Tricks
Festive Sale Scam Safety: Your 15-Minute Setup Before Oct 8
Festive sale scam safety is not a boring lecture this week, it is the one deal that actually saves you money. Amazon Great Indian Festival opens for everyone on October 8, Flipkart Big Billion Days early access also starts October 8, and the full BBD sale opens to all on October 9. Your phone is about to get flooded with “90% off” forwards, fake delivery calls and mystery refund links. So instead of tips you will forget by Wednesday, here is a 15-minute setup you do once, tonight, before the carts go live.
If you still need the sale calendars and bank offer basics, our Amazon Great Indian Festival 2026 dates guide and Flipkart Big Billion Days 2026 dates explainer have you covered. This one is about keeping the savings.
Table of Contents
Why a setup beats a tips list
The CyberIntro take: festive scams are a speed game. The scammer wins when you decide in the moment, with a timer ticking and a fake agent rushing you. You win when the decision is already made. So the plan below is not “be careful”. It is three short blocks where you change real settings on your cards, phone and family group, so even a sleepy 12:01 AM version of you is protected. Chalo, timer on.
Minute 0 to 5: Build a sale wallet
Your biggest leak is the card you pay with. Since 2020, RBI rules have required card issuers to give you a switch to turn online, international and contactless usage on or off, and to set your own limits for each, any time of day, through the mobile app, net banking, ATM or phone banking (IVR).
Pick one card for the sale
- Choose the one card that carries the bank offer you plan to use. One card, one statement to watch.
- On every other card, switch off online transactions until the sale is over. A card that cannot pay online cannot be drained by a fake checkout page.
- Switch off international usage unless you genuinely shop on foreign sites.
Set a cart-sized limit
On your sale card, set the online limit to roughly your planned cart value plus a small buffer. Buying a Rs 25,000 phone? Do not leave a Rs 2 lakh online limit sitting there. If a fraudster gets in, damage stops at your ceiling. You can raise it in seconds when you are ready to pay.
Clean up old mandates
Check your UPI app for forgotten autopay mandates too. Our Google Pay autopay cancellation guide walks through it.
Minute 5 to 10: Harden your phone
A lot of festive fraud starts on WhatsApp, SMS or a phone call, not inside the shopping app. So lock the front gate.
- Silence unknown callers on WhatsApp: go to Settings, then Privacy, then Calls, and turn on Silence unknown callers. Unknown numbers will not ring, but still show up in your call list.
- Bookmark the real apps: keep only the official Amazon and Flipkart apps from the Play Store or App Store on your home screen. If a deal is real, it exists inside the app.
- No APKs, no screen-sharing: the Home Ministry’s I4C cyber wing has specifically warned shoppers against installing remote access apps like AnyDesk or TeamViewer because a stranger asked. No genuine refund or delivery fix needs one.
Minute 10 to 15: The family drill
You can be the most paranoid person in the house and still lose money through the family WhatsApp group. Spend the last five minutes on parents and younger siblings.
- Teach one golden rule: receiving money never needs a UPI PIN or OTP. CERT-In’s scam advisory says so too. A PIN to “receive” a refund is a payment. Full stop.
- Agree on a family code word: if a caller claims to be a relative in trouble and needing money urgently, they must say the code word. No code word, no transfer.
- Set the “app first” habit: any offer in the group gets checked inside the official app. If the price is not there, the offer is not real.
- Record the unboxing: I4C also advises recording a video while opening high-value deliveries. It is free evidence if a box arrives empty.
For a real-world example to forward to parents, see our breakdown of the fake IPPB account block message scam.
The five scam scripts you will actually see this week
Learn these scripts and they lose their power.
| The script | What it sounds like | Your move |
|---|---|---|
| Too-good ad | Instagram or YouTube ad shouting “90% off”, “stock clearance” or “government auction” on a premium phone | Ignore the ad, search the product in the official app |
| Lucky gift link | “You won a festive gift, claim in 10 minutes” | Never click; delete and report the sender |
| Delivery trouble call | “Your parcel is on hold, share the OTP to reschedule” | Check the order status inside the app yourself |
| Refund via QR | “Scan this QR and enter PIN to get your refund” | Hang up; refunds never need your PIN |
| Fake customer care | “Install this app so I can fix your payment” | Use only the help section inside the official app |
If it goes wrong: your golden-hour script
Even smart people slip at midnight. What matters is how fast you move after. Save this in your notes app.
- Freeze first: open your banking app and switch off the card or block it. The controls you just set up make this a seconds job.
- Report to the cyber police: call the National Cyber Crime Helpline 1930 or file at cybercrime.gov.in.
- Tell your bank in writing: raise a complaint through the app or email and keep the reference number. How much you can recover depends heavily on how fast you report.
- Got a scam message but lost nothing? Report it on Chakshu, inside the government’s Sanchar Saathi portal. It handles suspicious calls, SMS and WhatsApp messages, and wants reports within 30 days.
- Genuine seller problem, not fraud? Wrong item or a refund stuck with a real seller goes to the National Consumer Helpline: dial 1915 (8 AM to 8 PM, except national holidays) or WhatsApp 8800001915.
The rulebook: this Diwali vs January 2027
The bit most sale guides skip: RBI has finalised a stronger fraud protection framework, but it only kicks in on January 1, 2027. This festive season, the older rules still apply:
- Right now: if the fraud came from a breach that was neither your fault nor the bank’s, reporting within 3 working days of the bank’s alert gets you zero liability. Report within 4 to 7 working days and your liability is capped. If you shared your OTP or PIN yourself, you carry the loss until the moment you report it.
- From January 1, 2027: the zero liability window for third-party breaches becomes 5 calendar days, frauds where you were pressured into approving a payment are explicitly covered, banks must settle domestic fraud complaints within 45 days, and even people tricked into sharing details can get a once-in-a-lifetime compensation of 85 percent of the net loss (capped at Rs 25,000) on losses up to Rs 50,000, if they report to the bank and to 1930 or the cybercrime portal within 5 calendar days.
Our take: do not plan your Diwali around a rule that is not live yet. Treat 24 hours as your personal reporting deadline. Speed is the real insurance policy.
Final Thought
The best festive deal is the one where the only money leaving your account is the money you meant to spend. Fifteen minutes tonight buys a capped sale card, a quieter phone, a family that knows the PIN rule, and an emergency script. That is pure paisa vasool. Do the setup, share this with the family group before the forwards start, then hunt those October 8 and 9 deals with a clear head.
