From fake deals to deepfakes: How cybercriminals are exploiting festive shoppers

The surge in online shopping during the festive season has widened the scope of financial fraud in India, with cybercriminals increasingly exploiting consumers through fake shopping websites, cloned applications, AI-generated advertisements and fraudulent payment requests. As digital transactions rise, scams are also becoming more sophisticated, shifting from conventional phishing attempts to impersonation, identity theft and payment redirection.

Ankit Gupta, CTO of Policybazaar for Business, told Fortune India that fraudsters are increasingly capitalising on the urgency surrounding festive discounts, cashback offers and limited-period deals to trick consumers into sharing sensitive financial information or authorising fraudulent transactions.

"Festive sales have significantly increased online transactions, but they have also created more opportunities for cybercriminals to target consumers," Gupta said, adding that cyber fraud is no longer merely a technology issue but also a consumer protection and financial risk concern. He said consumers must consider cybersecurity an important part of their financial planning. Alongside preventive measures, retail cyber insurance can provide an additional layer of financial protection against specified cyber risks, subject to policy terms and conditions.

AI, fake websites and impersonation make scams harder to detect

Fraudsters are increasingly using fake shopping websites, cloned applications and misleading social media advertisements to lure consumers with unrealistic discounts. Fake customer-care numbers impersonating banks, retailers and payment companies are another growing concern.

Cashback and refund scams are also common, with fraudsters asking consumers to click suspicious links, scan QR codes or share one-time passwords (OTPs) to claim rewards or receive refunds.

According to Gupta, the modus operandi of cybercriminals has evolved with the availability of artificial intelligence (AI) tools, which help create realistic advertisements, fake product listings and convincing brand communications.

Deepfake videos and cloned voices are also being used to impersonate celebrities, business representatives and trusted individuals. WhatsApp has emerged as another channel for circulating fake shopping links, exclusive deals and fraudulent payment requests.

"The biggest shift is that fraudsters are no longer just targeting technology vulnerabilities; they are targeting consumer trust, impacting entire families, and are not restricted to main family members but extend to older adults and kids too," he said.

Consumers shopping through unfamiliar e-commerce platforms, social media sellers and third-party links offering steep discounts are particularly vulnerable when the seller's identity cannot be verified.

Gupta identified unusually high discounts, suspicious domain names, spelling errors, unverified business addresses, missing return policies, and sellers insisting on payments to personal UPI IDs or bank accounts as key red flags. Consumers should also avoid downloading applications through unofficial links or making payments under pressure to secure limited-period offers.

UPI convenience brings new vulnerabilities

With UPI becoming a preferred mode of digital payment, fraudsters are increasingly exploiting the convenience of instant transactions through social engineering. Fake cashback requests, fraudulent collect requests, QR codes disguised as money-receiving options and payment links circulated through WhatsApp are among the common methods.

Gupta advised consumers never to share their UPI PIN or OTP with anyone. Entering a UPI PIN authorises a payment and is not required to receive money. Consumers should also verify the beneficiary's name and transaction amount before approving payments and use only official banking and payment applications.

The level of consumer protection also varies across payment instruments. Credit cards generally offer better dispute-resolution mechanisms through issuing banks and card-network chargebacks. Debit card protection is governed by applicable RBI customer liability guidelines, while recovering money from UPI transactions voluntarily authorised under deception can be challenging. Buy-now-pay-later (BNPL) protection depends on the provider's terms and dispute-resolution framework.

"Consumers should also understand that authentication does not necessarily mean a transaction is free from fraud. Even an authorised payment can result from manipulation or impersonation," Gupta said.

He added that retail cyber insurance could offer an additional financial safety net against covered incidents.

Quick reporting critical to recovering lost money

The first few minutes after discovering a fraudulent transaction are critical, as the money can move through multiple bank accounts quickly.

Gupta advised victims to immediately call the national cybercrime helpline at 1930, register a complaint on the government's cybercrime portal, cybercrime.gov.in, and inform their bank to secure the account and initiate necessary action.

Consumers should block compromised cards, UPI or banking facilities, wherever necessary, and preserve transaction IDs, screenshots, messages, phone numbers and other evidence. Early reporting can improve the chances of tracing and freezing the funds, although recovery is not guaranteed.

Consumers with cyber insurance should also check whether the incident is covered and notify their insurer within the stipulated timelines.

While banks and payment companies have introduced safeguards such as two-factor authentication, device verification, transaction alerts, risk-based monitoring and transaction limits, Gupta said a significant challenge remains: consumers are often manipulated into authorising transactions themselves. He called for a shift towards behaviour-based fraud detection, supported by AI-driven monitoring and real-time identification of suspicious transactions.

Greater coordination needed across digital payment ecosystem

Gupta identified stronger coordination among banks, payment gateways, telecom operators and e-commerce platforms as a key requirement for improving India's digital fraud-prevention framework. Faster information-sharing could help identify suspicious transactions, fraudulent accounts and organised scam networks.

He also called for clearer accountability and grievance-redressal mechanisms so that consumers do not have to approach multiple institutions when reporting fraud. Greater clarity is needed on institutional responsibilities and compensation in cases where failures contribute to financial losses.

Consumers, meanwhile, should avoid making banking transactions over public Wi-Fi, refrain from saving card details on unfamiliar shopping platforms, use strong and unique passwords, enable multi-factor authentication and regularly monitor bank and card statements. "Cybersecurity is a shared responsibility," Gupta said, adding that individual cyber insurance could strengthen consumer financial protection as more people shop, bank and transact online. Such policies can cover specified risks, including online financial fraud, phishing, identity theft and unauthorised digital transactions, depending on the policy's terms and conditions.