The Fake Flash Sale Site
Scammers register domains that swap one letter or add a hyphen to a familiar name, fipkart.com, amazon-in-sale.com, and run Google or Instagram ads pointing to them. The site loads fast, the products look real, and the prices sit 60 to 70 percent below what the actual platform shows. The tell is the URL. Before you enter a card number, read the address bar character by character. If the domain is anything other than amazon.in, flipkart.com, or myntra.com with no additions, close the tab. A padlock icon means the connection is encrypted, not that the site is legitimate.
The UPI Collect Request Disguised as a Refund
You get a call or message: your order has a problem, we are processing your refund, please approve this UPI request to receive the money. Approving a UPI collect request sends money out of your account, not into it. No legitimate platform, courier, or bank will ever ask you to approve a collect request or enter your UPI PIN to receive a refund. Refunds arrive automatically. If someone is asking you to do something to get money back, they are taking money, not returning it.
Sponsored Social Media Listings for Goods That Do Not Exist
A sponsored post on Instagram or Facebook shows a limited-edition item at a price that makes sense only if the seller is losing money. You tap, you pay, nothing arrives. The account was created weeks before the sale season, has no real reviews, and the contact number goes dead after payment. The check: look at when the seller account was created and whether its older posts are about anything other than festival discounts. A seller with six weeks of history and no content before October is a seasonal operation. Stick to sellers with a verifiable track record on a platform that holds escrow.
The OTP Phishing Call
A caller identifies themselves as a customer care agent from a platform you actually use, sometimes quoting your recent order number, which they obtained from a data breach or a dark-web list. They say your account has suspicious activity and they need to verify your identity. They ask for the OTP that just arrived on your phone. The OTP they triggered is a login or payment authorisation. Reading it aloud hands them your account or completes a transaction. No platform's customer care will ever ask for an OTP. The moment someone asks for it, hang up.
The Fake Delivery Notification with a Malicious Link
An SMS arrives: your package could not be delivered, pay a small customs or re-delivery fee here. The link opens a page that looks like a courier portal and asks for card details to process the payment. Legitimate couriers in India, Delhivery, Blue Dart, Ekart, DTDC, do not charge re-delivery fees over SMS links, and they do not ask for card numbers to reschedule. If you are expecting a package, track it directly on the courier's official app or website using the tracking number from your original order confirmation.
