Selling on Wallapop or Vinted and the "buyer" asks for my details or sends me a link

You list something you no longer use on Wallapop, Vinted or Milanuncios (popular second-hand marketplaces in Spain; the same scam runs on eBay, Facebook Marketplace and similar sites everywhere) and, within minutes, an enthusiastic buyer appears. They don't haggle, they ask nothing about the item and they're in a big hurry. They ask for your WhatsApp or email "to make it quicker" and, soon after, send you a link: "I've already paid you, go here to receive the money" or "I've booked the courier, confirm your details so they can collect". If you open it, you'll see a page identical to the platform's asking for your card number, expiry date and CVV. That isn't a payment to you: it's theft. And the rule that dismantles the whole thing is simple: to receive money you never have to give your card details or any code.

How does the fake buyer scam work?

The scheme has variants, but it almost always follows the same steps:

• They pull you off the platform. The first move is to switch the conversation to WhatsApp, SMS, Telegram or email. Outside the official chat, the platform can't detect the scam or protect you, and the scammer can send you links without any filtering.
• They send you a fake link. The site copies the design of Wallapop, Vinted, Milanuncios, the postal service or a courier company. It says the payment is "on hold" or "awaiting confirmation" and that, to release it, you must enter your card. With that data they make purchases or charges in your name.
• They ask for codes. After you enter your card, you get an SMS from your bank with a code to authorise a transaction. The fake site asks for it "to verify you're the cardholder". That code is your signature: with it you authorise a payment, not a receipt.
• The Bizum variant. Instead of sending you money, they send you a Bizum request (Bizum is Spain's mobile-to-mobile payment system; other countries have equivalents) and tell you to accept it to receive the money. If you accept it, you're the one who pays.
• The "overpayment" variant. They claim to have paid you too much by mistake (or "for the courier") and ask you to send back the difference. The original payment never existed.

What they all have in common is pressure: the buyer "is going away", "the courier comes today" or "the payment expires in 30 minutes". The rush is there so you don't stop to think.

How do I tell the buyer is fake?

No single sign is proof, but several together are a fairly reliable diagnosis:

1. They want to continue on WhatsApp, SMS or email right from the start, for no clear reason.
2. They ask nothing about the item and don't negotiate the price. They don't care what they're buying.
3. They send you a link to get paid. Platforms handle payment and shipping inside their own app; money isn't "collected" on an external website.
4. The domain isn't the official one. Addresses with hyphens, added words ("secure-payment", "confirm-shipping") or odd endings. Look at it calmly, not at a glance.
5. They ask for your card, CVV, PIN or SMS codes. To receive money you need at most your bank account number (IBAN), and only if you're selling outside the platform. Never the CVV or a code.
6. A new profile or one with no reviews, often with a generic name and no photo.
7. Urgency and logistics excuses: a relative will pick up the parcel, a "private" courier, shipping abroad.

What do I do right now?

1. Don't open the link or enter any details. If you opened it but didn't type anything, close it; just opening it usually does no harm.
2. Go back to the platform's official chat. If the buyer is genuine, they'll agree to buy using the built-in payment and shipping system. If they refuse, you have your answer.
3. Check payments only inside the app or in your online banking, logging in yourself through the official app, never from a link you've been sent.
4. Save evidence: screenshots of the chat, the number or profile, the link (copy it as text, without opening it) and the date.
5. Block and report the profile on the platform, and the number on WhatsApp or your phone. That way the platform can remove the account before it tries other sellers.

What if I've already entered my details or a code?

Don't blame yourself: these sites are very well made. What matters is speed:

1. Call your bank immediately on the number on the back of your card or in its official app. Ask them to block the card and review recent transactions.
2. Report any charges you don't recognise as unauthorised transactions and ask for a refund to be processed. The sooner you do it, the better your chances. We explain this in how to recover money from a phone scam.
3. If you accepted a Bizum request (or a request in any similar payment app), tell your bank too: Bizum works through it. More details in the Bizum scam.
4. Change the passwords for your platform account and your email, and turn on two-step verification.
5. If you shared a WhatsApp code, someone may try to take over your account: open WhatsApp, turn on two-step verification and warn your contacts to ignore any requests for money.
6. Keep an eye on your accounts over the following weeks. Your details may be reused in calls pretending to be your bank; before acting, learn how to check whether a call or SMS from your bank is real.

Where do I report it?

• In Spain, the Policía Nacional (091) or the Guardia Civil (062): file a report with all the screenshots, the link and your bank's statements. The bank may ask you for it to process the claim. Elsewhere, report it to your national police.
• In Spain, INCIBE on 017: a free, confidential cybersecurity helpline. They'll advise you on what to do, and on the website of its Internet User Security Office (OSI) you can check alerts about active campaigns. Elsewhere, contact your national cybersecurity agency or fraud reporting service.
• The platform itself: report the profile and the conversation from its app.
• 112 (the European emergency number) only if there's a real emergency, for example threats or someone turning up at your home.

And if the contact came from a phone number, add it to the spam numbers directory so other sellers can recognise it.

Frequently asked questions

Can someone rob me with just my card number? With the number, expiry date and CVV, purchases can be made online, especially if they also get the confirmation code your bank sends you. That's why these sites ask for everything together. Never share it to get paid.

The buyer says the platform "requires" me to verify my card. Is that true? No. If the platform needed something from you, it would ask inside its official app, not through a link a stranger sends you on WhatsApp.

Is it safe to sell in person? Meeting in a public place and getting paid in cash or through the platform's system is reasonable. Be wary of any "proof of payment" sent as a screenshot or email: what counts is the money you see in your account or in the app.

The link came by SMS rather than through the chat. Does that change anything? No. The channel changes, the trap is the same. It's the same logic as the fake parcel delivery SMS.

In short

When you're selling, the money comes to you: you never have to pay, enter your card or give codes to receive it. Keep the conversation and the payment inside the platform, be wary of rushing and of links, and if you've already entered details, call your bank before anything else and report it afterwards. If you want an extra warning about suspicious numbers and texts, NoCall helps you identify who's on the other end before you reply.