Selling on Facebook Marketplace or Gumtree and the "buyer" sends a link or a PayID email

Selling on Facebook Marketplace or Gumtree and the "buyer" sends a link or a PayID email

You list an old couch, a phone or a pram on Facebook Marketplace or Gumtree, and within minutes someone messages: "Is this still available? I'll take it, no need to inspect." It sounds like a quick sale. Then the conditions start: they've paid you through PayID but you need a "business account" to receive it, or they'll send a courier and you just need to enter your card on a link to "confirm the delivery". This is the fake buyer scam, and it targets sellers, not buyers. A buyer never needs your card details, a fee from you or a code to pay you.

How does the fake buyer scam work?

It has several variants, but it almost always follows the same steps:

• They pull you off the platform. The first move is to switch to text, WhatsApp or email. Outside the marketplace chat, the platform can't spot the scam and the scammer can send links freely.
• The fake PayID email. The best-known Australian version. The buyer says they've paid via PayID, and then you receive an email that looks like it comes from "PayID" or your bank saying the payment is "on hold" until you upgrade to a business account, or pay a fee. The buyer then asks you to send them that fee and promises to "add it to the payment". There's no payment and no upgrade: PayID doesn't work like that, and the email is fake.
• The fake courier link. They say they'll send a courier, sometimes naming Australia Post, and send a link to "arrange the pickup" or "receive the funds", where you're asked to enter your card. Australia Post warns that it won't ask you to click a social media message to organise a courier for a marketplace sale.
• They ask for codes. After you enter your card, your bank texts you a one-time code to approve a transaction. The fake site asks for it "to verify you're the cardholder". That code approves a payment from you, not to you.
• The overpayment. They claim to have paid too much (or added money "for the courier") and ask you to send back the difference. The original payment never existed.

What they all share is pressure: the buyer "is interstate", "the courier is coming today" or "the payment expires in 30 minutes". The rush is there so you don't stop to think.

How do I tell the buyer is fake?

• They want the item without seeing it, or without asking anything about it.
• They want to move the chat to text, WhatsApp or email.
• They mention a PayID "business account", upgrade or fee. Receiving a PayID payment doesn't cost you anything or need any upgrade.
• The payment email comes from "PayID", a Gmail address or a strange domain. Money paid to your PayID just appears in your bank account.
• They send a link to "receive the money" or "confirm the courier".
• They ask for your card details or a code. To receive money you only ever share your PayID or BSB and account number.
• The profile is brand new, has no history or uses a stock photo.

What do I do right now?

1. Keep the conversation on the platform and don't open any links.
2. Check your banking app yourself to see whether any money has arrived. Ignore emails and screenshots.
3. Never pay anything to receive a payment, and never enter your card or a code on a link.
4. Prefer cash or a confirmed payment on pick-up, in a public place, or let the buyer arrange and pay for their own courier only after the funds are visibly in your account.
5. Report the buyer using the platform's report tools and block them. Report the number in the spam numbers directory.

What if I've already entered my details or a code?

1. Call your bank now on the number on your card or in its app, and ask them to block the card and check recent transactions. If you shared a one-time code, say so: a payment may already be approved.
2. If you sent money for a "PayID upgrade" or "courier fee", tell your bank straight away and ask them to try to recall it. Banks like CommBank explain how to report scam payments.
3. Change your passwords if you entered any login details, and turn on two-step verification.
4. If you shared ID documents, contact IDCARE on 1800 595 160 for free help.
5. Keep screenshots of the chat, the buyer's profile, the email and any links.

Where do I report it?

• The marketplace: Facebook Marketplace and Gumtree both have reporting tools on the listing and the user profile.
• Police, through ReportCyber via the AFP's cybercrime page, if you lost money.
• Scamwatch, to help warn other sellers.
• Australia Post, if the scam impersonated it: forward the email or text to [email protected].

Frequently asked questions

Can someone rob me with just my card number? Card number, expiry and security code are often enough for online purchases, and with the one-time code they can approve almost anything. Never enter them to receive a payment.

The buyer says PayID "requires" me to upgrade my account. Is that true? No. PayID is free to receive into and is set up through your own bank. Any email asking you to pay an upgrade fee is fake.

Is it safe to sell in person? It's usually the safest option: meet in a public place, ideally during the day, take someone with you for valuable items, and check the payment has landed in your banking app (or take cash) before handing over the item.

The link came by text rather than through the chat. Does that change anything? No, it's the same scam through another channel. If anything, it's another warning sign: they've moved you off the platform.

In short

A fake buyer doesn't want your item, they want your card, your code or a "fee". Keep the chat on the platform, check payments only in your own banking app, and never pay anything to receive money. If you've already shared details, call your bank immediately and report it to ReportCyber and Scamwatch. And report the number in the NoCall spam numbers directory to warn other sellers.