The scams to watch for
1. The PayID "upgrade" scam
Common on Facebook Marketplace and Gumtree. A "buyer" says they've paid by PayID, then you get a fake email saying your account must be upgraded to a business account and you need to send money first. Westpac warns: "You should never be asked to pay a fee to access PayID." Check your own banking app: if the money isn't there, it hasn't been paid.
2. Fake "you've been paid" emails and links
A message says you've been paid, with a link to "confirm the sale". The link leads to a fake page that steals your card or login details. Real payments show in the app itself. Vinted says its emails come from an address ending @vinted.com.au, and eBay explains how to spot fake emails.
3. "Can I pay you another way?"
On Vinted, eBay and Depop, a buyer who wants to pay outside the app is a warning sign. If you agree, you lose the platform's protection.
4. "Message me on WhatsApp"
Moving the chat off the platform means nothing is recorded where the platform can see it. Keep all messages in the app.
5. "The box was empty" or "it never arrived"
Your best defence is evidence: use tracked postage, and take photos or a short video of the item being packed and sealed.
6. "Please send it to a different address"
Only ever post to the address on the order or the platform's label.
Protect yourself before every sale
- Describe the item honestly, flaws included, with clear photos.
- Photograph the item as you pack it, and photograph the sealed parcel and label.
- Keep proof of postage until the order is complete.
- Keep every message and payment inside the app, or for local sales, take cash or check the transfer has arrived before handing anything over.
- Never share codes sent to your phone or email. No real buyer needs them.
If something goes wrong
- Tell the platform first. Report the buyer or message in the app. eBay asks for fake emails to be forwarded to spoof@ebay.com.au.
- If you've lost money or given card details, contact your bank straight away and ask them to stop any transactions.
- Report the scam to Scamwatch. For cybercrime such as stolen money or personal information, you can also make a police report through ReportCyber.
- If your identity details were taken, IDCARE can help.
- If you entered a password on a fake page, change it at once, and anywhere else you use it. Turn on two-step verification.