Before claiming a Diwali gift or cashback offer, ask three questions: who is offering it, where can you verify it independently, and what are you being asked to authorise? Pause if the answer involves sending money, sharing a redemption code or installing an unfamiliar app.
The message examples below are illustrative, not reports of particular incidents. Use them to recognise warning signs without assuming that every festive promotion is fraudulent.
Fake festive bonus and Diwali gift links
A message saying “Your festive bonus is ready” deserves verification before a click. CERT-In warns about phishing links offering prizes, rewards and cashback. It advises checking URLs and withholding personal information from unfamiliar websites.
For an employer bonus, contact HR through your usual workplace channel. For a shopping reward, open the retailer's app yourself and look for the offer there. For a claimed government gift, look for an announcement on the relevant department's official website. Do not use the message's own helpline as your verification source.
Treat “forward this to your family to unlock the gift” as a reason to stop. Do not pass along an unverified promotion, even with a disclaimer. Ask the person who forwarded it whether they independently confirmed the offer, rather than whether the page looked convincing.
Scratch cards and spin-the-wheel cashback
Imagine a page where scratching a card or spinning a wheel reveals a reward, followed by a request for a delivery charge, verification payment or bank login. Treat this as an unverified offer. The animation and congratulations screen should not decide whether you trust the next instruction.
Close the page and check the promotion through the named company's own service. Look for eligibility, the claim procedure and written terms. If you cannot find the offer independently, leave it alone. Do not make a small test payment to discover whether a larger reward will arrive.
When comparing an actual promotion, write down what you must spend, what you receive, where you can use it and when it expires. Ask whether the benefit is withdrawable money, a shopping balance or a discount on another purchase. Avoid treating these as interchangeable in your Diwali budget.
A boss, relative or officer asks for gift cards
Delhi Police describes gift-card impersonation scams in which someone posing as a boss asks an employee to buy cards and send the claim codes. The excuse may be that the boss is out of town or on a conference call. The recipient can then redeem or resell the cards.
An illustrative message is: “Buy vouchers for the team now; send photographs of the codes and I will reimburse you.” Stop before buying. Call the supposed sender on a number you already have. For workplace purchases, confirm the request through the normal approval process. Do not accept secrecy or urgency as a substitute.
Apply the same independent check to a supposed relative or officer. The Department of Telecommunications identifies impersonation of relatives and government officials seeking money among suspected fraud communications. Refuse gift-card-code payment demands until you have verified the underlying request through a separate channel.
What RBI gift-PPI rules actually cover
For regulated gift prepaid payment instruments, RBI's PPI directions, paragraph 10.1, set a maximum value of ₹10,000 per instrument and prohibit reloading. Cash-out and fund transfers are prohibited, except transfer back to the funding account with the holder's consent. Gift PPIs must be revalidated when the holder requests it.
Do not apply those provisions automatically to every discount coupon. The same directions distinguish closed-system instruments, usable only for the issuing entity's goods or services, whose issuance does not require RBI payment-system authorisation.
Before buying, identify the issuer and ask which rules and terms apply. Check participating merchants, validity, exclusions, partial-use arrangements and the complaint contact. Save the receipt. Do not assume that a retailer's logo identifies the issuer, or that a voucher described as a gift can be converted into cash.
Fake e-commerce gift-voucher websites
The RBI Ombudsman's BE(A)WARE booklet describes phishing websites that imitate genuine e-commerce services and capture credentials. A familiar-looking checkout therefore needs an independent address check.
Start from the retailer's established app or an address you already trust. Find its gift-card section and any named authorised sellers there. Compare the complete domain with the destination of the advertised offer. Avoid entering credentials into a page reached only through an unsolicited voucher message.
CERT-In's shopping guidance recommends verifying the brand and website before paying. Our practical buying rule is to walk away when you cannot establish who will issue the voucher and handle a complaint. A discount is not a reason to skip those checks.
Cashback does not need a UPI payment approval
The RBI Ombudsman's BE(A)WARE booklet says you never need to enter a PIN or password, or scan a QR code, to receive money. If an app asks for your PIN, you are sending money. You do not need to enter your UPI PIN to receive cashback.
Approving a UPI collect request with your PIN pays the requester. If a screen asks you to approve a debit while a caller calls it cashback, reject it. Read the amount, recipient and action in your payment app before proceeding.
For example, “approve this request to release your festive reward” should make you stop. Check your account independently for an actual credit. Do not continue because someone promises an immediate reversal. Never read your PIN aloud or type it into a reward website.
Our UPI scam prevention guide covers related payment traps. For genuine purchase promotions, use our bank and card offers guide to check the offer conditions before spending.
Fake cashback apps and reward-expiry SMS
Avoid installing a “cashback update” or “reward redemption” APK from a message. CERT-In explains that malicious mobile apps can steal data and login credentials, and advises using trusted download sources rather than message attachments.
An illustrative SMS might say: “Your reward points expire tonight; install this app to redeem.” Open your existing banking app independently and check its rewards section. CERT-In recommends official app stores and only necessary app permissions. Do not grant screen access or install extra software at a stranger's direction.
Handle a KYC-expiry message the same way: contact the bank or wallet provider independently. CERT-In warns against disclosing personal information to callers promising gifts or claiming to update KYC. Verify any genuine requirement through the provider's established process.
If you clicked, shared a code or lost money
Stop interacting with the sender. Save the message, sender details, website address, receipts and transaction references. Note what you shared and when. Keep this evidence private for the provider and authorities; do not publish usable gift codes or banking details in a social-media complaint.
If you disclosed credentials or authorised a suspicious payment, contact your bank immediately through its established app or official number. Ask it to secure the affected service. CERT-In advises changing compromised account passwords and blocking cards or freezing accounts where needed. Use another trusted device if the phone has suspect software.
If you shared gift codes, contact the gift-card issuer straight away through its official help page. Ask whether the unused balance can be blocked, keep the complaint reference and do not assume the money can be recovered.
For financial fraud, call 1930 promptly and report at cybercrime.gov.in. The DoT announcement directs victims there, while identifying Sanchar Saathi's Chakshu as the route for suspected fraudulent calls, SMS and WhatsApp communications. Do not substitute a suspicious-message report for reporting money already lost.
Quick checklist
- I verified the offer through the company, employer or department independently.
- I checked the voucher issuer, usable balance, restrictions and validity.
- I refused requests to buy gift cards and send codes without independent confirmation.
- I will not approve a UPI debit to receive cashback.
- I avoided reward APKs, unfamiliar login pages and unnecessary permissions.
- I checked KYC and reward-expiry messages inside the provider's established service.
- I saved evidence and know to contact the bank, 1930 and cybercrime.gov.in after financial fraud.
Sources
Official sources checked on 22 October 2026.
