Free Money That Costs You Money: Inside the Fake Cashback Offer Scam

Everyone likes a reward. A cashback credited to a wallet, a voucher for an anniversary celebration, a refund you had forgotten about: these small wins make a day better. Cyber criminals know this very well, and they have built an entire scam around it. Like many frauds that rely on persuasion rather than technical hacking, it falls under social engineering fraud.

How the scam begins

It starts with a message. It can arrive by SMS, WhatsApp or sometimes email, and it usually looks like good news. Typical versions include:

• A note saying your KYC has been updated successfully and cashback has been added to your wallet, with a link to collect it.

• A voucher from a well-known retail brand to celebrate an anniversary, with a link to claim it.

• An alert that your online banking account has been suspended, with a link to "unlock" it.

• A QR code with a rupee amount and a label such as "payment refund".

The message might pretend to come from a payment app like PhonePe or Google Pay, from a bank, or from a shop you recognise. The link is often a strange string of letters and numbers, which is not what a real company would use.

What actually happens

The victim opens the link or scans the code, and the screen shows a payment page. At the top, there is a friendly amount, and somewhere a word like "refund" or "receive". The victim believes money is coming in and enters their MPIN or UPI PIN to "accept" it.

That is the moment the trap closes. The page was never a credit. It was a request for money, styled to look like one. Entering the PIN authorises a payment from the victim's own account to the fraudster. Instead of receiving money, the victim pays it.

The labels are decoration

One of the cleverest parts of this scam is how the QR code or link is edited. Fraudsters add text that suggests the opposite of what is really happening, with phrases like "payment refund" or "money receive", in place of the word "pay".

Those words are just labels typed by the person who made the code. They do not change what the code actually does. Most victims never read the screen properly, because they are hoping for a reward and trusting the wording. The real direction of money is shown elsewhere, in the payment app's own screen, as a payment to someone else.

Why it works

• A pleasant surprise. People are less careful when they expect good news.

• Brand trust. Names of popular payment apps, banks and retailers lend instant credibility.

• Plausible reasons. KYC updates, anniversaries and refunds are all things people are familiar with.

• Reading the headline only. In a hurry, we look at the amount and the friendly words, not the fine print.

• The PIN habit. Many people are so used to entering a PIN to complete a payment that they do it without asking why.

The thumb rule that beats the scam

Here is the one thing worth memorising. You enter your MPIN or UPI PIN only when money is leaving your account. It is never needed to receive money.

So if a screen asks for your PIN while you believe you are receiving a reward, stop. Whatever the screen says, that is a payment going out.

A few more habits help:

1. Never click or forward a suspicious link from an unverified source.

2. Do not scan a QR code that arrived by message from someone you do not know.

3. Read what the payment app itself is showing you, especially the name of the recipient and whether it says you are paying.

4. Ignore the pressure. Real cashbacks do not expire in ten minutes.

5. Check offers directly in the official app or on the official website of the company, not through a link that was sent to you.

6. Be wary of any link that looks like a random string of characters instead of a recognisable address.

The legal angle

This kind of fraud is generally dealt with under the Information Technology Act, 2000, notably Section 66C (dishonest use of someone's identifying information) and Section 66D (cheating by personation using a computer resource), together with the cheating provisions of the Bharatiya Nyaya Sanhita. The sections finally applied depend on the facts in the FIR and the investigating agency's view.

If you have already entered your PIN

1. Call your bank immediately and ask them to block UPI and flag the transaction.

2. Call the National Cyber Crime Helpline, 1930, without delay.

3. File a complaint at cybercrime.gov.in.

4. Keep screenshots of the message, the link, the payment screen and the transaction ID.

5. Do not click the link again, and do not reply to the sender.

6. Report quickly. Under RBI's framework for unauthorised electronic transactions, reporting within three working days generally strengthens the customer's position where the fault does not lie with them. Because the victim enters the PIN in this scam, banks may question whether the transaction was authorised, so keep every record.

A closing thought

Most of us would never hand money to a stranger who asked for it. The cashback scam works because it does not ask. It offers. The way to stay safe is to flip the question: if money is supposedly coming to you, why is a PIN being asked for? The honest answer is that it should not be. When in doubt, close the screen.