The festive season is also peak season for online fraud. Cybersecurity firm Kaspersky has shared findings from the festive shopping period that show how scammers target buyers with fake websites, fake delivery messages and discount traps, and has listed practical steps shoppers can take to stay safe.
Between January and October 2025, Kaspersky blocked more than 6.4 million phishing attempts impersonating online stores, banks and payment systems, and about half of them directly targeted online shoppers. The message is simple: the busier the shopping season, the more carefully scammers dress up their traps.
Fake websites that copy real brands
The most common trap is a fake website that closely copies a real brand or store. Recent examples include fake sites selling a so-called iPhone Duo with 25 percent discounts, countdown timers and WhatsApp chat offers to create urgency. Other fake sites, in the names of big companies and stores, offer pre-sale discounts and at first ask only for a name, address and contact details, promising a manager callback. The real fraud begins later, when the same details are used for bigger financial scams. In 2025, fake sites selling goods in the name of the Mahakumbh took money from buyers and never delivered anything.
Fake delivery messages
Another common trick is a message claiming a parcel could not be delivered, or asking for a small re-delivery fee. The message pushes users to a link where they are asked to share card details, passwords or one-time passwords. Kaspersky warns that receiving money never requires entering a UPI PIN, and that any request for an OTP or password in a delivery message is a red flag.
How to stay safe while shopping online
The safest habit is to shop only on official apps and trusted websites and to check the web address carefully before paying. Treat unrealistic discounts and countdown timers as warning signs, not bargains, and never click links in suspicious messages. Check order and delivery status only in the retailer or courier's official app, never through a link in a message. Never pay a re-delivery fee and never share an OTP or password with anyone. Using virtual cards for online shopping and checking bank statements regularly can also limit the damage if details do leak.
