Whalesbook
How the Scam Unfolded
A judge of the Bombay High Court lost ₹6.02 lakh on February 28, 2026, to a carefully planned credit card reward point redemption scam. The deception began when the judge tried to redeem her accumulated reward points but couldn't reach the bank's official customer service. Searching online for a different contact number, she found a fraudulent line operated by scammers.
The scammer, posing as a bank representative, asked the judge to download an 18MB file via WhatsApp. When the file didn't work on her iPhone, the fraudster suggested using an Android device. The judge borrowed a helper's phone and used her SIM card. After downloading the file and entering her credit card details into a linked form, she quickly received alerts for multiple unauthorized transactions totaling ₹6.02 lakh. The judge promptly blocked the card and reported the incident to cybercrime authorities and police. The bank involved was HDFC Bank.
Reward Point Scams: A Growing Danger
This incident is part of a growing trend exploiting the common practice of redeeming credit card reward points. Scammers often pretend to be bank officials or digital wallet representatives, using urgent reasons like expiring points to pressure victims. Their usual method involves posting fake customer service numbers online, leading victims to download malicious apps or files via WhatsApp. These files can install malware, direct users to fake websites, or steal sensitive data like credit card numbers, CVVs, and OTPs.
The scammer's tip to use an Android device shows how adaptable these frauds are to different mobile systems.
Why These Scams Succeed
The biggest risk remains social engineering – tricking people. These attacks bypass technical security by playing on human psychology, trust, and urgency. Scammers succeed because people often click unknown links or download files, and it's hard to get money back once it's gone. While banks invest in cybersecurity, fraudsters convincingly impersonate legitimate companies, catching even careful users.
Scams often exploit common user actions, like seeking customer help or redeeming points. Recovering stolen funds is difficult due to the speed and anonymity of digital transactions.
India's Rising Cybercrime Problem
This reward point scam occurs as cybercrime in India escalates. In 2025 alone, Indians reported nearly ₹20,000 crore lost to fraud, with credit card fraud being a significant part. Card and internet frauds made up a large share of total cyber fraud cases in FY 2024-25, showing ongoing weaknesses in digital banking. Criminals constantly update their methods, using personalized attacks and advanced phishing, and impersonating banks and regulators. This growing sophistication makes scams harder to spot, even for tech-savvy people.
Impact on Consumer Trust
These clever scams seriously damage consumer trust in digital finance. When processes like redeeming reward points can be exploited, it makes people question the security of online banking. While these scams don't hack banks directly, they target customers, causing financial loss and potential reputational damage. The Reserve Bank of India (RBI) recognizes how important consumer trust is and the need for strong security to keep the digital financial system stable.
New Rules to Fight Fraud
To counter rising digital fraud, regulators are stepping up efforts. The RBI has proposed new rules from July 1, 2026, to boost customer protection. These include a compensation plan for smaller fraud cases, covering up to 85% of losses, capped at ₹25,000 for the first instance. Banks must offer 24/7 channels for reporting fraud and speed up dispute resolution.
Financial firms are pressured to improve fraud detection, teach customers about cybersecurity, and ensure clear, safe communication for all interactions, especially those involving money or sensitive data.
Staying Safe Online
As cyber threats keep changing, a multi-layered defense is needed. This means banks need advanced technology, but also strong focus on user education and awareness. Consumers must watch out for social engineering tricks and always verify communications, especially those asking for personal details or directing them to download files. Reporting suspicious activity quickly is key to reducing losses and helping investigations.