Diwali Scam Messages: A Teacher's Checklist for the Festive Weeks
In the two weeks before Diwali my phone, and probably yours, fills up with messages that all want one thing: a tap. "Your electricity will be cut tonight, update KYC." "Congratulations, you have won a festive gift hamper." "Your Diwali bonus has been credited, confirm your account." Some of these are from real companies. Most are not, and the fake ones are better written every year.
I teach this lesson to my students every October, so this is the written version. We will look at the seven message types that peak in festive season, the single test that separates a real message from a fake one, what to do in the first ten minutes if you have already tapped, and how to protect the older people in your family, who receive the same messages with less practice at reading them.
Why the festive weeks are different
Three things change in October and November. People are expecting money to move: bonuses, gifts, refunds for returned sale purchases. People are shopping with sellers they have never met. And people are busy, which means they read messages while doing something else. Scammers know all three and write their messages to fit the moment: a bonus message when bonuses are due, a delivery message when parcels are arriving, a KYC message when banks genuinely do send reminders.
The messages are not cleverer than usual. The timing is.
The seven festive message types
Message type | What it says | What it actually wants | The giveaway |
|---|---|---|---|
Electricity disconnection | "Bill not updated, power cut tonight, call this number" | A call to a "lineman" who asks you to install an app | Power companies do not disconnect by SMS at night |
KYC update | "Your account will be blocked, complete KYC via link" | Your net banking login on a fake page | Banks never send KYC links; they ask you to visit a branch or use their own app |
Festive gift or lottery | "You have won a hamper or cashback, claim here" | A small "processing fee" by UPI | You cannot win a draw you did not enter |
Bonus credited | "Your Diwali bonus of ₹X is pending, confirm account details" | Account number and OTP | Your employer pays into the account it already has |
Parcel on hold | "Customs duty or address fee pending for your order" | A card payment on a copied courier page | Real couriers collect duty at the door, not by link |
Discount coupon or sale app | "Flat 70 percent off, download our festive app" | An APK file that reads your SMS and OTPs | Real apps are on the Play Store, not sent as files |
Charity or temple donation | "Donate for Diwali, scan this QR" | A UPI payment to an individual | Registered charities have names, not personal UPI handles |
Keep this table on your phone. Most festive scams fall into one of the seven rows, and a message that fits a row is a message to delete.
The one test that works on all of them
Every one of the seven asks you to act through the message itself: tap the link, call the number, scan the QR, install the file. That is the whole trick. A genuine organisation can always be reached through a route you already have, such as the app you installed from the store, the number printed on your card, or the website you type yourself.
So the test is simple. Close the message. Open the official app or type the website yourself. If the electricity bill is really pending, the app will show it. If your bank really needs KYC, the app will show a notice. If the parcel really has a fee, the courier's tracking page will show it. In my experience of helping students and their parents through this, the "real" problem exists in the official app roughly one time in fifty.
Reading the sender, not the message
The text of a scam message is designed to be convincing, so do not judge it on text. Judge it on the sender.
What to look at | Genuine | Fake |
|---|---|---|
Sender ID | A fixed six-character header such as VM-HDFCBK, consistent across months | A ten-digit mobile number, or a header that changes |
Link domain | The company's own domain, nothing before it | A shortener, or the company name as a subdomain of something else (hdfc.secure-update.in) |
Language | Formal, no urgency, no reward | "Tonight", "immediately", "last chance", "congratulations" |
What it asks | To open the official app or visit a branch | To tap, call, scan, install or pay |
Reply behaviour | Does not reply to your questions | Replies within seconds, pushes you to act |
The sender ID row is the most reliable. Save your bank's and your electricity provider's genuine sender headers in a note; anything else claiming to be them is not them.
If you have already tapped
Tapping a link is usually not the loss; what you did on the page is. If you only opened the page and closed it, change nothing except your alertness. If you entered a login, change that password now from the official app and turn on two-factor authentication. If you entered card details, call the bank's number from the back of the card and block the card. If you installed a file, switch the phone to flight mode, uninstall the app, and change your banking passwords from a different device.
If money has left, report within the hour. Call 1930 or file at cybercrime.gov.in with the transaction ID, and tell your bank at the same time so the receiving account can be frozen if the money is still there. The steps in the first hour are laid out in what to do right after a money scam; the festive version is the same list on a tighter clock.
Protecting the elders in the house
Most of the festive-scam losses I hear about are not the students'. They are a parent's or a grandparent's, and the money is often a pension or a fixed deposit that was broken under pressure. Three habits help. Agree a family rule that no payment above a small amount is made from a message without a second person looking at it. Put the genuine sender IDs and the bank's real phone number on a card by the landline. And rehearse the test above out loud once: "Close the message, open the app." People do under stress what they have practised, and the scam depends on nobody having practised.
What the sellers you do not know have in common
Festive shopping brings a second, quieter risk: the small Instagram or WhatsApp shop with a wonderful discount that asks for full payment by UPI before dispatch. This is not a message scam in the sense above, but it ends the same way. Pay unknown sellers through a platform that holds the money until delivery, or pay a token first and the balance on receipt. A seller who refuses both has told you what you need to know.
A ten-minute Diwali clean-up
Before the festive messages start in earnest, spend ten minutes on the five items below. None of them needs a visit to a branch.
Minute | Task | Why it matters in festive season |
|---|---|---|
1–2 | Save the genuine sender IDs for your bank, card and electricity provider in a note | Lets you dismiss any other "bank" header on sight |
3–4 | Turn on transaction alerts and two-factor authentication where they are off | A stolen password alone then achieves nothing |
5–6 | Lower your UPI daily limit to what you actually spend in a day | Caps the damage of one bad tap; raise it for a specific purchase |
7–8 | Tell one family member you will never ask them to pay a fee to receive a gift | A message in your name then fails on them too |
9–10 | Block and report the last three suspicious messages in your inbox | Trains you to do it without thinking when the next one lands |
The broader catalogue of scams that run all year is in common money scams in India, and most festive variants are seasonal costumes on those same ten.
A note on the real messages
Some festive messages are genuine. Your bank will remind you about KYC. Your courier will say a parcel is out for delivery. The test does not ask you to ignore them; it asks you to respond through the official route instead of the message. A genuine sender loses nothing when you do that. Only a fake one does.
Frequently asked questions
The message came from a number saved in my contacts. Can it still be fake? Yes. Sender IDs and even known numbers can be spoofed, and a friend's phone may be compromised. Apply the same test regardless of who it appears to be from.
I replied to the message. Is that a problem? Replying confirms the number is active, so expect more messages. Block the sender. If you shared nothing else, there is no financial exposure.
Are QR codes safe to scan for donations? Only when you can see the name of the registered organisation at payment time. A personal name on a charity QR is the sign to stop.
My bank really did send a KYC reminder. How do I know? Open the bank's own app. A genuine KYC requirement will be shown there as a notice, with instructions that do not involve a link from a message.
Is it worth reporting a message if I lost nothing? Yes. Forward it to 1930's reporting channel or your bank's fraud desk. Reports from people who lost nothing are how the numbers behind these messages get blocked for everyone else.