It's that time of year again in Mumbai. Millions of devotees are lining up for hours, sometimes overnight, just to get a glimpse of the city's most famous Ganesh idol. The lines for the Navsachi line and the regular Mukh Darshan line stretch for kilometers. You stand in the heat. You navigate massive crowds. You test your physical endurance. The wait can easily cross twelve or fourteen hours. And this devotion creates the perfect opening for cybercriminals. Right now, the fake Lalbaugcha Raja 2026 VIP Darshan Pass WhatsApp scam is spreading fast across family groups, promising a shortcut that will drain your bank account instead of saving time.
Honestly, scammers understand human psychology perfectly. They know you're tired. They know you have elderly parents who can't stand in a line for ten hours but desperately want darshan. So they drop a simple WhatsApp forward into your family group (annoying, I know). The message looks incredibly official. It usually features a photo of the idol and a link claiming to offer official fast-track entry for a fee of Rs 500 or Rs 1,000. It sounds like a blessing. But it's a trap designed to hijack your phone and steal your money.
How the VIP darshan pass scam actually works
The fraud usually starts with a compromised WhatsApp account or a bulk message blast. You get a forward with a link. It says something like "Click here to book your Lalbaugcha Raja VIP Darshan Pass 2026".
When you tap the link, it takes you to a fake website. These websites are cloned to look exactly like the official Lalbaugcha Raja Sarvajanik Ganeshotsav Mandal portal. They use the same saffron color schemes and the exact same fonts. The site will ask for basic details first. Your name and phone number. They might even ask for your Aadhaar card or PAN card details, claiming it's required for temple security checks. Once they have your ID documents, they can use them to open fake bank accounts. They can take out instant loans in your name. Or they bypass basic KYC protocols. Look, don't hand over your government IDs to unverified websites. Legitimate Indian services use DigiLocker or official government portals for verification. They don't use a random web form linked from a chat app.
Next comes the payment trap. In my experience, scammers never stop at just one trick.
The site asks for a small fee, usually between Rs 200 and Rs 1,000. It redirects you to a payment gateway that looks familiar. But here is where the scam branches into two paths.
Path one is a direct UPI hijack. You enter your UPI PIN thinking you are paying Rs 500. But the scammers manipulated the backend request. So instead of paying the merchant, you're authorising a transfer of your entire account balance to a mule account.
Path two is a total mess. Instead of a direct payment website, the link asks you to download a "VIP Darshan App" as an APK file. Never install APK files sent over WhatsApp. Once you install this file, a trojan hides in your phone's background. It gives the scammers full access to your SMS messages. They initiate banking transactions from their end. When your bank sends the OTP, the malware intercepts it. It forwards it to the scammers and deletes the message from your inbox before you even see it. CERT-In has issued advisories about this exact type of Android malware targeting Indian users during major festivals. We saw the exact same technical setup in the recent NHAI toll pass fraud that compromised hundreds of phones earlier this year.
The official word from the Lalbaugcha Raja Mandal
I need to be absolutely clear about this. There is no online VIP pass system for the general public. The organizers have stated this repeatedly.
In a public statement addressing these frauds, the organizers were categorical.
"The Mandal does not issue VIP passes or charge money for darshan. Some websites and social media handles are spreading false information. Do not believe or circulate unverified news. For authentic updates, always refer to our official channels."
Any website or WhatsApp number claiming to sell passes is lying to you. The official website handles live streaming and donations. It doesn't sell fast-track entry tickets to bypass physical queues. The numbers here are a bit fuzzy, but the sheer volume of devotees makes a paid online VIP system impossible to manage anyway. If you ask me, the crowd size alone proves these offers are fake.
Temple scams are a growing threat across India
The commercialization of faith is making devotees incredibly vulnerable. We're seeing a massive spike in religious tourism frauds. They take many forms. Some are digital. Others happen right on the temple grounds.
Take the incident at the Trimbakeshwar Temple earlier this year. In April, a trustee of the Trimbakeshwar Temple Trust was arrested in Nashik because of a VIP darshan scam. Devotees who already had legitimate Rs 200 passes were approached by agents on the temple grounds. These agents convinced them to pay Rs 3,000 for a guaranteed ten-minute VIP darshan. They took the money. They provided no receipts. They pocketed massive amounts of cash daily. The police had to step in and make arrests after devotees complained.
Cybercriminals watch the news. They see how willing people are to pay for access, and they digitize the crime. I think people just want to skip the lines. They create fake helicopter booking sites for Kedarnath. They run fake donation drives for Ayodhya. And now they sell fake passes for Lalbaug. It's a highly organized industry. They use the same psychological pressure tactics found in other financial frauds, like the KBC lottery winner fraud. The goal is always the same. They want to get you to act purely on emotion without checking the facts.
Warning signs that a darshan pass is totally fake
You need to know how to spot a fake link before you tap it. The warning signs are usually obvious if you take a second to look.
- The message creates an artificial rush by claiming only a few passes are left and the offer closes in minutes.
- The link asks you to download an Android APK file directly instead of directing you to the Google Play Store or Apple App Store.
- The web address looks slightly wrong, using a random string of numbers or a strange domain instead of the official one.
- You are asked to enter your UPI PIN to receive a digital ticket or a confirmation SMS. You only ever enter a UPI PIN to send money from your account.
- The contact number has an international country code, or they refuse to speak on a standard voice call and insist entirely on WhatsApp chat.
How to protect your bank account from festival frauds
Protecting yourself requires technical common sense and healthy skepticism. When you're planning a temple visit, rely only on information published on verified platforms. If a deal sounds too convenient, it's almost certainly a trap. If you want to understand exactly how these malware networks operate under the hood, I highly recommend checking out our tech explainers on Android security.
Basically, fix your phone settings immediately.
Go to your Android settings, search for "Install unknown apps," and disable this permission for WhatsApp and Chrome. This simple step blocks rogue APK files from installing themselves on your device.
Also, review your UPI daily limits. You can log into your banking app and set a strict limit of Rs 5,000 for daily UPI transfers. This way, even if you make a mistake and enter your PIN on a fake payment gateway, the scammers can't drain your entire life savings in a single transaction. (Which makes sense, actually.)
Warn your older relatives. They are the primary targets for this. Scammers know that senior citizens are more likely to trust a message that features religious imagery. Tell your parents and grandparents that nobody sells Lalbaugcha Raja passes on WhatsApp.
But don't engage with the scammers if you realize it's a fraud midway through. Don't try to confront them or waste their time. Just block the number, report the WhatsApp account as spam, and delete the message so you don't accidentally forward it to anyone else.
What to do if you lose money to this scam
If you did tap the link, paid the fee, or installed the app, you're in a race against time. Don't sit in shock. You have to act immediately.
Call the national cybercrime helpline at 1930 the exact moment you realize money has left your account. The 1930 system works with the RBI and major banks to freeze fraudulent transactions. But this only works if you call within the golden hour before the scammers get a chance to withdraw the cash from ATMs or buy crypto.
We regularly see victims delay reporting out of embarrassment. Do not delay reporting out of embarrassment. A recent case in Bengaluru involved an engineer who lost over Rs 72 lakh to a sketchy scam run through UK phone numbers. Because he waited days to file a police complaint, the fraudsters easily moved the money across twelve different accounts. That made recovery impossible. Don't make this mistake.
After calling 1930, go to cybercrime.gov.in and file a formal written complaint. You'll need to upload evidence. Take screenshots of the WhatsApp chat, the fake website, and your bank statements showing the exact transaction IDs.
Thing is, if you installed an APK file, your phone is compromised. Disconnect from the internet immediately. Transfer your photos and contacts to a computer, and perform a complete factory reset on your device. You must wipe the phone entirely to remove the malware. Simply deleting the fake app from your home screen isn't enough.
Stay alert this festival season. I'm not sure exactly why it gets so bad during festivals, but scammers are working overtime. They have zero moral issues with using faith to steal your hard-earned money. Keep reading our latest scam alerts to understand the new tactics these criminals use. Share this information with your community before someone else gets hurt.
