7 Diwali Scams Hitting Indian Phones This Year, and How to Spot Each One

It's a time to buy, give and exchange gifts, and to search for the worthy gift offers. However, with the festive season, India's cybercriminals are also capitalizing on the excitement as the majority of Indians spend more time on their phones.

Warnings have already been issued this year about fake links to giveaway gifts by Diwali and offers to buy gifts. Punjab police has warned against fake WhatsApp and SMS hamper links and digital gift envelopes, offering fake congratulations during the festive season. At the same time, it has also been decried as a hoax from the government offering ₹8,000 in a Diwali bonus by the Press Information Bureau (PIB).

The foremost cautionary statement: if a message looks like a Christmas message, or it's from a contact you know, don't assume that it is. If you're scanning for info on this year's Diwali scams, here are seven to keep an eye out for and signs to look out for.

1. Fake Diwali Sale Websites and Shopping Links

Smartphones, clothes, electronics, home appliances, jewellery – these are just a few of the many items that you might be able to find great discounts on during festive sales. Scammers exploit by creating websites or social media ads which are similar to legit shopping websites.

Although the website might look like a legitimate one, it could be fake, offering a high-priced phone for an extremely low price or providing a countdown timer to spur consumers to purchase. Upon clicking on the link, customers might be required to give their name, phone number, card details or UPI information. Occasionally they pay for an order which they never receive.

Suspicious message:

DIWALI MEGA SALE!

iPhone at 70% OFF. Only 10 pieces left.

Come on in and order today: [unfamiliar shopping link]

How to avoid it: Make sure that the website address is carefully checked. Check for misspelled words, odd sounding domain names, missing contact information and extremely “good” prices. Do NOT click on links in forwarded messages but go to the retailer's official website or app.

2. Fake WhatsApp Greeting Cards and Gift Links

It might be innocuous to get a greeting card from a friend or family member. Cybercriminals are sending messages via WhatsApp with offers of free gift hampers, electronic gift envelopes, personalised Diwali greeting cards and cash rewards etc.

The link could lead to a bogus Web page that requests personal data, shares the message with contacts or downloads a file. If the account owner's profile is hacked, a message from someone they know can be dangerous, as well.

Suspicious message:

A special Diwali Gift for you!

Click on the digital envelope to open it: [unknown link]

How to avoid it: Avoid clicking on links or opening PDFs or gift pages in unsolicited greeting cards, or personal pages asking for personal or banking information. If the message is from a known sender, check with the sender first, via an independent call before opening. Punjab Police have particularly issued a warning to people about such links and attachments.

3. Fake ₹8,000 Government Diwali Bonus Messages

Among the most discussed warnings this festive season, there is one WhatsApp warning saying the Government of India has announced to give an ₹8,000 Diwali bonus in the name of PM Modi.

The PIB has pointed out the statement as bogus. Message content instructs people to register for the purported benefit on a website. This may result in the gathering of personal data, banking data or OTPs on such pages. Some users may also be charged a processing fee or they might have to approve UPI transactions.

Suspicious message:

Government Diwali Bonus 2026

Directly receive ₹8,000 in your bank account.

Don't miss out on the offer, sign up today: [unknown link]

How to avoid it: Don't assume that any benefit claimed by a government is truly government because of the use of the government's name, jargon or format. Listen to news on government websites. Avoid sending payments or OTPs to benefit from a random prize. The PIB has also given the contacts for reporting any suspicious claims made regarding the Central Government – WhatsApp number – 8799711259 and email address – factcheck@pib.gov.in.

4. Fake Courier Calls Asking for OTPs or Delivery Fees

Online shopping rises during Diwali and so do the chances of scams to masquerade as delivery agents or representative of courier companies.

A caller can say that a parcel is stuck, there is an incomplete address and there is a small delivery charge pending. May send a link for payment or request for a code received by phone. The purpose can be to obtain banking information, the recipient's money or trick the recipient into approving a transaction.

Suspicious message:

Your Diwali parcel is in the holding because it has an incomplete address.

If you want to reschedule delivery, you will have to pay ₹5.

How to check: You can find out if the parcel is delivered by checking its status via the official website or app of the courier company. Never use payment links from people you don't know. In case there is an OTP for delivery, the same should be used only for the delivery of the parcel in question and not for other parcels. Don't give banking OTPs, UPI PIN or card number to a caller.

5. UPI Collect Requests and Fake Cashback Offers

UPI is making the festive shopping easy, but this could also be exploited by scammers to defraud the users of sending money.

It is possible that you will get a message stating that you have won some cashback, shopping reward or Diwali gift. The sender could request you to scan the QR code or enter your UPI pin or accept a collect request to collect the reward.

Just a reminder: by entering your UPI PIN you are authorising a payment. Does not need to be paid for.

A message that contains the following markings is likely to be a scam:

Congratulations! You have won Diwali cashback of ₹2500.

Accept the UPI offer of your reward.

How to avoid it: Be sure to read each UPI screen before accepting a request. Look at the transaction and see if it asks for money to be paid/received. Never scan a QR code or enter a UPI number/pin to get a prize. NPCI advises consumers against fake cashback links, tricks with QR codes.

6. Fake Customer Care and Refund Scams

A customer may contact a shopping platform after a delayed delivery, failed payment or cancelled order. Scammers can exploit this situation by pretending to be customer support representatives.

They may share a fake customer-care number, ask the customer to install a screen-sharing application or send a refund link. Once the user follows their instructions, the fraudster may gain access to sensitive information or manipulate a payment.

Example of a suspicious message:

Your Diwali order refund is pending.

Call our customer-care executive at [unknown number] to receive your money.

How to spot it: Find customer-care details only through the company's official website or app. Do not install unknown applications or give screen-sharing access to a stranger. Never share your UPI PIN, password or OTP with someone claiming to process a refund.

7. Malicious APK Files Disguised as Festive Messages

Not every dangerous message looks like a payment request. Some may ask you to download a Diwali greeting card, parcel receipt, festive offer application or other file.

CERT-In has warned about Android malware distributed through fake e-Challan messages in 2026. These messages encourage users to download APK files that can compromise devices and expose sensitive information. Similar caution is sensible for unexpected festive files received through WhatsApp, SMS or other platforms.

Example of a suspicious message:

Your Diwali greeting card is ready!

Download the attached file to view your wishes.

How to spot it: Do not install APK files received through unknown links or messages. Download applications only from trusted official app stores. Avoid granting unknown apps access to SMS, contacts, calls or accessibility services. CERT-In advises users to avoid suspicious APK downloads and report financial fraud through 1930 or the National Cyber Crime Reporting Portal.

What Should You Do If You Fall for a Diwali Scam?

If you have clicked a suspicious link, shared banking information or lost money, do not panic or wait for the next day. Take action immediately.

1. Call 1930: Report financial cyber fraud through India's National Cyber Crime Helpline as soon as possible.

2. Contact your bank: Use the official banking app or verified customer-care number to report the transaction and secure your account.

3. File an online complaint: Visit cybercrime.gov.in and submit the relevant details.

4. Save the evidence: Keep screenshots, phone numbers, website links, payment receipts, transaction IDs and messages.

5. Secure your phone and accounts: Change compromised passwords and payment credentials. If you installed a suspicious application, stop using it and seek help to remove it safely.

Calling 1930 quickly can help authorities and financial institutions take timely steps to trace or potentially stop a fraudulent transaction. However, reporting does not guarantee that the money will be recovered.

Celebrate Diwali, But Think Before You Tap

Cybercriminals often rely on excitement, urgency, fear and attractive rewards. A free gift, a huge discount or a government bonus may look tempting, but a genuine offer should never require you to reveal your UPI PIN, banking password or OTP.

Before clicking a festive link, pause and verify the sender. Use official websites and apps for shopping, payments and delivery updates. A few seconds of checking can protect your money, personal information and peace of mind this Diwali.