The festive season usually brings a surge in online shopping, digital payments and attractive discount offers. Consumers may receive dozens of messages about sales, cashback, parcel deliveries, refunds and limited-time deals as retailers and e-commerce platforms compete for attention.
The same environment can also be exploited by cybercriminals.
Fraudsters may imitate banks, delivery companies, online shopping platforms or customer-care representatives to make fraudulent messages appear genuine. Fake shopping links, refund scams, QR codes, phishing messages and calls asking for sensitive banking information are among the tactics consumers should watch for.
A moment of caution before clicking a link or approving a payment can make a significant difference. Here are some important precautions to follow while shopping and making digital payments during the festive season.
1. Don't Rush to Open a Festive Offer Link
Messages containing phrases such as "Offer ends today," "Claim cashback now," "Limited-time reward" or "Your gift is waiting" are designed to encourage immediate action.
Legitimate businesses also use promotional language, so urgency alone does not prove that a message is fraudulent. However, unexpected offers should always be verified before you interact with them.
Examine the website address carefully. A fake shopping website may use a domain that looks similar to a well-known brand but contains an extra character, unusual spelling or a different domain extension.
Avoid downloading unknown attachments or applications from links received through unsolicited SMS, WhatsApp messages, emails or social-media posts.
When in doubt, open the company's official app or manually visit its verified website rather than following the link in the message.
2. Be Extra Careful While Making UPI Payments
UPI makes digital payments convenient, but users still need to verify every transaction before approving it.
One of the most important points to remember is that you generally do not need to enter your UPI PIN simply to receive money. The PIN is used to authorise transactions from your account.
Before approving a UPI payment, carefully check the recipient's name and the amount displayed on the payment screen.
Never disclose your UPI PIN to another person, including someone claiming to represent a bank, shopping platform or customer-support team.
Also be suspicious if someone claims you need to scan an unknown QR code and enter your PIN merely to receive a refund, cashback or prize. Scanning a QR code can initiate a payment flow, so always read the information displayed on your UPI app before authorising anything.
3. Fake Refund and Delivery Messages Can Look Convincing
Festive shopping means consumers are often waiting for several packages at the same time. That can make fake delivery notifications particularly convincing.
A message may claim that your parcel could not be delivered because of an incorrect address and ask you to click a link. Another may claim that a refund is pending and request your bank or card information.
Instead of trusting the message directly, verify the status from the shopping platform's official application or website.
Do not provide card details, passwords, OTPs or other sensitive information through an unknown webpage simply because the message mentions an order or delivery.
4. Beware of Fake Customer-Care Executives
Cybercriminals may also pose as customer-support representatives.
A fraudster could claim that your refund has failed, your bank account requires verification or there is a problem with an online order. The caller may then ask for an OTP or instruct you to install a screen-sharing or remote-access application.
Treat such requests as a serious warning sign.
Remote-access applications can allow another person to see or control parts of your device when permission is granted. Never install one merely because an unsolicited caller says it is required to process a refund or solve a banking problem.
If you genuinely need assistance, disconnect the call and contact the organisation using the customer-care details available on its official website or app.
5. Never Share OTP, PIN, CVV or Passwords Over a Call
Fraudsters may impersonate bank officials, delivery agents, government representatives or customer-care employees to gain a victim's trust.
No matter how convincing or urgent the caller sounds, do not disclose sensitive credentials such as your OTP, UPI PIN, ATM/debit card PIN, CVV, internet-banking password or other authentication information.
Do not assume that a call is genuine merely because the person already knows your name, mobile number, address or some transaction-related information.
If the caller claims there is an urgent problem with your account, end the call and independently contact the organisation through a verified channel.
6. Stop Immediately If a Payment Request Looks Suspicious
Many scams succeed because victims are pressured to act quickly.
A fraudster may claim that a payment has failed, an account will be blocked, a parcel will be cancelled or a cashback offer will expire within minutes.
Do not allow this urgency to override basic security checks.
If the name, amount, QR code, payment request or website looks unfamiliar, stop the transaction. Verify the request independently before proceeding.
The few extra minutes required for verification can be far less costly than approving a fraudulent transaction.
What to Do If You Have Already Been Scammed
If you suspect that money has been fraudulently transferred from your account, contact your bank or payment provider immediately and report the transaction through official channels.
In India, victims of financial cyber fraud can also report incidents through the government's cybercrime reporting mechanisms. Acting quickly may improve the chances of limiting further loss, although recovery cannot be guaranteed.
If credentials such as a password or card information may have been compromised, change the affected passwords, block the card where necessary and review recent account activity.
Stay Alert While Shopping During Festive Sales
Festive discounts and cashback offers can be useful, but a deal should never require you to ignore basic digital-security practices.
Use official shopping and banking apps, verify website addresses, carefully review every UPI payment, avoid unknown QR codes and never reveal confidential banking credentials to callers or message senders.
Most importantly, do not let an offer's urgency pressure you into making an immediate payment. Verify first and pay only when you are confident that the merchant, request and transaction details are genuine.
