Diwali Greeting Scam on WhatsApp: Signs and What to Do

A Diwali greeting scam usually looks like a harmless message: a “personalised card” link, or a file to install, often from someone you know. Don’t tap it, don’t install anything, and call the sender on a normal phone call to ask if they really sent it.

If you’ve already tapped, this is fixable when you move quickly. What you need to do depends on one question, and that’s in section 3.

⚡ Key takeaways

Real Diwali wishes don’t need you to install anything. A greeting that asks you to download a file or an APK is the red flag.
Telangana’s cyber security bureau warned on 30 October about a fake ₹8,000 Diwali message that uses the Prime Minister’s name.
A hacked friend’s account can send these, so a familiar name proves nothing.
If you installed something: go offline, remove the app, secure your bank and WhatsApp.
If you lost money: call your bank at once, then 1930 and cybercrime.gov.in.

Table of Contents

How the Diwali Greeting Scam Works

This playbook isn’t new. Police warned about it in detail during New Year 2026. India TV’s report on Hyderabad’s cyber crime unit lays out three steps:

The hook: an SMS or WhatsApp message offers a greeting card with your name or photo.
The trap: the link opens a page asking you to download an APK file, the format for Android apps.
The compromise: once installed, it can give attackers remote access to your phone.

Mumbai’s Government Railway Police described the same pattern in New Year warnings. Victims reported apps opening by themselves and strangers reading messages and contacts, along with unauthorised UPI or bank transactions.

We haven’t found a police advisory about an APK card for Diwali 2026 specifically. But the same trick ran at New Year, and greetings are about to fly around, so treat any card link with the same suspicion.

diwali greeting scam: clay diyas burning on a dark surface — Real wishes arrive as a photo or a message. They never need an install. · Photo: Hashtag Captured / Pexels

This Year’s Version: The ₹8,000 Diwali Message

There’s a live cousin of this scam right now. Telangana Today reported on 30 October that the Telangana Cyber Security Bureau warned about a WhatsApp message offering a ₹8,000 Diwali cash benefit in the Prime Minister’s name, with a link to claim it.

The bureau says clicking can lead you to sites that collect Aadhaar details and bank account numbers. It may also lead to unauthorised UPI transactions or malware. Its advice is simple: don’t believe it, don’t click, and don’t forward it.

⚠️ Watch out

Forwarding “just in case it’s true” is exactly how these messages spread, especially in family groups. If an aunt forwards it, tell the group it’s fake, then share the source. A genuine government scheme will be on an official website.

5 signs to check in 5 seconds

Sign	Why it’s suspicious
Asks you to install or download anything	Greetings don’t need an app
Link to “see your personalised card”	The personal touch is the bait
Free cash or gift for Diwali	GRP lists gifts and rewards as warning signs
Urgent wording or spelling mistakes	Pressure stops you from thinking
Asks for OTP, UPI PIN or bank details	GRP says genuine organisations never ask for these over messaging apps

Also readPhone Safety for Parents: 9 Settings to Fix on Your Diwali Visit

Tapped the Link? It Depends on What Happened Next

Here’s the question that decides how worried you should be: did you install something, or type in any details?

If you only opened the link and closed it

Close the tab and don’t download anything. Run the Play Protect check below, and watch for odd behaviour for a few days. In most cases, your next step is simply to delete the message.

If you entered details on the page

Treat those details as stolen. Change any password you typed, tell your bank straight away if you entered card or account details, and never approve an OTP you didn’t ask for.

If you installed the file

This is the serious one. India TV’s report says to turn off Wi-Fi and mobile data at once, and contact the sender by another route to check if their account was compromised. Then work through the steps in the next section.

💡 Pro tip

On an iPhone, an APK can’t install, since it’s an Android format. But the fake page can still ask for your bank details, so the same caution applies.

What to Do in the First 10 Minutes

Go in order. The first few steps matter most.

Go offline. Turn off Wi-Fi and mobile data, or use airplane mode.
Remove the app. Google says to tap the Play Protect notification, then Uninstall, if it flags something. Otherwise go to your app list and look for anything you don’t recognise, then remove it. Our is my phone hacked guide has the full checklist.
Run Play Protect. It’s on by default and scans your apps. Open Play Store, tap your profile icon, and open Play Protect to scan.
Use another device for banking. From a family member’s phone, call your bank’s official number and ask them to block UPI and cards if you see anything odd.
Change key passwords from a clean device. Start with email, since it can reset everything else.
Check your money trail. Look through your bank statement for transactions you don’t recognise.

diwali greeting scam: hands holding a phone showing a chat conversation — A short phone call to the sender settles most doubts. · Photo: RDNE Stock project / Pexels

⚠️ Watch out

Lost money? Time matters. Contact your bank first, then call 1930 and file at cybercrime.gov.in. Our money missing from your account guide walks through it step by step.

If Your WhatsApp Is Sending These Messages

If friends tell you your number has been sending weird Diwali links, your account may be compromised too. WhatsApp’s help page says this:

Log back in on your phone: enter your number and the 6-digit code by SMS or call. Re-registering logs out all other devices, including the intruder’s.
You’ll need your SIM: the code goes to your number.
Asked for a two-step PIN you don’t know? WhatsApp says to wait 7 days and try again.
Never share the code: not even with family. “My friend just needs your OTP” is a classic takeover.
Tell your contacts: someone could be impersonating you in your groups.

Don’t report the account first. WhatsApp warns that reporting could lead to a ban, costing you your access and data, so try recovery first. After you’re back in, turn on two-step verification and check your linked devices.

Also readIs My Phone Hacked? 9 Checks for Android and iPhone Users

Protect Your Parents Before Diwali Morning

Older relatives on WhatsApp are the ones most likely to tap a sweet greeting, and they’re often the ones forwarding it. So spend 5 minutes with them today.

✅ Our verdict

Teach one rule: no install, no click, call first. If a greeting asks you to install anything, it’s a scam. If it comes with a link, call the sender. If it promises money, ignore it. That single habit stops almost everything in this post, and it fits on a sticky note.

Practical things to set up on their phone:

Keep Play Protect on, and don’t turn off its warnings.
Turn on WhatsApp two-step verification.
Save 1930 as a contact named “Cyber Fraud Help”.
Tell them they won’t get in trouble for tapping something. People hide mistakes when they’re embarrassed, and delay is what costs money.

Our phone safety guide for parents has the complete setup. Similar tricks turn up in fake courier SMS scams, so the same rule applies there.

Frequently Asked Questions

Can a phone get hacked just by opening a WhatsApp greeting?

The reports we read describe the danger as downloading and installing a file, or entering details on a fake page. Don’t open links you weren’t expecting, and don’t install anything from one.

What is an APK file?

It’s the installation format for Android apps. Police advice is to get apps only from the Google Play Store or Apple App Store, never from a message.

My friend sent the link. Is it safe?

Not necessarily. Police warn that these often come from hacked accounts of people you trust, so check with your friend by phone first.

Is the ₹8,000 Diwali scheme real?

Telangana’s cyber security bureau has flagged it as a fake message. Check government schemes only on official websites, and never pay a fee to claim a benefit.

Where do I report a Diwali scam in India?

Call 1930, the national cybercrime helpline, or file at cybercrime.gov.in. If you’ve lost money, contact your bank immediately as well.

The Bottom Line

A Diwali greeting scam only works if you tap and then install or type something, so one small pause protects you. Send your wishes as plain text or photos, and ask for the same. Share this post with the person in your family group who forwards everything.

Keep reading

Sources

Diwali Greeting Scam on WhatsApp: What to Do If You Tapped