Almost every scam on Wallapop and Vinted begins with the same demand: move the conversation elsewhere. A buyer who prefers WhatsApp, a link to “receive” a payment, a courier that is supposedly cheaper than the platform’s own service. Once a user accepts, the protection that makes a marketplace safer than a classifieds board vanishes. TechNews DevTop examines the most repeated tricks and what to do if card details have already gone to the wrong place.
- Stay in the app: Scammers need you to move messages, payment or shipping elsewhere.
- Sellers face fake payment links: A “buyer” claims to have paid and asks for card details.
- Buyers lose cover outside the buy button: Vinted holds payment; Wallapop’s integrated shipping records the deal.
The seller trap: the buyer who says the money is already sent
The most widespread trick against sellers is a buyer who moves the chat to WhatsApp or email, says payment has been made and sends a fake link to collect the funds. The page imitates the marketplace and asks for card details so the money can be “received”. INCIBE, Spain’s cybersecurity institute, has documented the pattern: the supposed buyer claims payment is done and supplies a link impersonating the platform. Entering card data lets criminals make charges; INCIBE even mentions cryptocurrency purchases.
An older variant still works. The fake buyer asks to continue by email, requests a name, address and phone number to arrange a pickup, and then a message impersonating DHL arrives asking for bank details or the purchase of prepaid cards to “complete the shipment”.
Warning signs recur: the buyer wants to talk off-platform immediately; the account is new, with no ratings or verified profile; the buyer offers to pay more than the asking price and cover shipping; or asks for card details to pay. The rule is simple: nobody needs your card’s security code to send you money. Wallapop says it only requests bank details when a user validates the Monedero inside its app or website, and it does not contact users via external private messages. If “Wallapop” writes on WhatsApp with a link, it is not Wallapop.
The buyer trap: protection exists only inside the buy button
For buyers, the main risk is paying outside the platform — by transfer or person-to-person payment — to someone who never ships. The marketplace cannot intervene because the purchase does not exist in its system. Vinted makes this clear: a purchase is protected when the buyer uses the “Comprar” button. Payment is held until the order arrives and the buyer confirms it is fine. If the item does not arrive, arrives damaged or does not match the description, Vinted issues a refund. The claim window is 2 days.
Wallapop applies the same logic. According to company data, the most frequent scam it detected in 2025 was closing payments or shipping outside the platform. Its Wallapop Envíos service exists to keep distance purchases recorded and protected. The excuses are always similar: saving the commission, using a faster courier, or getting a discount for paying directly. Any saving of a few euros disappears when the parcel never arrives.
If you have already fallen for one of these scams
If card details were handed over, call the bank immediately to block the card, then gather evidence and file a complaint, as INCIBE advises.
- Block the card. Contact your bank once you suspect card number, expiry date and security code were entered on a fake site.
- Preserve evidence before deleting anything: chat screenshots, the supposed buyer’s phone number or address, the link received and any receipts.
- Report the fraud to the Policía Nacional or the Guardia Civil with that evidence, as INCIBE advises.
- Report the user inside the app so the platform can block the profile.
- If you paid inside the platform and the problem is shipping, open a claim in the app and respect the deadlines: Vinted gives 2 days.
What platforms can do — and what they cannot
Wallapop says that 90% of potentially fraudulent listings and profiles are blocked before they become visible or removed without receiving reports, and that in 2025 it resolved 85% of reports in under 4 hours. These are company figures, not independently audited. Reporting still helps: it feeds the filters that catch the next fake listing.
A Wallapop survey offers a more troubling number: 74% of respondents admitted they do not feel able to identify a cyber scam. Platforms can filter listings, but they cannot stop a user from clicking a WhatsApp link. The defence that works is almost boring: everything, from the first message to payment and shipping, stays inside the app. If someone insists on leaving, their purpose is already clear.