Act this weekWhat happenedDelhi Police issued a cyber-safety advisory before Diwali about fraudulent gift messages, fake shopping sites, malicious APK files and courier scams.
Who is affectedOnline shoppers and digital payment users, including UPI and net banking users, WhatsApp users and anyone expecting a delivery.
What to do- 1Do not tap links or open APK files sent as gifts or greeting cards, even from people you know.
- 2Check the website address carefully and shop through official apps, not unfamiliar sites with huge discounts.
- 3Never share your UPI PIN or bank one-time password, and remember you do not need to scan a QR code to receive money.
- 4If scammed, call your bank to block cards and net banking, then call 1930 or file a report at cybercrime.gov.in.
Delhi Police have warned that Diwali shoppers are being targeted with fake gift messages, fake online stores and fake courier calls. The advisory, issued ahead of the festival, says the goal is to steal bank details or take control of a phone. Festive buying, online payments and home deliveries all rise at this time of year, which gives fraudsters more openings.
What the police found
The advisory came from a Delhi Police unit linked to the Indian Cyber Crime Coordination Centre. It describes several tricks running at the same time:
- A WhatsApp message promising Diwali gifts worth Rs 8,000, with a link that may be used to steal personal and banking information.
- APK files sent as Diwali greeting cards. An APK is an app installation file, and opening one can install malware, which is harmful software.
- Fake shopping sites selling phones and electronics at discounts of up to 90 per cent.
- Calls from people posing as Blue Dart, India Post or other delivery staff, claiming an order is held or an address must be updated.
Refund scams and fake help lines
Police also cautioned about fake customer-care numbers. In refund frauds, criminals may talk victims into installing remote-access apps such as AnyDesk or UltraViewer. These apps let an outsider control a phone or computer, and the fraudster can then try to make unauthorized transactions from linked bank accounts.
A common QR code mix-up
The advisory also clears up a widespread misunderstanding. A person does not need to scan a QR code to receive money. QR codes are generally used to make payments. Police say no one should ever share a UPI PIN or a bank one-time password with anyone, whatever the reason given.
Who can relax a little
Nothing in the advisory says that simply receiving a message causes harm. The danger starts when someone taps a link, installs a file, shares a code or follows instructions from a caller. People who do not shop online or expect deliveries face fewer openings, but gift messages and greeting cards can reach anyone with a phone.
What to do
The alert box above lists the steps. One point is worth stressing: speed matters. Police say prompt reporting can improve the chance of getting the defrauded amount frozen in the bank account. The order is bank first, then the 1930 helpline.
What happens next
The material does not say how many people have been defrauded or whether more advisories will follow. Police ask residents to stay alert through the Diwali period while shopping, receiving deliveries and answering promotional messages. For any courier call, check the company's official website and get the customer-care number there, not from the caller.
The takeawayDo not tap, install or share anything tied to a Diwali gift or delivery, and if money is lost, call your bank first and then 1930.