Fraudsters do not send badly-written messages anymore. The current wave sends three message shapes: a "refund overdue" notice with a link, a courier "delivery missed — reschedule" link, and a fake customer-support chat stolen from a real brand's name and photo. All three end the same way: they ask for an OTP, a UPI PIN, or a "screenshot" while you enter a password.
The three shapes
1. The refund / missed-delivery link
A message that appears to come from a real company, a blue-tick-like logo and a short link. The destination page mirrors the brand. The scam breaks only when it asks you to log in with an OTP the "agent" then reads back to you.
Why it matters
The single fact that shuts down almost every version of these scams: your OTP is literally authorisation to a bank action. Whoever reads it back to you has just used your money. No legitimate process needs you to read an OTP to a "support agent" — ever.
2. The fake support ticket
You post about a problem anywhere; within minutes a "support agent" follows up in a DM. The chat is professional. The final step — "share the OTP we just sent you" — is the whole point of the conversation.
Key takeaways
- "Refund", "courier" and "support" messages with links are the current top-of-wave scams.
- Any OTP/PIN request = fraud, regardless of how official the message looks.
- Report to cybercrime.gov.in and freeze via your bank within minutes, not days.
3. The "family member needs help" message
A new number, your relative's name and photo copied from their profile, asking for money via a QR code or UPI ID. The voice note version uses cloned audio. The check is always the same: call the real number.
How to spot them
- Official payments and support never require you to share an OTP — anyone who asks for your OTP is a scammer by definition.
- QR codes sent by a stranger hide a payee you cannot inspect first — a legitimate QR payment shows the payee name before you confirm.
- Delivery refunds and courier reschedules have official apps: go to the app, not the link.
What you should do
- Stop and verify by official channel — open the official app or site, never the message link.
- If you shared an OTP or paid money, call your bank's helpline immediately to freeze the account and dispute the transaction.
- Report the number on WhatsApp and to cybercrime.gov.in
- Tell the person the message pretends to be from — the group conversation usually stops a clone number dead.