Diwali 2026 Online Shopping Scams: A Simple Safety Checklist

Festive sales mean more people shopping online, more parcels on the way, and more messages about offers, deliveries and refunds. That makes it a good season for scammers too.

A quick, honest note before the list. As of early October 2026, we had not found an official festive-season advisory for this year. So the tricks below come from police advisories issued for Diwali 2025, plus one recent case and standing guidance from NPCI and a bank.

What police warned about last festive season

Hyderabad Cybercrime Police (October 2025) warned about fake shopping sites with unrealistic discounts, fake gift offers and malicious links. Their advice: never pay in advance and never share OTPs.

Rajasthan Police Cyber Crime (October 2025) described four ways people were losing money:

1. Fake shopping sites and apps that look like real stores.
2. Fake prize-draw links that promise a reward for clicking.
3. Fake "order cancelled" or "refund" calls from people pretending to be the seller.
4. Fake helpline numbers pushed into Google search results, so that when you search for customer care, you reach a fraudster.

They advised verifying numbers through official channels and never sharing an OTP or PIN.

The CRPF's Cyber Byte bulletin (October 2025 special edition) added two more: AI-made fake celebrity ads promoting deals, and festive e-cards carrying malware that takes over your WhatsApp.

A recent case: the ₹2 "customer care" call

The Times of India reported on 3 October 2026 that a 73-year-old singer in Mumbai received a call from someone claiming to be "Zepto customer care", saying an item from his order was missing. The caller asked him to send ₹2 on Google Pay while keeping him on a merged call. Through this, the fraudsters obtained an OTP and ₹45,000 was debited from his account.

He called 1930 that same night, and police asked the bank to freeze the account that had received the money.

The amount asked for was tiny, which is exactly why it felt safe. The real goal was the OTP.

Your Diwali safety checklist

Before you buy

• Be suspicious of discounts that look unrealistic. That was the first thing Hyderabad police warned about.
• Type the store's address yourself, or use its official app. Do not shop through a link in a message or an unknown ad.
• Treat celebrity deal ads with caution. CRPF has warned that some are made with AI.
• Do not pay in advance to sellers you cannot verify.

When someone calls or messages about your order

• "Order cancelled", "refund pending", "item missing"? Hang up and check your order in the official app.
• Never share an OTP or PIN with anyone who calls you, whoever they say they are.
• Do not send a small amount to "verify" anything, and be wary of a caller who wants to merge another call while you make a payment.
• Do not search for helpline numbers on a search engine. UCO Bank advises using the company's official website or app instead, because fake numbers can be planted in search results.

On UPI

• Your UPI PIN is only needed to send money, never to receive it. NPCI says this clearly. If someone says you must enter your PIN to get a refund or prize, they are trying to take money from you.
• Reject collect requests from people you do not know.

With festive greetings

• Be careful with e-cards that arrive as files or links. CRPF warned that some carry malware that can take over WhatsApp. A greeting that needs you to download or install something is not a greeting.
• Do not click prize-draw or "lucky winner" links.

If something goes wrong

Call 1930 or report at cybercrime.gov.in as soon as you can, and tell your bank. In the Mumbai case, calling 1930 the same night meant police could ask the bank to freeze the receiving account. Keep screenshots of the messages and the transaction details.

The bottom line: the tricks police warned about last festive season were simple ones: a fake sale, a fake refund, a fake helpline, a fake greeting. Shop through official apps and sites, keep your OTP and PIN to yourself, and remember that you never need a PIN to receive money. If an offer or message looks off, you can check it with the free Scam Checker, and our guide to common UPI scams explains more of these tricks.