Is a Mystery Box Legal in India?

The line that actually matters

Most articles on this question get lost in terminology (loot box, mystery box, surprise bundle, blind box), as though the name determines the legal status. It does not. There is one structural question that does almost all the work:

Is there an outcome where you hand over money and receive nothing of value in return?

If yes, you are in the territory of games of chance, and the regulatory picture across Indian states becomes complicated fast. If no (if every single transaction returns a product of at least the value paid), then what you have is a retail sale where the composition of the goods is randomised. That is a very old and entirely ordinary commercial format. Trading card packs, gachapon machines, blind-box collectibles and surprise toy eggs have all operated on it for decades.

The randomness in a legitimate mystery box governs which product you get. It does not govern whether you get one. Those are different things, and conflating them is where most of the confusion in this category comes from.

What Indian law says

India regulates gambling primarily at the state level, under a framework descending from the Public Gambling Act of 1867, with individual states legislating their own positions, which is why the picture varies so much between, say, Goa and Telangana. The recurring statutory concept across those laws is wagering: staking money on an uncertain event, where you may win and may equally lose your stake.

A guaranteed-minimum product bundle does not fit that description, because the stake is never lost. You have made a purchase, and you have received goods. The consumer-protection question that remains is a different and more mundane one: were the terms disclosed honestly before you paid? That falls under the Consumer Protection Act 2019 and its e-commerce rules, which is really a question about transparency rather than legality.

Practically, this means a mystery box operator has three obligations worth holding them to: publish the odds, guarantee the minimum value, and describe the products accurately. An operator doing all three is running a retail business. One doing none of them may be running something else, whatever the label on the page says.

This is general information, not legal advice. If you are planning to operate a mystery box business rather than buy from one, get an Indian lawyer to look at your specific structure. State-level variation is real and matters.

How to spot the WhatsApp scams

Here is the thing worth understanding: the most common "mystery box" fraud in India is not a badly-run mystery box. It is not a mystery box at all. It is a phishing operation borrowing the vocabulary, and it looks nothing like a retail purchase once you know the shape.

The pattern arrives as a forwarded WhatsApp or Instagram message, claims to come from Amazon or Flipkart directly, and tells you that you have already won. What follows is one of three asks:

• Share this with ten contacts to unlock your prize. This is the propagation mechanism. No commercial business distributes rewards through forwarded messages, because it cannot bill anyone.
• Log in here to claim. The page harvests your Amazon or Flipkart password. There is no legitimate reason any third party ever needs your platform credentials.
• Pay a small release fee to this UPI ID. Payment to a personal UPI handle rather than a payment gateway, for a prize you supposedly already won. Both halves of that are wrong.

Notice what all three have in common: you were contacted first, and you had not bought anything. A real mystery box is something you decide to buy, on a website, at a stated price, before anything is revealed. If the reward came before the purchase, it is not a mystery box. It is bait.

A five-point legitimacy checklist

Applicable to any mystery box site in India, including this one. Check them rather than taking anyone's word:

1. Are the odds published? On a public page, as specific numbers. "Great chances of winning" is not published odds. Ours are on the rewards page.
2. Is there a guaranteed minimum value? Stated plainly, with the lowest-tier product described. If the site is vague about what the common outcome is, that is the answer.
3. Does payment go through a regulated gateway? Razorpay, PayU, Cashfree. You should see the gateway's own screen. A personal UPI ID is a serious warning sign.
4. Is the refund policy written down? With a window, a process, and what does and does not qualify.
5. Does it claim to be an official brand partner? Almost none are. A site claiming an official Amazon partnership for a ₹20 box is very likely lying about something.

A site that passes all five may still not be worth your money. That is a value judgement, and we would rather you make it with the actual odds in front of you. But a site that fails two or more is not one to hand money to.

The verdict

Mystery boxes with a guaranteed minimum value are legal in India, because no outcome exists in which the buyer loses their money. Mystery boxes where you can end up with nothing sit in much murkier territory, and unsolicited "you have won" messages are not mystery boxes at all. They are phishing.

The distinction is not subtle once you know to look for it, and it is worth applying to every site in this category, ours included.

Frequently Asked Questions