The Ministry of Home Affairs cybercrime coordination cell shared an updated blocklist of look-alike shopping domains with major payment aggregators on Friday, asking processors to flag or reject transactions tied to known phishing kits ahead of Diwali online sales that begin this week.
The move targets a seasonal pattern: fraudsters register domains that mimic large marketplaces and send SMS blasts offering unrealistic discounts on phones and appliances. Victims enter card or UPI details on fake checkout pages, and money is swept through mule accounts before complaints reach police.
How aggregators will use the list
Three payment firms with national licences told InfoHandle they received the domain feed through the Indian Cyber Crime Coordination Centre channel. Rules vary by company, but most plan to increase risk scores for merchants whose checkout pages redirect through newly registered hosts matching the blocklist.
Unlike a public takedown order, the list is aimed at choke points in the payments chain—aggregators, acquirer banks and wallet providers—so that fraudulent merchants never reach settlement. Consumers may still see ads on social media unless telecom scrubbing catches the URLs earlier.
What shoppers should verify
Cybercrime.gov.in continues to host the national helpline 1930 for reporting financial fraud. Officials urge buyers to type retailer URLs manually rather than clicking shortened links, and to refuse UPI collect requests from unknown handles claiming “cashback verification.”
Banks have separately tightened SMS sender-ID rules for outbound collections, but scamsters rotate through international SMS gateways within hours. Payment aggregators said machine-learning models trained on last year’s Diwali fraud graph improved detection rates but are not foolproof.
State police parallel efforts
Gujarat and Maharashtra cyber cells ran weekend awareness campaigns on regional language radio, highlighting that legitimate marketplaces never ask for UPI PINs to “release” refunds. Telangana police arrested a small ring selling cloned checkout templates on Telegram earlier in October, according to a press note.
The MHA list will refresh daily through November, officials said. Aggregators that fail to act on flagged domains could face scrutiny from the Reserve Bank’s payment systems department, though no public penalty framework exists yet.
For households planning big-ticket purchases on Monday sales, the practical advice is unchanged: if the discount requires installing an unknown APK or sharing an OTP, stop—the blocklist only helps if the payment rail refuses to settle the scam in the first place.
RBI payment oversight
Reserve Bank officials reminded non-bank payment companies in a September circular that they must file incident reports within six hours of detecting large-scale phishing spikes. The Diwali blocklist is an attempt to front-run that clock by sharing indicators before losses hit bank balance sheets.
Consumer groups welcomed the move but asked for a public searchable version so technologists can plug the domains into browser blocklists at home. The MHA has resisted open publication, citing fears that fraudsters will simply rotate domains faster once a list goes viral.
For now, the practical defence remains scepticism: legitimate retailers never ask customers to install remote-access apps to “verify” cashback, and any Diwali deal that expires in ten minutes is probably designed to panic you past that check.