This Diwali, Don’t Let AI-Powered Cyber Scams Steal Your Celebrations

Diwali is a season of celebration, generosity, shopping and togetherness. From exciting online discounts and festive gift hampers to corporate bonuses and family gatherings, millions of Indians look forward to the festivities every year.

But while people prepare to celebrate, cybercriminals are looking for opportunities to exploit the excitement. And in 2026, they have a powerful new advantage: artificial intelligence (AI).

AI is transforming how we work, communicate and shop. Unfortunately, the same technologies that make everyday tasks easier can also help fraudsters create convincing messages, imitate trusted individuals and develop sophisticated online scams.

A suspicious email that once contained obvious spelling mistakes can now look professionally written. A fake shopping advertisement can resemble a genuine brand campaign. Even a familiar voice on the phone may not belong to the person you think is calling.

With Diwali on 8 November 2026, understanding these emerging risks is an important part of staying digitally safe.

How artificial intelligence is changing festive cyber fraud

Traditional cyber scams often depended on generic messages, poorly designed websites and mass-distributed phishing emails. Generative AI has changed the possibilities. Cybercriminals can potentially use AI-powered tools to:

The dangerous part is not simply that AI makes scams look better. It can make fraudulent communications feel more personal, relevant and trustworthy. Here is how these techniques could be used during Diwali and the festive season.

1. AI-generated Diwali shopping offers

Using generative AI, attackers can create convincing promotional images, product descriptions and storefront content. They may distribute these offers through social media advertisements, WhatsApp groups, emails and search results. A customer who follows the advertisement may land on a fraudulent shopping website that collects payment details, personal information or login credentials.

2. Deepfake celebrity endorsements and fake festive giveaways

A familiar face promoting a festive offer instantly attracts attention. Imagine a video in which a well-known actor, entrepreneur or influencer appears to announce an exclusive Diwali giveaway. The face looks familiar, the voice sounds natural and the video appears professionally produced. But the endorsement may never have happened.

Deepfake technology can create synthetic video or audio that falsely shows someone supporting a product, service or investment. During the festive season, such content could promote fraudulent giveaways, fake investment schemes, luxury product discounts or cryptocurrency offers.

A convincing video is no longer sufficient proof that a promotion is legitimate.

3. AI voice cloning: when a trusted voice asks for money

One of the more concerning uses of AI in fraud is voice impersonation.

Synthetic voices can make these attempts more believable, especially when attackers combine them with details gathered from social media or public business profiles. See our guide to AI vishing and voice cloning for the verification steps teams can rehearse.

Recognising a voice is no longer the same as verifying an identity.

4. Fake corporate Diwali bonuses and gift vouchers

Organisations often announce bonuses, gift cards, festive allowances and rewards during Diwali, and cybercriminals can exploit those expectations. An employee could receive what looks like an official HR email announcing a Diwali bonus or gift voucher, with professional language, familiar branding and a plausible approval process.

But the link could lead to a fraudulent login page designed to capture corporate credentials. AI-written messages can make these emails more polished and personal, and the damage may not stop at one account: stolen credentials can expose business data and give attackers a way in for further attacks.

5. Fake courier and gift-delivery messages

Diwali brings a big increase in gift exchanges and online deliveries, which makes courier notifications attractive to fraudsters. Imagine a WhatsApp message saying your Diwali gift hamper could not be delivered because of an incomplete address, asking you to update your details or pay a small redelivery charge.

AI can generate natural-sounding delivery notifications that copy the style of real logistics providers, and some scams use automated chats that pose as customer support. The goal may be personal information, banking details or a payment authorisation. Our smishing and WhatsApp phishing guide covers these mobile scams in more detail.

6. AI-powered UPI cashback and QR code scams

Festive cashback rewards and digital payment promotions are common during big shopping events. Fraudsters circulate fake cashback offers, coupons and QR codes: a message may claim you have won a special Diwali cashback and must scan a QR code or enter your UPI PIN to collect it. AI can make the promotion look professional, but the fraud depends on misleading you about what the payment authorisation does.

7. Fake festive invitations and calendar phishing

Around Diwali, employees receive invitations to office celebrations, festive get-togethers, online contests and gift-distribution events. Fraudsters can hide malicious links inside invitations that look legitimate, and AI can help them write convincing event descriptions and personalised invites, delivered by email, calendar invitation or messaging app.

A recipient who follows the link may meet a fake registration form, a fraudulent login portal or a malicious download. Calendar invitations deserve particular attention because people treat them as routine scheduling rather than a possible threat. Learn more in our analysis of CalPhishing and malicious calendar invitations.

8. AI-driven festive charity and donation fraud

Diwali is also a season of giving, and many people support charities, community celebrations and social causes. Fraudsters can exploit that generosity with fake donation campaigns built on AI-generated photographs, persuasive messages and invented organisations, sometimes claiming to represent well-known charities. These campaigns spread on social media and messaging apps and point donors to unverified payment accounts.

Why these attacks are harder to spot in 2026

One of the biggest changes in AI-enabled fraud is that the traditional warning signs are less reliable. People have long been told to look for poor grammar, unusual formatting and unprofessional language. Those clues still matter, but they are no longer enough: AI-generated content can be grammatically correct, well formatted and written fluently in English, Hindi, Marathi or other regional languages.

Attackers also combine channels. A fraudulent festive email may be followed by a WhatsApp message and then a convincing voice call, each one reinforcing the last and making the story more believable.

1. Festive email→
2. WhatsApp follow-up→
3. Convincing phone call→
4. Payment or credentials

That is why awareness has to move beyond spotting suspicious-looking messages. The focus needs to shift to verifying identities, validating requests and recognising manipulative behaviour, even when a message looks genuine.

How organisations can prepare employees for festive scams

The festive season brings its own pressures for businesses. Employees may be planning holidays, handling extra work, processing year-end purchases or approving festive vendor payments, and fraudsters can build convincing phishing and impersonation scenarios around exactly those circumstances.

1. 1 · Simulate

   Run festive-themed phishing simulations: fake gift vouchers, delivery notices, HR bonus announcements and discount offers.

2. 2 · Prepare

   Explain that familiar voices, polished videos and recognisable faces are not identity checks, and practise verifying unusual requests.

3. 3 · Report

   Encourage people to report suspicious emails, messages, calls and websites quickly, so the security team can warn others.

Measure human risk continuously. Completing an annual course does not mean people are ready for new threats. Organisations need to see how people respond to realistic simulations, where the gaps are and whether behaviour improves over time.

Strengthen financial approval controls. Finance and procurement teams should verify unexpected bank-account changes, urgent payments and last-minute vendor requests using contact details they already trust. An apparent instruction from a senior executive should never override established payment controls.

How PhishSheriff helps organisations prepare

At PhishSheriff, we believe security awareness should prepare employees for the attacks they are most likely to meet. PhishSheriff brings together phishing simulation, security awareness, behavioural intelligence and email trust insights, so organisations can understand risk and decide where to act. Organisations can use PhishSheriff to:

• Run phishing simulations based on festive offers, HR announcements, gift vouchers and delivery scams
• Introduce employees to new social engineering techniques through AI-assisted scenarios
• Assess responses to voice-based social engineering with AIVA, PhishSheriff’s AI voice phishing simulation
• Run exercises across the channels available in your deployment with the Multi-Channel Simulator
• Review responses with human risk analytics to see which teams need more support
• Deliver targeted awareness training and track how responses change over time

The objective is not to create fear around new technology. It is to help employees build the confidence and judgement to recognise a suspicious situation, because awareness has to evolve as quickly as the threats themselves.

What to do if you encounter a festive cyber scam

1. 1Don’t respond straight away to a suspicious offer, payment request or unexpected verification message.
2. 2Verify the sender through a separate channel you already trust.
3. 3Never share passwords, OTPs, banking credentials or confidential business information.
4. 4If you have already shared credentials, change the affected passwords promptly and tell your organisation’s IT or security team.
5. 5If you have lost money in India, contact your bank immediately and report it to the National Cyber Crime Helpline on 1930 or at cybercrime.gov.in.

Report quickly: delays can make recovering money and containing an incident much harder.

Celebrate Diwali with awareness, not anxiety

Diwali symbolises light overcoming darkness. As we celebrate the festival of lights, it is just as important to bring awareness to the digital world around us. AI is creating extraordinary opportunities for businesses and individuals, but fraudsters can misuse the same innovations to make scams more convincing, personal and difficult to recognise.

Whether it is an unbelievable shopping discount, an unexpected Diwali gift, a suspicious cashback message or a familiar voice asking for money, a few moments of verification can prevent serious consequences.

Not every festive offer is genuine. Not every familiar voice is real. And not every convincing message deserves your trust.

Celebrate responsibly. Verify before you trust. Stay cyber aware. Wishing everyone a happy, prosperous and cyber-safe Diwali from Team PhishSheriff!