UPI fraud complaint.
2. Call your bank to block cards or UPI if you shared details.
3. If you installed an APK, switch on flight mode, uninstall it, and check which apps have SMS and accessibility access.
4. Keep screenshots, the link, phone numbers and the UTR / transaction ID.
5. If you did not lose money but received a fraud call or message, report it on Chakshu on Sanchar Saathi.

Frequently asked questions

This guide is general information, not legal advice. If you have lost money to fraud, call 1930 immediately or report at cybercrime.gov.in.