Festive sale scams: how fake shopping sites take your money

Every festive season, the same trap returns in a new design. A sale advertisement appears on Instagram, Facebook, WhatsApp or in your search results. It carries a familiar brand name, a familiar logo and a price that looks too good to miss. In October 2026 two public warnings have repeated this message: one from Kerala Police and one from CyberDost, the public-awareness handle of the Indian Cyber Crime Coordination Centre (I4C).

What was reported. On 10 October 2026, a PTI report published by ThePrint said Kerala Police had warned the public against fake online festival sale offers. The police said fraudulent websites use names with small spelling changes to resemble popular shopping platforms, and that links are being spread through WhatsApp, Telegram, SMS and social media. On 21 October 2026, CyberDost I4C posted a similar advisory, reported by Digit.in on 22 October. It said scammers use well-known brand names, logos, product images and sale designs, and that such ads lead to websites that closely resemble official platforms.

How the scam works. The fake site is built to look like the real one: the same layout, the same product photographs, the same countdown timer. The buyer is asked to pay, often by UPI, card or an advance transfer. The CyberDost advisory warns that payments made on such sites may go straight to scammers. The420.in reported on 22 October 2026 that complainants in one case found their payments had gone to accounts bearing names different from the genuine store, and that buyers who paid in advance for dry fruits and firecrackers received nothing.

A second version of the trick uses the telephone. Kerala Police warned of fake customer-care calls that claim to help cancel an order or offer a special deal. Such calls are commonly used to obtain your OTP, card details or UPI approval. A genuine bank or shop does not need your OTP to help you.

The warning signs below combine the points in these reports with common fraud-prevention practice. First, a price far below normal, or a free gift attached to a purchase. Second, a link that reached you through a message, an advertisement or a sponsored search result rather than the official app. Third, a web address with a slightly altered spelling, or one that lacks https and the padlock symbol. Fourth, a demand for advance payment on a site you have never used before. Fifth, a payee name on the UPI screen that does not match the shop. Sixth, a seller who cannot be reached once payment is made.

Prevention is simple and costs nothing. The Digit.in report of the CyberDost advisory lists these precautions: check the website address before shopping, avoid ads and links from unknown sources, do not click sponsored links in search results, visit the platform's official website or app directly, avoid advance payment on new sites or with sellers who cannot be verified, and choose cash on delivery where possible so that the goods can be inspected. Kerala Police add that you should never share an OTP with anyone and should not enter bank, card or UPI details on unfamiliar sites.

If you have already paid, the first hour matters most. Step one: call the national cybercrime helpline 1930 at once and give the transaction details. Step two: file a complaint on the official portal, cybercrime.gov.in; both channels were named by Kerala Police in their warning. The remaining steps are general good practice. Step three: tell your bank in writing, through its app or branch, giving the transaction reference. Step four: take screenshots of the advertisement, the website address, the order page, the payee name and any chat or call details, and do not delete them. Step five: if you entered a card number, block the card; if you shared a password, change it from a clean device.

Speed matters because early reporting gives the authorities the best chance of acting on the receiving account, but recovery cannot be assured, which is a further reason to avoid the payment in the first place. Please do not pay anyone who contacts you offering to recover your money for a fee.

What the law says. Taking a payment for goods that the seller never intended to deliver can amount to cheating under BNS S. 318, and sub-section (4), which deals with dishonestly inducing a person to deliver property, carries imprisonment of up to seven years and a fine. Pretending to be a well-known shop or brand can amount to cheating by personation under BNS S. 319, which carries imprisonment of up to five years, or a fine, or both. The Information Technology Act, 2000 may also apply: IT Act S. 66D punishes cheating by personation using a computer resource. Whether these or other provisions are applied in a given case is a matter for the police and the court after investigation. Your complaint is the starting point.

A note on consumer rights. The420.in reports that the National Consumer Helpline received 17,71,622 complaints in 2025, of which 5,11,196, about 29 per cent, related to e-commerce. It also reports that the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, are expected to take effect from January 2027, and that they would cover sponsored listings and seller information. These rules are not yet in force, so they cannot help with a purchase made today.

How Codesnag helps. Codesnag is the cyber-security side of Codesnag × VirtualVakil. For families and small businesses, we run a free breach check, and members of Cyber Surety can message SOS on WhatsApp to reach a responder who walks through the steps above, from preserving evidence to securing accounts. Cyber-loss cover included, up to plan limits. T&C apply. Small businesses that run festive sales can ask us to review their public web presence for weaknesses that make a copycat site easier to build.

The short version for your family group: type the shop's address yourself, do not trust a link that arrives by message, never share an OTP, and if money has gone, call 1930 and file at cybercrime.gov.in within the hour. Forward this page to the relative who always says that they never fall for these things.