Online scams in India don’t look like scams anymore. They come as a courier update, a “police officer” on a video call, or a clean-looking sale page that’s selling something that doesn’t exist. Some now use cloned voices built with the same kind of software we cover in our complete guide to AI tools in 2026. The goal is always the same: get you to act before you stop to think.
This guide is the one page to bookmark and send to your family WhatsApp group. It covers the 12 scams doing the most damage right now, the festive-season tricks that peak in October and November, what to do in the first 60 minutes after you lose money, how to report on 1930 and cybercrime.gov.in, and when your bank has to refund you.
First, a quick look at the size of the problem. These are official figures, not survey estimates.
- 1,01,928 cybercrime cases were registered in 2024, up from 86,420 in 2023 and roughly double the 2020 figure (NCRB, Crime in India 2024).
- More than 65.89 lakh financial fraud complaints were filed on the National Cyber Crime Reporting Portal between 2021 and 2025, reporting losses of more than ₹55,050 crore (MHA reply in the Lok Sabha, 21 July 2026).
- Only about ₹8,189 crore of that was frozen by banks. That’s roughly ₹1 in every ₹7 reported.
That last number matters most. Money gets frozen when people report fast. Most of this guide is about how to be one of those people.
One caveat on that chart. NCRB only counts registered FIRs, and fewer than 2 lakh FIRs came out of those 65 lakh-plus portal complaints. So the true number of people targeted is far higher than the bars show.
Festive-season scams to watch right now
Amazon’s Great Indian Festival went live on 8 October and Flipkart’s Big Billion Days opened to everyone on 9 October. Diwali falls on 8 November. For the next four weeks your phone will be full of offers, delivery updates and “payment pending” alerts. Scammers know you’re expecting all three.
CERT-In, India’s national cyber security agency, has issued festive-season warnings in past years. Its October 2024 advisory flagged phishing messages that pretend to be from well-known brands, fake lottery and prize offers, and fake shopping sites. Here’s how those play out this season.
1. Fake sale links and clone shopping sites
You see an Instagram or Facebook ad for a ₹70,000 phone at ₹9,999, or a WhatsApp forward about a “Diwali mega sale, only today”. The link opens a site that looks a lot like a real store. You pay by UPI, and nothing ever ships.
- Red flag: the price is far below every other store, the site only takes UPI or bank transfer, and the web address is slightly off (extra words, odd endings such as .shop, .top or .xyz).
- What to do: type the store’s address yourself or open its official app. Never buy from a link in an ad or forward.
2. Delivery OTP and “failed delivery” scams
With five parcels on the way, a message saying “Your package is on hold, address incomplete, pay ₹25 to reschedule” feels believable. The link leads to a card or UPI page that captures your details, or it asks you to install an app.
The phone version is a “courier executive” who says they need an OTP to confirm your delivery. The OTP you get is often a bank or wallet code, or a login code for one of your accounts.
- Rule: a real delivery OTP is for an order you placed, and you show it to the agent standing at your door. Never read an OTP out to a caller.
- Check: track parcels only inside the shopping app or on the courier’s official site.
- Never dial a code a caller gives you. The Department of Telecommunications has warned that dialling *401# followed by an unknown number can forward all your calls, bank OTP calls included, to the scammer. Telecom companies never ask you to do this.
3. UPI collect requests and “scan to receive” tricks
Some good news first. In a circular dated 29 July 2025, NPCI directed banks and UPI apps to make sure no person-to-person (P2P) collect request is processed on UPI from 1 October 2025. A stranger can no longer just “request” money from your UPI ID. The change was widely reported as an anti-fraud step, because fake collect requests had long been used to trick people into approving payments.
Scammers moved on. The ban covers person-to-person requests only, so merchant collect requests still exist, and fake “merchants” send payment requests dressed up as refunds or cashback. Others send a QR code or payment link and say “scan this to receive your refund”.
The one rule that beats all of these: you never need to scan a QR code or enter your UPI PIN to receive money. A PIN always means money is leaving your account.
4. Fake gift, cashback and “Diwali bonus” messages
“Congratulations! You’ve won a Diwali gift from [brand]. Spin the wheel.” These spread on WhatsApp and Telegram every year. The spin is rigged so you always win, and then you pay a “delivery fee” or enter card details to claim it. The same wave brings fake festive greetings with an .apk file attached.
Real brands don’t make you pay to receive a gift. If a prize needs a fee, your card details or an app install, it isn’t a prize.
The 12 most common online scams in India in 2026
Almost every scam uses one of three levers: fear (police, arrest, account blocked), greed (returns, prizes, jobs) or urgency (only today, act in 10 minutes). Once you spot the lever, the scam loses most of its pull.
1. Digital arrest scams
A caller says a parcel in your name was caught with drugs, or your Aadhaar was used for money laundering. You’re moved to a video call with a “CBI officer” or “police inspector” in uniform, sometimes sitting in front of a fake police-station backdrop. You’re told you’re under “digital arrest”, that you can’t hang up or tell anyone, and that you must move your savings to a “safe RBI account” for verification.
There is no such thing as a digital arrest under Indian law. Police don’t arrest people over video calls, and no agency asks you to transfer money to clear your name. In 2024 alone, people filed about 1.23 lakh digital arrest complaints and reported losses of ₹1,935.51 crore, according to an MHA reply in the Rajya Sabha. I4C has blocked more than 3,962 Skype IDs and 83,668 WhatsApp accounts linked to these calls.
2. Stock market and investment scams
It starts with a WhatsApp or Telegram group that shares “free tips” from a so-called market expert. Members post screenshots of big profits. You’re then moved to a trading app or website that shows your money growing fast. When you try to withdraw, you’re asked for a “tax” or “unlock fee”. The app is fake, and the profits on screen never existed.
- Real brokers are registered with SEBI. Check the name on SEBI’s website before you invest a rupee.
- Nobody guarantees returns, and a genuine platform never charges a fee before letting you withdraw.
3. Task-based and part-time job scams
“Earn ₹3,000 a day from home by liking YouTube videos or rating hotels.” The first few tasks really do pay a small amount, which builds trust. Then come “prepaid tasks” where you deposit money to earn a bigger commission. The deposits grow, and the payouts stop.
If a job asks you to pay before you can earn, it’s not a job.
4. UPI frauds
Collect requests are mostly gone, but UPI fraud isn’t. The common versions now are:
- “Sent by mistake”: someone sends you a fake payment SMS or screenshot, then calls in a panic asking you to return the money. Check your actual bank balance. Nothing arrived.
- Buyer scams on OLX-type sites: the “buyer”, often claiming to be in the army, sends a QR code so you can “receive” the payment.
- Swapped shop QR codes: a fraudster pastes their own QR sticker over a shop’s code. Always check the name your app shows before you pay.
5. Phishing: KYC, electricity bill and e-challan messages
“Your account will be blocked today, update KYC.” “Your electricity will be cut at 9:30 pm tonight, call this officer.” “You have a pending traffic e-challan, pay here.” Each one pushes you to a fake page or a phone call where you’re walked into sharing details.
Two RBI moves help you here. Banks have been told to make transactional and service calls only from numbers in the 1600xx series. They’ve also had to move their websites to the .bank.in domain, which only RBI-regulated banks can register. A “bank” link that doesn’t end in .bank.in deserves a hard second look.
6. Malicious APK files
A file called “Wedding_Invitation.apk”, “RTO_Challan.apk” or “PM_Yojana.apk” lands in WhatsApp, sometimes from a hacked contact you know. If you install it, the app can read your SMS, so it sees your OTPs. Some also send the same file to everyone in your contacts.
Real invitations are PDFs or images, not apps. Never install an .apk from a chat, and keep “install unknown apps” switched off on Android.
7. Fake customer care numbers
You search “airline refund customer care number” and call the first result. It’s a scammer’s number planted in search listings, social media posts or fake review pages. They ask you to install a screen-sharing app “to process the refund”, and then watch you type your PIN.
Get helpline numbers only from the company’s official app or website, or from the back of your card.
8. AI voice cloning and deepfake impersonation
A few seconds of someone’s voice from a reel or video can be enough to clone it. Parents get calls that sound exactly like their son: “I’ve been in an accident, don’t tell Papa, send ₹50,000 to this number.” Office staff get WhatsApp messages from a “boss” with the right profile photo, asking for gift cards or an urgent transfer. Deepfake videos of celebrities and business leaders “recommending” investment apps are now common too.
AI makes these scams more convincing, and it fails in quieter ways too. We collected real cases in what happens when AI gets it wrong, with real cases of AI errors that cost people money. The defence for voice scams is simple and doesn’t need any technology: agree on a family code word, and always call the person back on the number you already have saved.
9. Sextortion video calls
A video call from an unknown number shows explicit content for a few seconds. The scammer records your face next to it and then threatens to send the clip to your contacts unless you pay. Some follow up with a fake “cyber police” call demanding a “settlement”.
Don’t pick up video calls from unknown numbers. If it happens, don’t pay, because paying always leads to more demands. Block the number, save the evidence and report it on cybercrime.gov.in.
10. Instant loan app scams
An app promises a ₹10,000 loan in five minutes with no paperwork. It asks for access to your contacts and photos. You get less than promised, the interest is huge, and recovery agents start harassing you and the people in your contacts, sometimes with morphed photos.
Borrow only from apps linked to a bank or an RBI-registered NBFC. The lender’s name must be shown clearly in the app and on the loan agreement.
11. Online shopping and marketplace fraud
This covers fake stores (see the festive section above), sellers on social media who vanish after taking advance payment, and fake rental or pet listings that ask for a “token amount”. The pattern repeats: pay first, outside a protected platform, to someone you can’t verify.
12. SIM swap and call forwarding fraud
If someone gets a duplicate of your SIM, or forwards your calls, they can receive your OTPs and reset your banking passwords. Warning signs: your phone suddenly loses signal for hours, or people say your calls go somewhere else.
- Call your telecom operator straight away if your SIM stops working with no explanation.
- Check which mobile numbers are registered in your name on the government’s Sanchar Saathi portal (sancharsaathi.gov.in), and report any you don’t recognise.
The golden hour: what to do in the first 60 minutes after fraud
Scammers rarely keep stolen money in one account. They move it through “mule” accounts, usually within minutes or hours, and every hop makes it harder to trace. The I4C system behind 1930 works by alerting the banks in that chain so they can freeze the money before it’s withdrawn. Through it, more than ₹11,158 crore had been saved in over 32.80 lakh complaints by 30 June 2026.
That only works if you report while the money is still moving. Here’s the order to follow.
What to do immediately after online fraud
- Call 1930 right away. This is the national cyber fraud helpline. Give the transaction details so the money can be flagged and frozen. If you can’t get through, file the complaint at cybercrime.gov.in under “Financial Fraud”.
- Call your bank’s official 24×7 helpline. Use the number on your card or in your bank’s app. Report the transaction as fraud and ask them to block your card, UPI and net banking.
- Lock everything down. Change your UPI PIN, net banking password and email password. Log out of all devices.
- Cut off the scammer’s access. Uninstall any screen-sharing app or APK they asked you to install. Check that call forwarding is switched off in your phone settings.
- Save the evidence. Write down or screenshot the UTR or transaction ID, the amount, time, the scammer’s number or UPI ID, chat screenshots and website links. Don’t delete the chats.
- Note your complaint numbers. Keep the 1930 or cybercrime.gov.in acknowledgement number and your bank’s complaint reference. You’ll need both later.
- Send a written complaint to your bank by email or through the app the same day. This creates the time-stamped record the refund rules depend on.
- Ignore anyone who offers to “recover” your money for a fee. Recovery scams target people who have just been cheated.
Steps 1 and 2 matter far more than the rest. If you only have five minutes, call 1930, then call your bank.
How to report: 1930 and cybercrime.gov.in, step by step
India’s official reporting system is run by the Indian Cyber Crime Coordination Centre (I4C), which comes under the Ministry of Home Affairs. You have two ways in. Use both if you’ve lost money.
Option 1: Call the 1930 helpline
- 1930 is toll-free. Use it first when money has already left your account.
- Keep these ready: your bank name, account or card number (last digits are enough to start), the UTR or transaction ID, the amount, date and time, and the scammer’s number or UPI ID.
- Write down the acknowledgement or complaint number you’re given.
- Follow up on the portal. A call alone may not complete your complaint, so make sure it shows up on cybercrime.gov.in with your details.
Option 2: File a complaint on cybercrime.gov.in
The National Cyber Crime Reporting Portal handles every type of cybercrime. These steps follow the labels the portal used when we checked in October 2026. Labels may shift slightly over time.
- Open the portal. Type cybercrime.gov.in into your browser yourself. Scammers run look-alike sites, so don’t use a link from a message.
- Choose the right category. From the home page or the “Register a Complaint” menu, pick Financial Fraud if you lost money. Use Other Cyber Crime for hacking, fake profiles or harassment. Crimes against women and children have a separate option that lets you report anonymously.
- Log in with your mobile number. You’ll get an OTP to verify the number, then fill in your name and state.
- Enter the incident details. Add the date and time, the type of fraud, and each transaction: bank or wallet name, transaction ID or UTR, date and amount. Add every transaction separately if there was more than one.
- Add suspect details and evidence. Enter the phone numbers, UPI IDs, bank accounts, websites or social media handles used. Upload screenshots and keep the originals.
- Write a clear description. Say what happened in order, in plain words: who contacted you, what they said, and what you did.
- Preview, submit and save. You’ll get an acknowledgement number. Use “Track your Complaint” on the portal to check progress.
Other useful reporting tools
- Report & Check Suspect (cybercrime.gov.in): look up a phone number, email, website or app in I4C’s suspect repository before you pay someone, or report one.
- Chakshu (sancharsaathi.gov.in): report suspicious calls, SMS or WhatsApp messages before you’ve lost money. It’s for suspected fraud only. If money is gone, use 1930.
- Local police or cyber cell: for large losses, ask whether an FIR should be filed. Between 2021 and 2025, fewer than 2 lakh FIRs were registered against more than 65 lakh portal complaints, so an FIR doesn’t happen automatically.
Will the bank refund you? RBI zero-liability rules explained
It depends on two things: whose fault it was and how fast you told your bank. RBI’s framework has rules for both, and the rules change on 1 January 2027. Here’s where things stand.
The rules that apply today (fraud up to 31 December 2026)
These come from RBI’s 6 July 2017 circular, “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions”. RBI later carried them into its Responsible Business Conduct Directions, 2025, which consolidated its rules for banks.
| Situation | When you report | Your liability |
|---|---|---|
| Fraud caused by the bank’s fault or negligence | Any time, even if you don’t report | Zero |
| Third-party breach (neither you nor the bank at fault, e.g. card skimming or a system hack) | Within 3 working days | Zero |
| Third-party breach | 4 to 7 working days | The transaction amount or a cap, whichever is lower: ₹5,000 (basic savings), ₹10,000 (most savings accounts, credit cards up to ₹5 lakh limit), ₹25,000 (other current accounts, credit cards above ₹5 lakh) |
| Third-party breach | After 7 working days | As per your bank’s board-approved policy |
| Your own negligence (e.g. you shared your OTP, PIN or password) | Any time | You bear the loss until you report it. The bank bears anything after that. |
Three other rules from the same circular help you:
- The bank must prove you were negligent. The burden of proof is on the bank, not on you.
- Shadow credit within 10 working days. Once you report, the bank must credit the disputed amount (a “shadow reversal”) within 10 working days, value-dated to the day of the fraud.
- 90-day limit. The bank must resolve the complaint within 90 days. If it doesn’t, it has to pay the compensation the rules provide.
The hard truth: most scams covered above involve you being tricked into sharing an OTP, entering a PIN or approving a payment. Banks usually treat that as customer negligence. That’s why reporting fast matters so much, and why freezing the money through 1930 is often your best chance to get it back.
What changes from 1 January 2027
On 24 June 2026, RBI issued the Commercial Banks – Responsible Business Conduct Third Amendment Directions, 2026 (RBI/2026-27/167). Matching directions cover small finance banks, payments banks, regional rural banks, local area banks and co-operative banks. They apply to transactions made on or after 1 January 2027. Here’s what they say:
- Wider cover. The rules move from “unauthorised” to “fraudulent” electronic banking transactions. That includes payments made by a fraudster with credentials they got out of you by deceit, and payments you approved yourself under coercion or duress, as in a digital arrest call.
- 5 calendar days for third-party breaches. Zero liability and a reversal apply if you report within five calendar days of the transaction. After that, your liability follows the bank’s policy. Fraud caused by the bank’s own negligence stays zero liability whenever you report.
- “Customer negligence” is now spelled out. It includes being careless with your PIN, password or OTP, reporting late, ignoring a specific warning from your bank that a payment looks like a scam, downloading malicious apps, and not updating your mobile number or email with the bank.
- A one-time compensation scheme for small frauds. If you were negligent and lost up to ₹50,000, you can get 85% of the net loss (after any recovery) or ₹25,000, whichever is lower. It’s open to individuals, including sole proprietors, and you can claim it only once in your lifetime. You must report the fraud to both your bank and 1930 or cybercrime.gov.in within five calendar days. The bank pays within five calendar days of getting your application. The scheme covers frauds that happen in the year after 1 January 2027, and RBI funds most of the payout.
- Faster timelines. Banks must investigate and reply within 45 calendar days for domestic fraud and 60 for cross-border fraud. For credit card fraud, they must give a shadow reversal within five calendar days. If they reject your claim, they must tell you why.
- Alerts and reporting. Instant SMS alerts become mandatory for every electronic transaction above ₹500, plus email alerts if you’ve given an email address. Banks must offer 24×7 ways to report fraud and put a “report fraud” link on the home page of their website and app.
Your bank’s own customer protection policy will spell out exactly how it applies these rules, and it’s usually on the bank’s website. If the bank rejects your claim or doesn’t reply within 30 days, you can escalate to the RBI Ombudsman at cms.rbi.org.in.
How to protect elderly parents: a 10-point checklist
Older people lose far more per complaint. In a Rajya Sabha reply on 5 August 2026, MHA said senior citizens filed 1,03,488 financial cyber fraud complaints on the national portal in 2025, reporting ₹4,005.12 crore. That works out to nearly ₹3.9 lakh per complaint. The same reply gives about ₹81,000 per complaint for women, so seniors reported almost five times as much per case. For many families, that’s a big part of someone’s life savings.
Sit with your parents this Diwali and go through this list together.
- Save 1930 in their phone as “Cyber Fraud Helpline”, along with the bank’s official helpline.
- Teach them one sentence: “Police, CBI, RBI and banks never ask for money or OTPs on a call.”
- Agree on a family code word to check any urgent “it’s me, I’m in trouble” call.
- Make it okay to hang up. Tell them it’s never rude to cut a call and call you first, however official the caller sounds.
- Keep a separate spending account. Link UPI to an account with a small balance, and keep pension and savings in an account with no UPI attached.
- Set low transaction limits for UPI and net banking in the bank app, and switch off international card use if they don’t travel.
- Lock down the phone. Turn off installs from unknown sources, remove any screen-sharing apps they don’t need, and set WhatsApp to silence calls from unknown numbers.
- Make sure alerts reach them. Check that the bank has their current mobile number and email, so every transaction SMS goes to a phone they actually use and read.
- Show them the real thing. Open their bank app together and point out what a genuine alert looks like and where the “report fraud” option is.
- Talk about scams without blame. People who feel embarrassed hide losses, and hiding costs the golden hour. Make sure they know they can call you at any hour, whatever happened.
FAQ: online scams in India
What are the most common online scams in India right now?
The biggest ones are digital arrest calls, fake stock market and investment apps, task-based job scams, UPI tricks such as fake QR codes and “sent by mistake” calls, phishing messages about KYC, electricity bills and e-challans, malicious APK files, fake customer care numbers and AI voice-clone calls. In October and November, add fake sale sites, delivery OTP scams and fake Diwali gift messages.
How do I report cyber fraud and get money back?
Call 1930 or file a complaint under “Financial Fraud” on cybercrime.gov.in as fast as you can, and report the transaction to your bank’s official helpline at the same time. Fast reporting lets banks freeze the money before it’s withdrawn. Whether your bank must refund you depends on RBI’s liability rules: who was at fault and how quickly you reported. If the bank doesn’t resolve it, escalate to the RBI Ombudsman.
What should I do in the first hour after a UPI fraud?
Call 1930 with your UTR number, amount and the scammer’s UPI ID. Then call your bank to block UPI and report the fraud, and change your UPI PIN and banking passwords. Uninstall any app the scammer asked you to install. Save screenshots and the transaction ID, and keep your complaint acknowledgement numbers.
Is “digital arrest” real?
No. There’s no provision for digital arrest in Indian law. Police and agencies such as the CBI or ED don’t arrest people on video calls or ask them to transfer money for “verification”. Hang up and report the number on 1930 or cybercrime.gov.in.
Will I get a refund if I shared my OTP?
Under the current RBI rules, sharing an OTP is usually treated as customer negligence, so you bear the loss until you report it. For frauds between 1 January 2027 and the end of that year, RBI’s new scheme pays 85% of the net loss, up to ₹25,000, on losses up to ₹50,000. You can claim it once in your lifetime, and only if you report to both your bank and 1930 or cybercrime.gov.in within five calendar days.
The bottom line
Scams keep changing their costumes: a courier this month, a police officer the next, a cloned voice after that. The defence doesn’t change. Slow down when someone rushes you. Never share an OTP or enter a PIN to “receive” anything. Verify on a number you already trust. And if money goes, call 1930 before you do anything else.
Share this with the people in your family who are most likely to pick up an unknown call, because they’re the ones scammers call first. And if you’re shopping this month, read our guide on spotting fake festive sale discounts before you check out.
Sources: NCRB, Crime in India 2024; Ministry of Home Affairs replies to Lok Sabha Unstarred Question 251 (21 July 2026) and Rajya Sabha Unstarred Question 1994 (5 August 2026); I4C and the National Cyber Crime Reporting Portal (cybercrime.gov.in); RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18 (6 July 2017) and RBI Third Amendment Directions, 2026, RBI/2026-27/167 (24 June 2026); NPCI circular NPCI/UPI/OC/220/2025-26 (29 July 2025); CERT-In advisories; Department of Telecommunications. This article is for general information and isn’t legal or financial advice.
