Hyderabad Police Commissioner V.C. Sajjanar on Saturday warned Telangana residents against WhatsApp and social media messages claiming a leading digital payments platform is gifting Rs 1,000 in Diwali cash, the latest variant in a nationwide surge of festive phishing ahead of Deepavali.
How the lure works
Messages circulate with screenshots purporting to show friends receiving money, nudging recipients to tap shortened links. Cybercrime units say the pages mimic official branding, harvest login credentials or persuade users to install lightweight APK files disguised as greeting cards. Once installed, malware can read SMS one-time passwords or initiate unauthorised UPI pulls.
Sajjanar's advisory mirrors parallel warnings from Delhi Police's Intelligence Fusion and Strategic Operations unit, which flagged fake central-government gift promises of Rs 8,000 and cloned e-commerce sites offering implausible discounts on phones and gold bonds. Maharashtra Cyber has likewise cautioned against "account blocked" follow-up pages designed to panic victims into sharing PINs.
Why festivals amplify fraud
Transaction volumes on Unified Payments Interface crossed one billion in a day for the first time on Dhanteras, meaning more households than ever are comfortable tapping QR codes. That familiarity lowers psychological friction when a fraudulent link arrives inside a family WhatsApp group forwarded by a trusted contact whose device was already compromised.
What police want users to do
Authorities repeat a short list: verify government schemes only on official portals, never share UPI PINs or OTPs with callers posing as couriers or bank staff, and refuse remote-access apps such as AnyDesk when "customer care" demands screen sharing. Victims should dial the national cyber helpline 1930 immediately and file complaints at cybercrime.gov.in so banks can attempt transaction freezes.
Platform response
Payment apps have issued in-app banners during Diwali week reminding users that they do not distribute cash gifts through forwarded links. Whether telcos will throttle known phishing domains in real time remains uneven; cyber cells want faster takedowns coordinated with NPCI when fake UPI collect requests appear.
For Hyderabad's technology corridor, where thousands of newcomers join digital wallets each quarter, Sajjanar's Saturday statement is as much about education as enforcement. The criminals are often offshore, but the entry point is still a local tap on a glowing offer that looks like festival generosity.
State coordination
Telangana's cybercrime wing linked the Hyderabad alert to broader Intelligence Fusion inputs shared with other metros. Officers said takedown requests for phishing domains spiked forty percent in the week before Deepavali compared with the October baseline, most tied to wallet impersonation rather than investment schemes.
Consumer affairs volunteers at Nampally and Kukatpally railway stations handed leaflets repeating Sajjanar's guidance in Telugu and Urdu, targeting migrants less familiar with official payment-app branding. Schools sent circulars urging students to warn parents about forwarded gift links.
Recovery pathways
Banks that received early 1930 reports on Dhanteras managed to freeze a portion of mule accounts before transfers hopped offshore, though success rates remain in the low double digits nationally. Cyber specialists urged victims to preserve message screenshots with visible timestamps to aid domain tracing.