Before booking your festive journey, separate three checks: who is taking your money, whether the reservation exists, and what happens if the trip is cancelled. Apply these checks to every train, bus, flight and room. The practical routines below are our recommendations; official requirements and reporting channels are linked beside the relevant explanation.
Start with the booking channel
India's cybercrime coordination centre, I4C, has warned about travel-booking fraud through convincing websites, social-media accounts and paid search advertisements, including hotel bookings and holiday packages. Its official booking-scam advisory recommends checking authenticity before payment and cross-checking bookings through official portals or trusted agencies.
For each purchase, write down the operator or property's name, website address, travel dates, cancellation terms and final payable amount. Open the booking service independently before entering payment details. Treat a forwarded link, an attractive advertisement or an urgent WhatsApp quotation as a starting point for checking. If the seller will not give you time to verify the booking, leave it.
Railway tickets: check the app and the agent
For direct railway booking, use IRCTC's own website, www.irctc.co.in, or IRCTC Rail Connect. IRCTC provides an official Android download link to its app-store listing. Avoid installing a supposed railway app from a chat attachment. CERT-In's security booklet advises downloading apps from legitimate websites or authorised stores and avoiding downloads supplied through messages.
Using an agent requires another check. Under IRCTC's published agent policy, the outlet must prominently display its authorisation certificate. Agents must issue an invoice showing the fare and charges; the reservation slip must identify the issuing agent and principal service provider. Ask to see these details before paying.
Compare the certificate, outlet address, invoice and reservation slip. Investigate mismatched names rather than accepting a logo as sufficient evidence. Ask the agent to explain the total charge and refund process in writing. Keep the invoice alongside your ticket, and save the contact details you independently verified.
Do not buy a promise of Tatkal confirmation
The Railway Ministry's Tatkal rules prohibit authorised agents from booking opening-day Tatkal tickets during the first 30 minutes: 10:00–10:30 am for AC classes and 11:00–11:30 am for non-AC classes. The rules also require Aadhaar-authenticated users for online Tatkal booking, with Aadhaar-based OTP authentication. Do not accept a salesperson's claim of special permission to bypass these restrictions.
After booking, enter the PNR yourself in Indian Railways' passenger-status enquiry. Compare the train, date, boarding point, class and current status with your ticket. The enquiry distinguishes confirmed, RAC and waiting-list status, and warns that predictions can differ from actual confirmation. Treat a screenshot or a promised probability as insufficient evidence.
If someone requests another payment to “release” a confirmed berth, pause and verify through IRCTC. Keep an alternative journey plan instead of repeatedly paying to rescue the original promise.
Bus and flight websites: verify the reservation
For a bus or flight, start from an operator or booking platform you have independently identified. Check the full website address before signing in. After payment, reopen your account and inspect the booking there. For flights, check the airline's reservation record; for buses, ask the operator to confirm the service, boarding point, date and passenger details using independently obtained contact information.
Be especially careful when searching for help after a failed payment. CERT-In warns that service-provider numbers found through search engines can be fake and recommends numbers on authorised websites. Use the operator's own contact page or the help section inside your existing booking account.
Before calling, note your booking reference and the precise problem. Ask for a complaint reference and a written response. If the caller immediately moves the conversation to a personal payment request, end the call and contact the service again through the channel you verified.
Hotels and homestays: confirm the exact property
Apply the same booking-scam precautions to a hotel, guest house or homestay. Before an advance payment, establish the full address, room type, occupancy, check-in date, total amount and cancellation conditions. Ask who will issue the receipt. Compare the listing with independently found property information and investigate conflicting addresses or names.
Call the property using a number established separately from the payment message. Ask staff to confirm both the reservation and the proposed payment recipient. For a homestay, ask for written arrival instructions and the host's contact details. Consider asking for a live video walkthrough if the listing leaves important questions unanswered, but continue checking the identity and payment terms.
Keep platform bookings and payment discussions inside the platform wherever possible. If someone asks you to cancel there and pay elsewhere for a better deal, stop and reassess. Save the listing, room description, cancellation deadline and payment confirmation together. Reconfirm your arrival before leaving home.
Cancelled flights: know which refund rule applies
DGCA's passenger-facilitation CAR, Section 3, Series M, Part IV addresses airline cancellations. For cancellation notified at least two weeks beforehand, or between two weeks and 24 hours beforehand, it provides for an alternative flight or refund acceptable to the passenger. Additional compensation depends on the circumstances and exceptions; it is not automatic for every cancellation.
Refund processing is covered separately by CAR, Section 3, Series M, Part II, dated 24 February 2026. It specifies seven days for airline refunds to credit-card accounts, immediate refunds for cash purchases at the airline office, and completion within 14 working days for tickets bought through agents or portals. For agent bookings, the refund responsibility rests with the airline.
Save the airline's cancellation notice and ask for the refund amount, method and reference in writing. State clearly whether the airline cancelled the flight or you requested cancellation. Keep the airline and booking platform informed when both are involved. Ask them to explain any deduction against the applicable rule and your booking terms.
Refund requests: read what you are authorising
Do not enter a UPI PIN to receive a refund. The RBI Ombudsman's BE(A)WARE booklet, hosted on a government website, explains that approving a UPI money request with your PIN sends money. Reject instructions to scan a payment QR code and enter your PIN to collect a refund. Read our UPI scam prevention guide for related checks.
Keep banking OTPs, card security details and passwords private, and refuse remote-access installation requests from callers. However, IRCTC's agent policy includes a cancellation-refund verification OTP. If you initiated an agent cancellation, read the SMS purpose and verify the request with your original authorised agent. Never substitute a banking OTP or UPI PIN.
For an unexpected refund call, hang up and reopen the original booking. Check the cancellation and refund status there. Do not make a fresh transfer described as an account-verification payment or refundable deposit without independently resolving the request through the booking service.
Report suspicious messages and money loss correctly
Use Sanchar Saathi's Chakshu to report suspected fraudulent calls, SMS or WhatsApp communications. The portal explicitly says Chakshu is not the reporting facility for financial-fraud or cybercrime cases. If you have lost money, call 1930 promptly and report through cybercrime.gov.in.
Also contact your bank or payment provider immediately through its verified channel. Ask about securing the affected account or card and reporting the transaction. CERT-In recommends notifying banks or wallets and law enforcement after identity theft. Save transaction references, recipient details, messages, website addresses and booking documents. Keep complaint acknowledgements, and avoid posting sensitive evidence publicly.
Quick checklist
- I independently checked the website, app, agent or property before paying.
- I have written booking details, cancellation terms and an itemised receipt.
- I checked the reservation with the railway, airline, bus operator or property.
- I obtained customer-care details from the service's own verified channel.
- I will not authorise a payment to receive a refund.
- I know to use Chakshu for suspicious communications and 1930 plus cybercrime.gov.in after money loss.
Sources
Official sources checked on 21 October 2026. Practical booking routines are editorial recommendations.
- I4C: travel-booking scam advisory.
- IRCTC: Android app link and agent policy.
- Indian Railways: Tatkal rules and PNR enquiry.
- DGCA: passenger facilitation CAR, Part IV and ticket refunds CAR, Part II.
- CERT-In: cybersecurity booklet and identity-theft precautions.
- RBI Ombudsman: BE(A)WARE, government-hosted copy.
- Reporting: Sanchar Saathi and Chakshu; National Cyber Crime Reporting Portal.
