Online Sale Scams 2026: Spot, Avoid and Report Them

Short answer

During sale season, scammers send fake “Big Billion Days” or “Great Indian Festival” links, fake delivery and refund calls, fake customer care numbers, prize messages and fake sale apps (APK files).

Shop only on flipkart.com, amazon.in or their official apps, and never share an OTP, PIN or screen with a caller. If money is taken, call 1930 at once, block your card or UPI in your bank app, and file a complaint on cybercrime.gov.in.

If this happens	Do this
Money lost to fraud	Call 1930 immediately, then report on cybercrime.gov.in
Card or UPI misused	Block it in your bank app or call your bank; report in writing within 3 working days
Suspicious call, SMS or WhatsApp, no money lost	Report on Chakshu (Sanchar Saathi portal or app)
Fake Amazon email or site	Forward to stop-spoofing@amazon.com; non-customers use reportascam@amazon.com
Fake Flipkart message or site	Report to Flipkart Help Centre in the app, or @flipkartsupport on X

The scale is large. India recorded 22.68 lakh cybersecurity incidents in 2024, up from 10.29 lakh in 2022, according to a government note from October 2025. The same note says quick reporting through the 1930 system has helped banks save more than ₹5,489 crore across 17.82 lakh complaints. Speed matters.

The 8 most common sale-season scams

1. Fake sale websites and WhatsApp links

A message says “Flipkart Big Billion Days: iPhone for ₹2,499” or “Amazon Diwali lucky offer”, with a link. The site looks like Flipkart or Amazon, but the address is different. Flipkart lists real examples of fakes, such as flipkart.dhamaka-offers.com, flipkart.biz, flipkart.org and unrelated addresses ending in .xyz. You pay, and nothing arrives, or your card details are stolen.

Rule: the real sites are flipkart.com and amazon.in. Anything before or after those words in the address, or a different ending, is not them.

2. Fake sale pages on Facebook and Instagram

In July 2026, Kerala Police warned about Facebook pages named “Flipkart GOAT SALE” and “Goat Sale Live” that advertised electronics at very low prices, then sent buyers to fake sites or WhatsApp chats asking for “booking charges” or “delivery fees”. Real stores never ask you to pay a booking fee to a personal UPI ID.

3. Fake “Big Billion Days” or sale APK apps

You get a file ending in .apk with a name like “Flipkart Sale” or “Amazon Offer”. Installing it can let the scammer read your SMS, including bank OTPs. In October 2025, Hyderabad police reported a man who lost ₹1 lakh after installing a malicious APK shared by a fake support number. Flipkart’s real Android app is published by Flipkart on the Play Store; apps with odd names like “Lite for Fk” are fake.

Flipkart guide to spotting fake Flipkart websites and apps — Image: Flipkart

4. Fake delivery OTP calls

A caller says your sale order is “on hold” and asks you to read out an OTP to confirm delivery. That OTP may actually be for a payment, a SIM swap or an account login. Flipkart says it never asks customers to read out payment OTPs over calls or texts. The only OTP you give is the delivery OTP to the delivery person at your door, for orders that use one, after you have the parcel in hand.

5. Fake refund and “cashback” calls

During and after sales, many people wait for refunds or bank cashback. Scammers call claiming to be from customer care, say a refund failed, and ask you to install a screen-sharing app or approve a request on UPI. RBI’s BE(A)WARE booklet warns never to download screen-sharing apps at a stranger’s request. Real refunds go back to your original payment method on their own; check the status in “Your Orders”. Our refund status guide and cashback timing guide explain the real timelines.

6. Fake customer care numbers

You search Google for “Flipkart customer care number” and call the first number shown. It belongs to a scammer. RBI warns that fraudsters plant fake numbers in search results. Use the Help Centre inside the official app or website instead.

7. UPI collect requests and QR codes

The basic rule from RBI: you never need to enter your UPI PIN to receive money. If an app asks for your PIN, you are sending money. NPCI stopped person-to-person “collect requests” on UPI from 1 October 2025, which removed one common trick, but scammers still use QR codes and merchant payment links. Never scan a QR code to “receive” a refund or prize.

8. Lucky draw and prize messages

“Congratulations! You have won a car in the Flipkart Diwali lucky draw. Pay ₹4,999 processing fee.” Flipkart’s advice: do not click the link, do not share details, do not call back, and do not forward it. RBI says never pay a fee to receive a prize.

Checklist of details never to share during online sales

How to check a link in 30 seconds

Pause. Amazon and I4C’s advice is to wait ten seconds before you tap any link that creates urgency.
Read the address, letter by letter. Real: flipkart.com, amazon.in. Fakes add words, change the ending or swap a letter for a number, like flipkart.dhamaka-offers.com or flipkart.biz (both flagged by Flipkart).
Look at the price. A new iPhone for ₹2,499 or 98% off everything is not a sale; it is bait.
Open the app yourself. Instead of tapping the link, open the Flipkart or Amazon app and search for the product. If the deal is real, it will be there.
Check the payment page. If it asks you to pay to a personal UPI ID, or shows a different store name, stop.

A genuine deal post, including the ones we share, should always land you on the official Flipkart, Amazon or brand website or app. Check the address bar after it opens. Our guide to spotting fake discounts covers the other side: real sites with misleading “discounts”.

Flipkart awareness graphic on OTP fraud — Image: Flipkart

What to do if you have been scammed

Act in this order. The first hour matters most, because banks can sometimes hold money before it is withdrawn.

Call 1930. This is the national cyber fraud helpline. Give the transaction ID, amount, time and the account or UPI ID you paid to.
Block your card or UPI. Use your bank app or call the number on the back of your card. Freeze UPI from the app if your phone may be compromised.
File on cybercrime.gov.in. Choose financial fraud, attach screenshots of messages, links and payment receipts. Note the acknowledgement number.
Tell your bank in writing (email or app complaint). Under RBI rules, if fraud happened because of a third party and you report within 3 working days, your liability is zero. Between 4 and 7 working days, liability is capped (₹10,000 for most accounts and cards). The bank must credit the disputed amount, as a shadow reversal, within 10 working days of your report, and settle within 90 days.
Uninstall unknown apps and change passwords for email, bank and shopping accounts. Turn on two-factor login.
Report to the store. Amazon: stop-spoofing@amazon.com for fake emails, or its self-service reporting tool. Flipkart: Help Centre in the app.
Report the number on Chakshu so it can be blocked. Chakshu, on the Sanchar Saathi portal and app, takes reports of fake customer care calls, phishing links and prize offers. It has received 7.7 lakh reports since launch.

If your bank does not respond, our RBI Ombudsman complaint guide explains the next step.

Simple habits for safe sale shopping

Save the official apps on your home screen and shop only from them.
Use a credit card for big online orders; disputes are easier than with UPI or debit cards.
Turn on transaction alerts by SMS and email for every card.
Do not use public Wi-Fi for payments.
Tell parents and grandparents about these scams; older family members are frequent targets.

Planning your sale shopping? Start with our Big Billion Days 2026 and Great Indian Festival 2026 guides.

Follow on WhatsApp (free)Join on TelegramNo spam, no forwards from strangers, leave any time.

Questions people ask

How do I know if a Flipkart or Amazon sale link is fake?

Check the address. Real sites are flipkart.com and amazon.in. Extra words, a different ending like .biz or .xyz, unbelievable prices or a request to pay a personal UPI ID mean it is fake.

Does Flipkart or Amazon ever ask for an OTP on a call?

No. Flipkart says it never asks customers to read out payment OTPs over calls or texts, and Amazon says it never asks for payment by phone or email. Only share a delivery OTP with the delivery person after you receive the parcel.

What is the cyber crime helpline number in India?

Call 1930 for online financial fraud, and file a complaint at cybercrime.gov.in. Call as soon as possible after the fraud.

Will my bank refund money lost to online fraud?

Under RBI rules, if a third party caused the fraud and you report it to your bank within 3 working days, your liability is zero. Reporting later can mean partial or full loss, so report immediately.

Is it safe to install a Big Billion Days app from WhatsApp?

No. Install the Flipkart or Amazon app only from the Google Play Store or Apple App Store. APK files shared on WhatsApp can steal your SMS and bank OTPs.

I got a 'you have won' message from Flipkart. Is it real?

Treat it as fake. Flipkart advises not to click links, share details, call back or forward such messages, and RBI warns never to pay a fee to claim a prize.

Sources

More Diwali 2026 guides