Online shopping cashback scam: recovery steps in India

A delayed cashback from a genuine merchant is a consumer dispute. A fake support agent who makes you scan a QR code, approve a collect request, share an OTP or install remote-access software is a cyber financial fraud. The first problem needs the seller, platform and consumer grievance route. The second needs immediate bank blocking, 1930 and the National Cyber Crime Reporting Portal. Some incidents involve both.

Searches for cashback scam India, online shopping refund fraud and how to report cashback scam should produce a bank ticket or an NCH docket — not a WhatsApp “task manager” asking for another deposit.

Do not assume every rejected promotion is criminal fraud. Do not downgrade an actual unauthorised debit into a routine customer-care ticket.

Follow the branch that matches the table above. This is the practical how to report cashback scam sequence.

1. End the remote-access session and stop further “tasks” or “GST deposits”.
2. Call the bank through its official channel and block the affected card, UPI or account access.
3. Call 1930 with the transaction facts; complete cybercrime.gov.in. Script: 1930 helpline. Recovery ladder: online payment fraud recovery.
4. Change bank and email passwords from a trusted device.
5. Preserve the order, offer, chat, QR/collect screen and payment reference before leaving the group.
6. Ask the bank for its written dispute and liability process. Do not quote an unofficial recovery percentage.
7. If the SIM stopped or a port request appeared, use SIM-swap recovery and check TAFCOP.

1. Capture the offer page, checkout screen, order number and the term you relied on, dated.
2. Complain once through the platform's official grievance channel (app/website), not a search-ad phone number.
3. If the 48-hour acknowledgement or one-month redress under the E-Commerce Rules does not produce a reasoned reply, file at NCH (1915 / consumerhelpline.gov.in). Guide: National Consumer Helpline 1915.
4. If still unresolved, consider e-Jagriti: e-Jagriti filing.

Keep the facts and the relief for each route separate. 1930 and the bank handle the fraudulent debit. NCH and the commission handle the genuine seller or platform-service issue. Do not send an OTP to either desk.

The victim searches for a merchant's support number and calls a number placed by an impersonator. The caller asks for a “refund form”, remote-access app, OTP or payment approval. Always enter support through the merchant's official app or typed website. Related: fake customer-care scams.

The scammer says scanning a QR code will credit a refund. The flow instead prepares a payment from the victim. Read the final UPI screen. You do not need to enter a UPI PIN merely to receive a normal credit.

A message promises a large cashback or reward but requires tax, KYC, membership or processing money first. A second payment often leads to a second demand.

The caller already knows an order detail from leaked, public or guessed information and claims cancellation requires an OTP. Order knowledge does not prove the caller is the platform.

The caller asks the victim to install an app so that support can “guide the refund”. Screen control can expose OTPs, bank apps and card details.

A group pays a small initial amount for product likes or reviews, then asks for larger deposits to unlock commissions. Treat deposits, crypto transfers and “negative balance” demands as high-risk financial fraud, not ordinary shopping cashback. The first small credit is how trust is built; it is not proof that the operator is a genuine marketplace programme.

No legitimate large marketplace pays the public to review products through an open WhatsApp or Telegram group. Closed influencer programmes use the platform's own invitation channel, not a personal UPI ID.

Preserve:

• merchant and platform name;
• order number, invoice and product listing;
• cashback or refund terms shown at purchase;
• payment reference, UTR, amount and time;
• seller or support chat and email;
• phone number, profile and website URL used by the suspect;
• screenshot of the collect request, QR flow or remote-access app;
• group name, admin number and a chat export if a task group was used;
• bank, 1930 and NCRP complaint references;
• platform grievance and response.

Keep original screenshots unedited. Make redacted copies for consumer correspondence so bank, card and identity data are not exposed unnecessarily. Export a chat from inside the app before you leave or are removed.

On [date] I [placed order number / joined a cashback or review group named … / searched for merchant support].
At [time] [displayed number / admin] said [exact cashback, refund or task claim] and asked me to [scan QR / approve collect / share OTP / pay ₹ amount / install app].
I paid / approved ₹[amount] at [time], UTR [number], to [VPA or account as shown].
I stopped further payments at [time], called the bank at [time] ticket [number], and called 1930 / filed at cybercrime.gov.in acknowledgement [number].

I am not treating a genuine marketplace as the accused solely because its product link or logo was shown. The collectors used [personal UPI / changing accounts / unofficial number].

The Consumer Protection (E-Commerce) Rules, 2020 require covered e-commerce entities to publish important information such as grievance redressal, return, refund, exchange, warranty, delivery and payment terms. The rules also require a grievance officer; the entity must acknowledge a consumer complaint within 48 hours and redress it within one month from receipt.

In the complaint, state:

1. exact order and payment;
2. written cashback, refund or return term relied on;
3. what happened and on which date;
4. whether the person who contacted you used an official platform channel;
5. money lost or benefit withheld;
6. the specific action requested;
7. cybercrime and bank references if fraud occurred.

Do not send an OTP, UPI PIN or card PIN as evidence. A genuine platform does not need those secrets to investigate.

To
The Grievance Officer
[Platform / seller legal name as on the invoice]
Copy: National Consumer Helpline docket [if already created]

Subject: Cashback / refund not honoured on order [number] — [date]

I purchased [item] on [date], order [number], paid ₹[amount] vide [UTR]. At checkout / in the offer page captured on [date] the term shown was [quote].

What happened: [cashback not credited / return refused / unofficial caller used the order detail].
I request: [credit the stated cashback / complete the stated refund / confirm whether the caller used an official channel].
I have also reported a fraudulent debit of ₹[amount] under bank ticket [number] and cybercrime acknowledgement [number], if applicable.

Attachments: order invoice, offer screenshot, payment proof, chat, grievance trail.

The Department of Consumer Affairs runs the National Consumer Helpline as a pre-litigation grievance mechanism. Its current contact page lists:

• 1915 or 1800 11 4000 for calls;
• consumerhelpline.gov.in for web filing;
• SMS or WhatsApp at 8800001915;
• NCH and UMANG app routes.

The published calling hours are 8:00 AM to 8:00 PM daily except national holidays. Verify the current details on the official contact page.

NCH sends grievances to participating companies, agencies, regulators or ombudsmen and generates a docket. It does not guarantee settlement. Track the docket using the consumer complaint status guide. For a cyber-financial-fraud debit, NCH is not the emergency desk — 1930 is.

Print two copies of a small pack. Hand one copy against an acknowledgement; keep the other.

• cybercrime.gov.in / 1930 acknowledgement;
• bank ticket and the statement line for each disputed debit;
• UPI or card screenshot showing beneficiary VPA, amount and time;
• order invoice and the cashback or refund term captured on the purchase date;
• WhatsApp or Telegram export (use the app's export, with media if the file stays small enough to attach);
• group-info screenshot: admin number, participant count, group name;
• QR / collect-request / remote-app permission screen;
• identity proof only if the official desk asks for it — do not post Aadhaar in a public group.

If a police station tries to record only a non-cognizable note, ask that information disclosing online financial fraud be recorded, and keep a written copy of what you handed over. A related walkthrough is complaint entered as NC.

• Do not pay a further “task”, “GST”, “security” or “negative balance” to unlock earlier money.
• Do not call a sponsored “Amazon / Flipkart / Meesho support” number from a search advertisement; type the official site or open the app.
• Do not treat a small incoming UPI credit as proof that a review group is a genuine marketplace programme.
• Do not name a listed marketplace as the accused solely because a product URL or logo appeared in the chat.
• Do not delete the group until the export exists.
• Do not publish other members' phone numbers.
• Do not hire a recovery agent who wants a percentage or an OTP.

If a genuine seller or platform dispute remains unresolved, consider the consumer commission route. e-Jagriti is the current online system described in the e-Jagriti filing guide. Jurisdiction, limitation, fee and evidence depend on the actual transaction and relief.

Do not substitute a consumer case for prompt cybercrime and bank reporting when an impersonator stole money. The consumer case addresses the seller or service relationship; police and bank processes address the fraud and payment trail.

The Department of Consumer Affairs' dark-pattern guidelines identify deceptive interface practices such as false urgency, basket sneaking, bait and switch, drip pricing, disguised advertising and subscription traps. A hidden condition or misleading checkout can be a consumer-protection issue even when no criminal impersonator exists.

Record the screen as it appeared at the time of purchase. A later version of the offer page may be different. Ask the platform for the exact promotion terms and reason for denial.

After a public complaint, scammers may pose as the platform, police, bank, NCH or a refund specialist. Verify every caller independently. No official needs you to:

1. approve a UPI collect request to receive a refund;
2. share an OTP, UPI PIN or card PIN;
3. install remote-control software;
4. pay crypto or a “case release” fee;
5. send full card or Aadhaar images over chat;
6. withdraw the cybercrime complaint before money arrives.

If an account becomes restricted because it received a disputed transaction, follow the cybercrime bank-freeze guide. A lost genuine parcel is a postal problem: Speed Post / parcel complaint. A courier-OTP fear call is courier OTP scam.

Use RTI only against a public authority that already holds your complaint. File through file RTI online.

To
The Public Information Officer
[State cyber unit / Department of Consumer Affairs — as named on the acknowledgement]

Subject: Information under the RTI Act, 2005 — acknowledgement / docket [number]

Sir / Madam,

Under section 6(1) of the RTI Act, 2005, please provide the current status recorded against [cybercrime acknowledgement / public consumer docket] [number] dated [date]; the unit holding it; and any recorded reason if it is closed or returned, without disclosing exempt third-party data.

I enclose the prescribed fee.

Name:
Address:
Mobile:
Date:

No. It may be a term, eligibility, tracking or merchant dispute. Fraud indicators include impersonation, secret requests, remote access and a payment demanded to release money.

You do not normally enter a UPI PIN merely to receive a credit. Read any collect request or QR authorisation carefully; it may be asking you to pay.

Notify the bank, call 1930 promptly, report at cybercrime.gov.in and preserve the order, payment and contact evidence.

Stop deposits, screenshot the group and payments, call 1930, file at cybercrime.gov.in and notify the bank. That is a financial-fraud report, not an NCH shopping ticket, unless a genuine platform also failed in a documented way.

The E-Commerce Rules require the grievance officer to acknowledge the complaint within 48 hours and redress it within one month from receipt.

The current official page lists 1915 and 1800 11 4000, plus web, SMS, WhatsApp, NCH app and UMANG routes.

No. NCH is a pre-litigation grievance mechanism. Keep the docket and escalate through the proper consumer route if unresolved.

Yes, when the incident has both fraud and a genuine merchant or platform-service issue. Keep the facts and relief for each route clear.

No. Verify officials independently and never pay a fee, share a PIN or approve a debit to receive recovered money.

• What to say when calling 1930
• Online-payment fraud and bank liability
• National Consumer Helpline 1915
• Track an NCH or e-Jagriti complaint
• File a consumer case on e-Jagriti
• File a consumer case online
• Fake customer-care number scams
• File a cybercrime complaint
• SIM-swap recovery
• TAFCOP / Sanchar Saathi
• Bank account frozen after cyber fraud
• Courier delivery OTP scam
• Report a scam call
• Lost or damaged postal parcel complaint
• MLM / pyramid scheme complaints
• File an RTI online
• RTI Wiki home

• National Cyber Crime Reporting Portal and 1930
• RBI customer-liability circular for unauthorised electronic transactions
• Consumer Protection (E-Commerce) Rules, 2020
• Department of Consumer Affairs: Consumer Protection Act, rules and guidelines
• National Consumer Helpline official contact routes
• National Consumer Helpline role and grievance workflow