The National Cybercrime Threat Analytics Unit, operating under the Home Ministry's Indian Cyber Crime Coordination Centre, told citizens on 19 October to treat social-media advertisements promising government cash transfers as fraudulent when they show manipulated videos of the Prime Minister, the Finance Minister or state chief ministers.
The advisory describes a full funnel: a sponsored post on Facebook or Instagram, a clip that mimics a policy announcement, then a link or WhatsApp chat demanding registration, processing or tax payments before benefits arrive. Victims who approve UPI collect requests or enter PINs thinking they are confirming a deposit instead authorise debits from their own accounts.
How the scam is packaged
Fraudsters mix political deepfakes with graphics that resemble official welfare portals. Some ads carry political-advertising labels even though the schemes they promote do not exist on any government domain. Others use scratch-card or spin-and-win interfaces that always "award" a prize requiring an upfront fee.
The unit said several complainants received calls or messages from international numbers, including Pakistan's +92 country code, congratulating them on selection for a benefit. That callback step is designed to build trust after the social ad creates urgency.
Why UPI is the exit rail
India's instant payment system makes it easy for criminals to sweep funds through mule accounts within minutes. The advisory repeats a basic rule many victims forget in the moment: a UPI PIN confirms money leaving your account, not money arriving. Any collect request from an unknown virtual payment address should be declined and reported.
State Bank of India and other lenders have issued parallel warnings about "jumped deposit" variants, where a small credit appears followed by a demand to refund a larger amount. The Home Ministry note ties those patterns to the same festival-season marketing push that legitimate banks run for contactless cards.
Verification steps that work
Official schemes are listed only on ministry and department websites ending in gov.in or nic.in. The I4C says to ignore WhatsApp forwards that lack a verifiable portal link, and to never share Aadhaar, PAN or OTPs with callers who claim to represent a state secretariat.
Victims should call 1930 immediately and file a complaint on cybercrime.gov.in, then alert their bank to freeze further debits. Quick reporting improves the chance that beneficiary banks can flag mule accounts before balances are withdrawn as cash.
Platform and police response
The advisory implicitly pressures Meta to tighten ad review for political imagery, though it does not name enforcement actions. State cybercrime cells in Gujarat and elsewhere have separately filed cases against phishing kits sold on Telegram, suggesting the welfare-ad scam sits inside a wider marketplace of templates.
For households waiting on real central schemes, the safest habit is to bookmark official portals rather than click through promoted posts. If a video looks too polished to be a hurried ministry briefing, assume manipulation until the same announcement appears on Press Information Bureau channels.