Stay safe › Scams
Shopping account takeover
Someone gets into your shopping or wallet app and spends your gift card balance, coins and saved cards.
How it works
Scammers get your login by tricking you into sharing an OTP, sending you a fake login page, planting a harmful app on your phone, or trying passwords leaked from other websites. Once inside, they spend whatever the account holds: gift card balance, reward coins, saved cards and pay-later credit. Gift cards and vouchers are popular with them because they are easy to resell.
Real cases
In December 2024, Mangaluru’s CEN police arrested a man from Delhi after a victim’s Flipkart account was taken over. The victim had downloaded an app linked to a WhatsApp message. The account was then used to buy two phones and gift vouchers worth about ₹1.31 lakh on his cards. In 2021, Inc42 reported Flipkart users saying their accounts had been broken into and their coins used. A security researcher linked the logins to an earlier data leak at another company.
Why one password for everything is risky
When a website is hacked, criminals try the leaked email and password on other popular apps. A different password for each app stops one leak from opening all your accounts.
If it has already happened
- Use "forgot password" in the official app to get back in, and log out of all devices.
- Call your bank to block any saved cards that were used, then report it in the shopping app's help section.
- Call 1930 or report at cybercrime.gov.in if money was taken. Uninstall any app you installed from a link.
Protect yourself
- Never share login OTPs. A shopping app will never call you to ask for one.
- Use a strong, different password for each shopping app, and don't install apps sent on WhatsApp.
- Don't store more than you need: keep gift card balances small and remove saved cards you don't use.
Say it simply
If you get an OTP you didn't ask for, someone is trying to get into your account. Don't share it, and tell the family.
Never tell anyone the OTP from a shopping app, even if they say they're from the company.
Where to report
- Cybercrime helpline 1930Money has been taken or a payment was tricked out of you. Call at once: the sooner, the better the chance of freezing it.Call 1930
- Your bank, directlyBlock your card or UPI, and report the transaction. Use the number on your card or the bank's official app, never one from a message.Number on your card
- The app or platformReport and block the account on WhatsApp, Instagram, YouTube or wherever it happened, so it can be taken down.Report in the app
- National Cyber Crime Reporting PortalFile a complaint about any cyber fraud, harassment, sextortion or morphed images.cybercrime.gov.in
Learn more
Strong passwords, PINs and 2FA
Why a password built from public information is no lock at all, and how passphrases, password managers and two-factor authentication keep accounts safe.
Real banks never ask for your OTP
How fake KYC messages and "bank manager" calls trick people into sharing OTPs, the red flags to spot, and where to report in India.