New Delhi: With Dhanteras and Diwali bringing a surge in purchases of gold, silver, jewellery, electronics and festive gifts, cybercriminals are finding new ways to exploit consumer excitement through fake shopping offers, fraudulent government schemes, malicious applications and phishing links.
Cybersecurity agencies and police departments across the country have issued warnings about scams that use festive greetings, attractive discounts, cashback offers and purported government benefits to deceive people into sharing sensitive information or transferring money.
Maharashtra Cyber, Telangana Cyber Security Bureau (TGCSB) and the Indian Computer Emergency Response Team (CERT-In) have highlighted several such threats, urging citizens to verify offers and avoid suspicious links and applications.
Here are the major scams consumers should watch out for this festive season.
1. Fake Gold And Jewellery Offers
With gold and silver purchases considered auspicious during Dhanteras, fraudsters may create fake jewellery websites, social media pages and advertisements offering coins, ornaments and precious metals at unusually low prices.
Some may collect advance payments and disappear, while others could deliver counterfeit products or products that do not match the advertised specifications. Consumers should verify sellers, check hallmarking and purchase precious metals through established and trusted jewellers.
2. Fake Diwali Gifts And Government Benefit Messages
Fraudsters are circulating WhatsApp messages promising free gifts, cash benefits and festive financial assistance in the name of government schemes.
The Telangana Cyber Security Bureau issued a warning on October 30 about a fake WhatsApp message claiming that citizens could receive an ₹8,000 Diwali benefit in the Prime Minister’s name.
The message contained a suspicious link that could redirect users to fraudulent websites seeking Aadhaar details, banking information and other personal credentials. Authorities warned that such links could also facilitate unauthorised UPI transactions and the installation of malware.
3. Malicious APK Files Disguised As Diwali Greetings
Cybercriminals may circulate festive greeting cards, digital invitations, shopping applications and gift-related APK files through WhatsApp, SMS and social media.
Maharashtra Cyber has warned about malicious Diwali greeting links and fake gift offers. Its advisory cautioned that clicking such links could expose users to phishing websites and malware.
CERT-In has also documented Android malware campaigns involving APK files disguised as legitimate government applications. Its March 2026 advisory described how malicious applications could gain access to SMS messages, OTPs and sensitive financial information.
Installing an unauthorised application could therefore expose banking credentials and enable fraudulent transactions.
4. Fake Shopping Websites And Unrealistic Discounts
Fraudsters create websites that imitate popular e-commerce platforms and advertise extraordinary festive discounts on electronics, clothing, appliances, sweets and other products.
The Telangana Cyber Security Bureau had also warned about fake online shopping websites and fraudulent sale campaigns in July 2026. Such operations use social media advertisements, WhatsApp messages, SMS and email to attract customers with unrealistic discounts and clearance offers.
Victims may be asked to make advance payments through UPI, QR codes or direct bank transfers, without receiving the products.
5. Fake Delivery And OTP Verification Scams
Scammers may impersonate delivery executives from popular courier companies, claiming that a festive purchase is delayed or that an additional payment is required.
They may send fake tracking links, request OTPs or ask customers to download applications to resolve delivery issues.
Consumers should never disclose OTPs, banking passwords or other confidential information to people claiming to represent delivery companies.
6. QR Code And Cashback Scams
Fraudsters may advertise Diwali cashback, shopping rewards and festive discounts through QR codes circulated on social media or placed on fake promotional material.
Victims are persuaded to scan the codes and enter their UPI PIN under the pretext of receiving money. However, entering a UPI PIN authorises a payment rather than receiving money.
Consumers should never scan unknown QR codes or approve unexpected payment requests.
7. Fake Customer Care And Refund Scams
After making festive purchases, consumers may search online for customer-care numbers to resolve payment, delivery or refund-related complaints.
Fraudsters exploit this by posting fake customer-care numbers and impersonating representatives of shopping platforms, banks and jewellery brands.
Victims may be asked to share screen access, install remote-access applications, disclose OTPs or follow payment instructions, eventually losing money.
8. Fake Investment And Digital Gold Schemes
The festive season also brings increased interest in purchasing gold and investing in precious metals.
Scammers may exploit this demand by advertising fake digital gold schemes, guaranteed returns, limited-period investment opportunities and fraudulent gold-saving plans.
Consumers should verify the company, investment product and regulatory status before transferring money. Guaranteed high returns and pressure to invest immediately should be treated as warning signs.
9. AI Voice Cloning And Impersonation Scams
Fraudsters may use artificial intelligence to imitate the voices of relatives, friends or acquaintances and make urgent requests for money.
They may claim to be stranded, facing an emergency or requiring immediate financial assistance during the festive period.
Maharashtra Cyber has previously warned about AI-based voice impersonation scams. People should independently verify unexpected money requests by calling the person back on a known number.
10. Fake Festival Competitions, Coupons And Lottery Links
Messages claiming that users have won Diwali hampers, shopping vouchers, gold coins or lucky-draw prizes may contain fraudulent links.
CERT-In has previously documented festival-themed phishing campaigns in which fake promotional offers and questionnaires were used to lure people into sharing personal details, bank information, passwords and OTPs.
Consumers should avoid clicking unsolicited prize links or paying processing fees to claim purported rewards.
What Do Cybersecurity Agencies Advise?
Maharashtra Cyber has urged citizens to avoid suspicious festive links, unknown applications and unsolicited gift offers. It has also warned people against sharing OTPs, passwords and banking credentials.
The Telangana Cyber Security Bureau has advised people to verify government schemes through official channels, avoid forwarding suspicious messages and follow the principle of “Pause, Think, Verify”.
CERT-In recommends downloading applications only from trusted app stores, keeping devices updated, checking application permissions and avoiding unknown APK files. Its advisories also caution against shortened URLs and suspicious links circulated through messaging platforms.
The National Informatics Centre (NIC), in its July 2026 cybersecurity guidance, reiterated that unknown APK files received through SMS, WhatsApp, email and social media could expose personal and financial information.
How Can Consumers Protect Themselves?
- Purchase gold and jewellery only from trusted and verified sellers.
- Verify shopping websites and promotional offers before making payments.
- Never download APK files received through WhatsApp or unknown links.
- Never share OTPs, UPI PINs, passwords or banking credentials.
- Do not scan unknown QR codes to receive cashback or refunds.
- Avoid clicking links promising free gifts, government benefits or unbelievable discounts.
- Never allow unknown individuals to access your phone through remote-access applications.
- Enable transaction alerts and keep banking applications and phone software updated.
- Verify urgent money requests, even when they appear to come from familiar contacts.
What Should You Do If You Fall Victim?
Anyone who suspects financial cyber fraud should immediately contact their bank and report the transaction.
Victims should call the national cybercrime helpline 1930 without delay or register a complaint through the National Cyber Crime Reporting Portal at www.cybercrime.gov.in.
Consumers can also report suspicious phone numbers, WhatsApp accounts, websites and other online identifiers through the portal’s facility for reporting cybercrime suspects.
As the festive shopping season gains momentum, authorities urge citizens to remain vigilant. A suspicious link, an unusually attractive gold deal or an unsolicited festive reward could turn a celebration into a financial setback.
