Diwali 2026: 8 Smartphone & Online Shopping Scams To Watch Out For During Festive Sales

Diwali sales bring deep discounts on smartphones, electronics and gifts, but they also give fraudsters a crowded, distraction-heavy window to strike. Cybersecurity advisories and police warnings this festive season flag cloned stores, fake delivery texts, tampered QR codes and refund scams as the biggest risks for online shoppers.

1. Fake shopping websites

Scammers build lookalike sites using familiar brand logos, product photos and 'flat 90 percent off' offers on premium phones and electronics. The goal is either to collect card, net-banking or UPI details, or to take payment without delivering anything.

Be suspicious of misspelled domains, missing contact details, vague return policies and prices dramatically below every other retailer. Shop through official apps or by typing the retailer’s address yourself, rather than tapping a link in an SMS, WhatsApp forward or social-media ad.

2. Fake delivery-message scams

Fraudsters exploit the festive flood of parcels with messages claiming an address problem, unpaid delivery fee, incomplete KYC or a parcel held at a warehouse. The link may lead to a phishing page asking for personal details, card information or a small “shipping charge.”

A genuine courier does not need your bank password, UPI PIN or OTP to deliver a package. If the message is unexpected, open the courier’s official app or website directly instead of clicking the embedded link.

3. Counterfeit customer-care numbers

After a failed payment, cancellation or delayed order, scammers post fake customer-care numbers on search results and social media. Callers may pose as support agents and ask for an OTP, ask you to scan a QR code, or pressure you to install a screen-sharing or “order tracking” app.

Never share OTPs, UPI PINs, passwords or card details with anyone claiming to be from a bank, marketplace or payment platform. Use only the support contact listed inside the official app or on the company’s verified website.

4. Malicious QR codes

Fake QR codes circulate through WhatsApp, SMS and social posts with promises of Diwali cashback, refunds, prizes or gift hampers. Scanning can open a malicious site, trigger a payment request, or install harmful software.

Before paying, check the recipient name on the UPI confirmation screen. A personal name instead of a merchant account is a major red flag, especially for a high-value smartphone or electronics purchase.

5. Fake refunds and cashback

A common trick is a 'refund' that requires you to scan a QR code or approve a UPI collect request. In reality, receiving money never requires entering a UPI PIN or approving a payment; doing so sends money out of your account.

Treat any refund message that arrives before you have raised a complaint as suspicious. Verify the order status only in the retailer’s official app, and never act on urgency, threats of account suspension, or offers that expire in minutes.

6. Fraudulent payment requests

Some fake storefronts advertise cash on delivery but switch to UPI at checkout, pushing buyers into an irreversible transfer. Others send payment links disguised as order confirmations, festive bonuses or “reserve your deal” requests.

Pay through the marketplace’s own checkout flow where possible, use payment methods with dispute protection, and avoid transferring money to individual UPI IDs for purchases from unknown sellers.

7. Counterfeit smartphone listings

Deep discounts on iPhones, flagship Android phones and accessories can be bait for counterfeit, refurbished, stolen or non-existent products. Fraudsters may use copied images, fake reviews and countdown timers to create urgency.

Compare the exact model number and price across official brand stores and established retailers. Check the seller’s rating, return policy, warranty terms and whether the listing specifies an Indian warranty before paying

8. Fake apps and festive giveaways

Fraudulent shopping apps and WhatsApp-forwarded “Diwali hamper” links can mimic popular marketplaces, harvest credentials or push users into payment pages. Even a message from a known contact can be dangerous if their account has been compromised.

Download apps only from the Google Play Store or Apple App Store, check developer details and reviews, and avoid granting unnecessary permissions. Do not install apps sent through chat links to track a parcel or claim a reward.

If you get scammed, here's what you need to do

Act immediately: call the national cybercrime helpline 1930, report the incident at cybercrime.gov.in, and inform your bank or payment app so it can attempt to freeze or recall the transaction. Preserve screenshots, transaction IDs, phone numbers, links and bank statements as evidence.

The safest Diwali rule is simple: verify the store, verify the sender, verify the payee - and never share an OTP or UPI PIN to receive money.