Selling on Vinted, eBay or Facebook Marketplace and the "buyer" asks for my details or sends a link

Selling on Vinted, eBay or Facebook Marketplace and the "buyer" asks for my details or sends a link

You've just listed a jacket, a games console or a pram on Vinted, eBay, Facebook Marketplace, Gumtree or Depop. Within minutes, a very keen "buyer" messages you: they want it now, they'll pay the full price and they'll even sort out the delivery. Then comes the twist: they ask you to move the chat to WhatsApp or email, send you a link to "receive the payment" or "confirm the delivery", or ask for your card details. This is a scam aimed at sellers, and its goal is to steal your card details or get you to send them money.

How does the fake buyer scam work?

1. The quick, keen buyer. They message seconds after you list the item, don't haggle, and sometimes don't even ask about its condition.
2. Moving the chat elsewhere. "I don't use the app much, can you give me your number or email?" Off the platform, its protections and scam filters no longer apply.
3. The fake link. They send you a link that imitates Vinted, eBay, PayPal, Royal Mail, Evri or a "secure payment" service. It says the buyer has already paid and you need to "receive the money", "confirm your account" or "activate the sale".
4. The data grab. The fake page asks for your full card number, expiry date and the three-digit security code, sometimes even your online banking login. Then it asks for the code your bank sends you by text, "to confirm the payment in".
5. The variants. A fake email saying "the buyer has paid but you must send the item before the money is released"; a fake "payment confirmation" screenshot; a buyer who overpays and asks for the difference back; or a "courier" who will collect the item if you pay a fee.

With your card details and that code, they make purchases or link your card to a mobile wallet. You never receive any payment.

How do I tell the buyer is fake?

• They want to move the conversation off the platform (WhatsApp, text, email).
• They send you a link to receive money. To receive a payment you never need to enter your card's security code or any code from your bank.
• They ask for card details or texted codes. A seller never has to give their card details to get paid.
• The link's domain isn't the official one. Look closely: extra hyphens, odd endings, or names like "vinted-payment-secure".
• Urgency: "I need it today", "the payment expires in 30 minutes".
• New or empty profile, no reviews, sometimes an overseas number.
• They pay more than the asking price and ask you to send back the difference.

What do I do right now?

1. Don't tap the link and don't enter any details.
2. Keep the whole conversation and the payment inside the platform. Vinted, eBay and similar sites handle payment and delivery labels within their own apps; read their help pages if you're unsure how a sale works.
3. Check your account by opening the app or website yourself, not through links. If a payment has really been made, you'll see it there.
4. Report the profile to the platform and block the user.
5. For sales in person, take cash or check the money has actually arrived in your banking app before handing the item over. Don't rely on a screenshot.

What if I've already entered my details or a code?

1. Call your bank immediately on 159 or the number on the back of your card. Ask them to block your card and check for unrecognised payments or new cards added to mobile wallets.
2. If you entered your online banking password, change it from a safe device and tell your bank.
3. If you sent money (a fee, a "difference" or the item's postage), ask your bank to try to stop or recover it. If you were tricked into a bank transfer, ask about reimbursement under the authorised push payment scam rules.
4. If you used the same password elsewhere, change it.
5. Keep screenshots: the conversation, the link, the profile and any payments.

Where do I report it?

• The platform: report the user and the conversation from inside the app.
• Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101, especially if you've lost money.
• The fake website: report it to the NCSC through its scam website reporting service. Scam emails can be forwarded to [email protected] and scam texts to 7726.
• NoCall: if they contacted you by phone or text, report the number in the spam numbers directory.

Frequently asked questions

Can someone rob me with just my card number? With the full number, expiry date and security code, they can attempt online purchases. With the code your bank texts you as well, they can confirm payments or add your card to a wallet. That's why you never give any of it to receive money.

The buyer says the platform "requires" me to verify my card. Is that true? No. If a platform ever needs anything from you, you'll see it inside the official app, never through a link a buyer sends you.

Is it safe to sell in person? Generally safer, if you meet in a busy public place and get paid in cash, or confirm the transfer has actually arrived in your banking app before handing over the item.

The link came by text rather than through the chat. Does that change anything? No: it's the same scam. Platforms don't send payment links by text. Forward it to 7726 and delete it.

In short

To receive money for something you're selling, you never have to enter your card details or any code. Keep the sale inside the platform, ignore links and buyers in a hurry, and if you've already entered your details, call your bank straight away. And if a "buyer" has contacted you by phone or text, report the number in the NoCall spam numbers directory: your warning could save another seller.