Selling on Trade Me or Facebook Marketplace and the "buyer" wants your details or sends a link

Selling on Trade Me or Facebook Marketplace and the "buyer" wants your details or sends a link

You've listed an old couch, a bike or a phone on Trade Me or Facebook Marketplace, and almost straight away a "buyer" gets in touch. They don't haggle, they don't ask about the item, they just want to buy it. Then comes the twist: they send a link "to receive your payment", "to confirm the courier" or "to verify your account", or they ask for your card details so they can "pay you". It's a scam aimed at sellers, and its goal is your card, your banking login or the codes your bank sends you.

How does the fake buyer scam work?

• They pull you off the platform. The first move is to take the conversation to WhatsApp, text, Messenger or email. Outside the platform's own messaging, it can't detect the scam or protect you, and the scammer can send you whatever they like.
• They send you a fake link. The page copies the look of Trade Me, Facebook, NZ Post or a courier company. It says the payment is "on hold" or "awaiting confirmation" and that, to release it, you need to enter your card details or log in to your internet banking.
• They ask for codes. After you enter your card, you get a text from your bank with a code to authorise a payment. The fake page asks for it "to verify you're the cardholder". That code is your signature: with it, they spend your money or add your card to their own phone wallet.
• The overpayment version. They claim they've paid you too much by mistake (or extra "for the courier") and ask you to send back the difference. The original payment never existed: they send a fake screenshot or a fake email "from your bank".
• The courier version. They're "overseas" or "away for work" and will send a courier to pick the item up, but you need to pay the courier fee first through their link, supposedly to be refunded with the payment.

How do I tell the buyer is fake?

1. They want to move to WhatsApp, text or email straight away, for no clear reason.
2. They don't ask anything about the item and don't negotiate. They don't care what they're buying.
3. They send you a link to get paid. To receive money you don't need to enter anything on an external website.
4. The web address isn't the official one. Addresses with hyphens, extra words ("secure-payment", "delivery-confirm") or odd endings. Look carefully, not at a glance.
5. They ask for your card number, CVV, PIN or text codes. To pay you by bank transfer, a buyer needs at most your account number. Never your card details or a code.
6. A brand-new profile or one with no feedback, often with a generic name and no photo.
7. Urgency and pick-up excuses: a relative will collect it, a "private" courier, shipping overseas.

What do I do right now?

1. Don't open the link or enter any details. If you opened it but didn't type anything, close it; just opening it usually does no harm. If you're unsure, Own Your Online's scam check can help you decide.
2. Keep the conversation on the platform. If the buyer is genuine, they'll happily use the platform's own messaging and payment options, pay by bank transfer, or pay cash on pick-up. If they refuse, you have your answer.
3. Check payments only in your own internet banking, logging in yourself through your bank's app, never from a link you've been sent. Don't hand over the item until the money has actually cleared into your account, not just appeared in a screenshot or an email.
4. Save evidence: screenshots of the chat, the number or profile, the link (copy it as text, without opening it) and the date.
5. Block and report the profile on the platform, and the number in WhatsApp or on your phone. That way the platform can remove the account before it targets other sellers. If the link arrived by text, forward it free to 7726, the Department of Internal Affairs' scam-text service.

What if I've already entered my details or a code?

1. Call your bank immediately on the number on the back of your card or in its official app. Ask them to block the card and review recent transactions.
2. Dispute any charges you don't recognise as unauthorised and ask how to claim them back. The sooner you do it, the better your chances.
3. If you logged in to your internet banking on the fake page, tell the bank and change your password straight away.
4. Change your passwords for your Trade Me or Facebook account and your email, and turn on two-step verification.
5. If you shared a WhatsApp code, someone may try to take over your account: open WhatsApp, turn on two-step verification and warn your contacts to ignore any requests for money.
6. Watch your accounts over the following weeks. Your details may be reused in calls pretending to be your bank.

Where do I report it?

• NZ Police: if you've lost money, report it on 105 or through the 105 online service on the NZ Police website, with all the screenshots, the link and your bank statements. The bank may ask for the Police reference.
• The National Cyber Security Centre: report the scam or phishing link to the NCSC.
• The platform itself: report the profile and the conversation using its reporting tools.
• Consumer Protection's Scamwatch for advice on online trading scams.
• 111 only if there's a real emergency, for example threats or someone turning up at your home.

Frequently asked questions

Can someone rob me with just my bank account number? Not on its own: account numbers are meant to be shared so people can pay you. The danger is giving out card details, passwords or the codes your bank texts you.

The buyer says the platform "requires" me to verify my card. Is that true? No. You'll never be asked to verify your card through a link sent by a buyer. Any account checks happen inside the platform's own app or website, which you open yourself.

Is it safer to sell in person? Selling face to face with cash or a bank transfer you've seen clear is usually safer. Meet in a public place in daylight, or take someone with you, and don't hand over the item until you've been paid.

The link came by text rather than through the chat. Does that change anything? No, if anything it's another warning sign. Platforms don't send payment links by text.

In short

When you're selling, the scam isn't that someone won't pay: it's that they'll get you to hand over your card, login or codes. Keep the conversation on the platform, never open payment links, and check payments only in your own internet banking. If you've already entered details, call your bank now and report it to Police and the NCSC. And report the number in the NoCall spam numbers directory.