Diwali 2026: 8 Smartphone & Online Shopping Scams To Watch Out For During Festive Sales

Diwali 2026 heralds a flurry of smartphone and online shopping deals, but these festivities also attract cybercriminals seeking to exploit the heavy traffic. Security warnings and police alerts urge shoppers to stay vigilant for a set of eight prevalent scams during the festive sales.

Firstly, counterfeit websites mimic familiar brands with identical logos and images, offering deep discounts on premium phones and electronics. These sites aim to steal card, net-banking or UPI details, or deliver fraudulent goods. Skepticism should be applied to misspelled URLs, missing contact information, vague refund policies, and prices unrealistically below market standards. Official app stores or manually typing the retailer's web address are safer alternatives than clicking links from unsolicited messages.

Secondly, fraudulent delivery notifications exploit the surge in package deliveries during Diwali. Messages claiming address issues, unpaid fees, or delayed parcels may lead to phishing pages demanding personal data, card information, or payment for "shipping charges." Genuine couriers never ask for bank passwords, UPI PINs, or one-time passwords (OTPs) for delivery. Verifying the message through the courier's official app or website, rather than clicking embedded links, is crucial.

Thirdly, scammers may post hoax customer-care numbers following failed payments or delays. These calls may impersonate support agents, requesting OTPs, screen-sharing access, or pressure to install malicious apps. Sharing such credentials with anyone claiming to be from financial institutions, marketplaces, or payment platforms is strictly prohibited. Only use the support contact listed within the official app or on the company's verified website.

Fourthly, malicious QR codes disguised as Diwali cashback, refunds, or gifts circulate through messaging apps. Scanning these codes can redirect users to fraudulent sites, trigger payment requests, or install malware. Before scanning, verify the recipient's name on the UPI confirmation screen. A personal name instead of a merchant's account is a significant warning sign, especially for high-value electronics purchases.

Fifthly, refunds and cashback scams involve receiving unexpected refunds or cashback, requiring users to scan QR codes or approve UPI collect requests. In reality, receiving money does not necessitate providing a UPI PIN or approving a payment, which transfers funds out of the account. Skepticism towards refund messages before raising a complaint is advised, with verification of the order status only through the retailer's official app.

Sixthly, fraudulent payment requests may offer cash on delivery but switch to UPI at checkout, forcing buyers into irreversible transfers. Other fake storefronts may disguise payment links as order confirmations, festive bonuses, or requests to reserve deals. Using the marketplace’s own checkout flow, opting for payment methods with dispute protection, and avoiding transfers to individual UPI IDs for unknown sellers mitigates this risk.

Seventhly, counterfeit smartphone listings inundate the market with deep discounts on iPhones, flagship Android devices, and accessories. Fraudsters use copied images, fake reviews, and countdown timers to create urgency. Comparing model numbers, prices, and seller ratings across official brand stores and reputable retailers helps identify genuine listings. Checking the warranty terms, return policy, and whether the seller specifies an Indian warranty is also essential before payment.

Lastly, fraudulent shopping apps and forwarded "Diwali hamper" links mimic popular marketplaces, harvesting credentials or steering users into payment pages. Even messages from trusted contacts can be compromised if their account is breached. Downloading apps exclusively from official app stores, checking developer details and reviews, and avoiding unnecessary permissions on granted apps are vital preventive measures.

In case of any scam, immediate actions include contacting the national cybercrime helpline at 1930, reporting the incident at cybercrime.gov.in, and informing the bank or payment app to attempt freezing or recalling the transaction. Saving screenshots, transaction IDs, phone numbers, links, and bank statements as evidence is crucial.

The safest rule for Diwali shoppers is to verify the store, sender, and payee, and never share OTPs or UPI PINs to receive money.