The festive shopping season may be over, but online fraud risks persist. Fake discount offers, cashback messages, impersonation calls and malicious applications continue to be used by fraudsters to trick consumers into sharing sensitive information or transferring money.
Recent cases highlight how these scams operate.
In Pune, an 80-year-old man allegedly lost ₹5 lakh after a fraudster posing as an Election Commission official persuaded him to download an application for a voter card update. In Hyderabad, an investigation into a fraud involving a promise of ₹45 lakh for an old ₹1 note reportedly uncovered a network of mule accounts.
With artificial intelligence (AI) making fraudulent websites, messages and voice calls more convincing, consumers cannot rely solely on obvious signs such as spelling mistakes or poor website design.
Cybersecurity firm Protectt.ai and the National Payments Corporation of India (NPCI) have highlighted several precautions consumers should follow to protect themselves from digital fraud.
Verify offers before clicking on links
Fake shopping websites, duplicate links and unsolicited messages offering discounts, cashback or free vouchers are common ways to lure consumers.
NPCI advises users to shop only through official websites and applications and avoid links or files received from unknown sources.
Protectt.ai also cautions against offers that demand advance payments, personal information or installation of unfamiliar applications to claim rewards.
Access a retailer’s website directly instead of following links received through WhatsApp, SMS or email.
Avoid downloading unfamiliar applications
Fraudsters may impersonate government officials, bank representatives or delivery companies and ask consumers to install applications to update documents, receive refunds or resolve account-related issues.
The Pune case illustrates how malicious applications can be used as part of such schemes. Protectt.ai warns that trojans and other malicious software circulated through email, SMS and WhatsApp can compromise devices and expose banking information.
Download applications only from trusted sources and review the permissions they seek before installation. Be particularly cautious about APK files shared through unsolicited messages.
Never disclose OTPs or UPI PINs
A caller claiming to represent a bank or payment application may say that a transaction has failed, an account is blocked or a refund is pending, and ask for an OTP to resolve the issue.
NPCI cautions users against sharing OTPs received for transaction authentication. Consumers should also never disclose their UPI PIN, card details, passwords or banking credentials to callers or through unsolicited messages.
AI-generated voice imitations and convincing impersonation attempts make independent verification important. Contact the organisation through its official customer service channels if you receive an unexpected request.
Make payments only through official platforms
Fraudulent sellers and messages may direct consumers to external UPI IDs or payment links instead of the official checkout page.
NPCI advises users to complete transactions within the shopping platform and verify seller details before making payments. Be wary of cashback or voucher offers that require an upfront fee or sensitive banking information.
Protectt.ai also cautions consumers against allowing others to use their bank accounts in exchange for money. Such accounts can be misused to move proceeds of fraud, potentially exposing account holders to financial and legal consequences.
Report suspected fraud without delay
Fraudsters often create urgency by claiming that an offer will expire or an account will be blocked unless consumers act immediately. NPCI recommends following the ‘Stop, Think, Act’ principle: pause when faced with an unexpected request, verify its authenticity and act only after checking the source.
If you suspect that your device has been compromised, stop using it for banking transactions until it is secured. Remove suspicious applications, change affected passwords using a trusted device and contact your bank if financial information may have been exposed.
If money has been lost, report the incident immediately through the national cybercrime helpline at 1930 or the National Cyber Crime Reporting Portal. Preserve transaction details, screenshots and relevant messages. Prompt reporting can help authorities and banks initiate action, although recovery of the money is not guaranteed.
Online fraud is not restricted to festive sales. Unsolicited calls, attractive offers and requests for personal or banking information can emerge at any time. Verifying the source before clicking a link, installing an application or approving a payment remains one of the simplest ways to reduce the risk.