Diwali Scams 2026: Fake UPI Refunds, OTP and Sale Link Frauds

Online fraud rises every festive season in India, and Diwali 2026 is no different. The most common scams right now are fake UPI refund requests, delivery OTP and “address incomplete” messages, fake sale websites, QR code traps and fake greeting apps. If you lose money, call the cybercrime helpline 1930 immediately and file a complaint on cybercrime.gov.in, ideally within the first hour.

The scale is large. Between January and June 2026, Indians filed more than 12.71 lakh financial cyber fraud complaints and reported losses of over Rs 10,178 crore, according to data reviewed at a Ministry of Home Affairs meeting and reported in July. About Rs 2,969 crore of that was frozen before it could be withdrawn, mostly because victims reported quickly.

1. Fake UPI “refund” or “cashback” requests

You get a call or message saying a refund, cashback or prize is waiting. Then a UPI request pops up on your phone. It looks like you are receiving money, but it is a collect request, and entering your PIN sends money out of your account.

Also readWordPress Site Hacked? A Step-by-Step Recovery Checklist

The rule to remember: you never need to enter your UPI PIN to receive money. If an app asks for your PIN, you are paying, not receiving.

2. Delivery OTP and “address incomplete” messages

With so many festive orders on the way, scammers send SMS or WhatsApp messages saying your parcel is on hold because of an incomplete address. The link opens a page that looks like India Post or a courier company and asks for a small “redelivery fee” or your card details.

Some callers pose as delivery agents and ask you to read out an OTP “to confirm the delivery”. That OTP is usually for a bank transaction or for taking over your WhatsApp account.

• Track parcels only inside the shopping app or the courier’s official app.
• Delivery agents do not need any OTP other than the one the shopping app itself shows you for handover.

3. Fake sale websites and social media ads

Ads on Instagram and Facebook promise iPhones at Rs 9,999 or branded sneakers at 90% off. The website copies a real brand’s logo and design, takes your payment, and either sends nothing or sends a cheap copy.

Researchers at CloudSEK found 828 phishing domains running through the Facebook Ads Library during last year’s festive season, many with web addresses one letter off from real brands.

• Type the store’s address yourself or use its official app.
• Be suspicious of new websites that only accept UPI or bank transfer and have no cash on delivery.
• Check the domain spelling carefully. “amaz0n” and “flipkart-sale” are not the real thing.

4. QR code traps

A QR code sent on WhatsApp “to receive payment” or pasted over a shop’s real code sends money from your account. As with UPI requests, scanning a QR code is for paying. You never scan anything to receive money.

At shops, check that the name shown in your UPI app after scanning matches the shop before you enter the PIN.

5. Fake greeting cards, wedding invites and APK files

“Your Diwali greeting card is ready” or a wedding invite arrives as an APK file on WhatsApp. Installing it gives the scammer access to your SMS, OTPs and sometimes your banking apps. We covered this in detail in our guide to the fake APK scam on WhatsApp.

Never install apps from outside the Play Store or App Store, even if the sender is someone you know. Their phone may already be compromised.

6. “Digital arrest” calls

This one is not festive-specific, but it remains one of the biggest sources of losses in 2026. A caller pretending to be from the police, CBI, customs or a courier company says a parcel in your name contained drugs, and keeps you on a video call until you transfer money “for verification”.

No Indian agency arrests anyone over a video call or asks for money to clear your name. Hang up and call 1930.

What to do in the first hour after a fraud

1. Call 1930, the national cybercrime helpline. Give the transaction ID, amount, time and the UPI ID or account the money went to.
2. File a complaint on cybercrime.gov.in and note the acknowledgement number.
3. Call your bank’s customer care and block your card, UPI or net banking. Ask them to raise a dispute for the transaction.
4. Save everything: screenshots of chats, SMS, the website, call logs and the payment receipt.
5. Report the number on the Chakshu feature of the government’s Sanchar Saathi app so it can be flagged for others.

Speed matters because money moves from account to account within minutes. The sooner the complaint reaches the bank, the better the chance of a freeze.

Quick safety checklist for this Diwali

• Never share an OTP, UPI PIN or card CVV with anyone, including “bank staff”.
• Turn on transaction alerts and set a daily UPI limit you are comfortable with.
• Keep sale shopping to official apps and websites you type in yourself.
• Talk to older family members about these scams. They are often the main targets.

For email-based tricks, see our tips on staying safe from scammers on Gmail. A two-minute pause before you pay is the cheapest protection there is.