Buying and Selling Online: The Three Classic Scams

Facebook Marketplace, Kijiji, and Craigslist are genuinely great for buying and selling locally. They’re also full of three recurring scams that have been the same for a decade. If you buy or sell online even occasionally, you will see one of these in your DMs. Here’s what they look like and the one habit that defeats all three.

• Anyone selling furniture, electronics, or anything valuable on Facebook Marketplace or Kijiji

• Anyone buying used items, especially from a seller they haven’t met in person

• Older adults who are newer to the platforms

• Newcomers to Canada navigating used-item marketplaces for the first time

• Students moving in or out of rentals, who list a lot of furniture quickly

• Small business owners who use Marketplace to source inventory or sell excess stock

Sellers get targeted more often than buyers, but both are at risk.

Three classic scam patterns. Learn the shapes and you’ll spot the rest.

Scam 1: The overpayment check

1. You list something expensive. A used couch, a bike, a camera.

2. A “buyer” messages from far away, super keen. They want to buy sight unseen.

3. They offer to send a cheque or e-transfer for more than the asking price.

4. They ask you to deposit the money, then forward the extra to their “mover” or “shipping agent”.

5. You wire the extra. A few days later, the original cheque bounces or the e-transfer is reversed as fraud. You’re out the difference.

The classic version uses physical cheques. The modern version uses e-transfers that get clawed back.

Scam 2: The fake shipping label

1. You list an item for sale. A “buyer” messages, again from far away.

2. They ask you to ship it. They’ll send a shipping label by email.

3. The label link is actually a fake login page for Canada Post, UPS, or FedEx. They ask you to log in to “print the label”.

4. You enter your credentials. They steal them. Sometimes they also ask for your credit card to “cover shipping”. That goes to them too.

5. If you actually do ship the item, they dispute the payment with their bank and you lose both the item and the money.

Scam 3: The “is this still available” link

1. You list something. Within minutes, a generic message arrives: “Hi, is this still available?”

2. When you reply yes, they say they’re interested but need to “verify you’re a real seller”.

3. They send a link to a Google Voice verification code, or a fake identity-check service.

4. You type in the code they sent. You just helped them create a Google Voice number using your phone. They’ll use it to scam other people while the number points at you.

5. Sometimes the link is a fake login for Facebook or Kijiji itself, and they steal your account to run more scams.

• A buyer or seller who won’t meet in person, won’t do a video call, or lives far away for no good reason

• Any offer above your asking price

• Any request to wire money, forward money, or buy gift cards

• Any “verification” process that involves a link or a code sent to your phone

• A message pushing urgency: “I need to ship today, can we do it now?”

• A listing that’s priced too low for a hot item, especially if they ask for a deposit to “hold” it

• A listing with photos obviously taken from somewhere else (reverse-search the image on Google)

• Sellers asking you to pay outside the platform. Facebook Marketplace, Kijiji, and similar platforms have protections that only work if you keep the transaction on-platform.

• Buy and sell in person, in cash, in public. The single rule that defeats all three of these scams. Meet at a coffee shop, a bank lobby, or a police-station parking lot (many have “safe exchange zones”). Hand over cash, hand over the item, done.

• Never share a verification code. Not from Google Voice. Not from Facebook. Not from a shipping company. A code sent to your phone is meant for you only.

• Never wire money or buy gift cards for a “buyer” or “seller”. Real people don’t ask for either.

• Don’t ship items you sold to a stranger online. If shipping is truly needed, use the platform’s built-in shipping (Marketplace Shipping, eBay Labels) which protects both sides.

• Verify listings before you send deposits. Reverse-search the photo. Check the seller’s profile age. Ask to do a quick video call. Real sellers won’t mind.

• Use a separate email for Marketplace listings. A dedicated Gmail address keeps scam emails out of your main inbox and makes it easy to shut the address down if things get bad.

• If you already fell for one. If you forwarded money, contact your bank or e-transfer service immediately. If you entered credentials anywhere, change the password and check haveibeenpwned.com. If someone took over your Facebook or Kijiji account, start the recovery process through the platform’s help centre right away.

• Report the scam. In Canada, call the Canadian Anti-Fraud Centre at 1-888-495-8501. In the US, the FBI’s IC3. Also report the profile to the platform so they can ban it.

The three scams change details every few years. Ship by UPS instead of Canada Post. E-transfer instead of cheque. Google Voice codes instead of Venmo requests. The shapes don’t change. Meet in person, pay in cash, never share a code that was sent to your phone, and you’re safe from almost every version of these.

For a broader look at the phishing patterns behind these scams, our free course How Not to Get Phished walks through the 4-step check in under 30 minutes.

Have you been hit by a new variation? Reply to the Phended Security Blog or ping Dave and we can help warn others.