Wallapop is once again at the center of news because together with Vinted or Airbnb they will have until April 6 to present to the Treasury the information of their sellers who annually carry out more than 30 operations for the sale of goods with an import of more than 2,000 euros. It is a time of great activity on these platforms and an opportunity for cyber scammers. In the case of Wallapop, it is not the first time that its identity has been impersonated to try to be the seller, especially if it is new. They look for your credentials and bank card details.
The Wallapop ‘newbie’ scam
When two people agree on Wallapop, one to sell and the other to buy, the option appears to send the product instead of delivering it in person. In this way, the payment is made in an online transaction, the amount of which is received by the seller once the product has been delivered.
This method of sale by shipment requires the buyer to press the pay button and enter the payment method information and a delivery address, which can also be a post office. For his part, the seller will deposit the agreed money into a wallet or bank account.
It is a simple process that, however, for people who use it for the first time can raise certain doubts, which is precisely what cybercriminals take advantage of in a new scam that takes advantage of the sale with shipping to steal your account data and your Card to the seller. The scammer will answer the usual questions of a good buyer by asking you about the condition of the product, the price, possible discounts… until the shipment is accepted.
The problem comes later, when the seller marks the product as reserved, at which point the cybercriminal, if he has detected that the victim has not been using the ‘app’ for a long time or it is the first time he has made a shipment, will try to deceive him. In this case, he will pretend to bring his experience in using Wallapop to help, pointing out, for example, that the seller has not done the registration of his account correctly and that is why he is not allowing him to make the payment. In fact, he claims that it is because the email is missing and even goes so far as to ask the victim to tell him the ’email’ with which they registered.
If the victim gives it to them, they will receive a communication supposedly from Wallapop in their inbox, stating that “the system has successfully reserved your item for sale” and that to confirm the order they must click on the button that is included. By doing so, you are redirected to a ‘completion of order’ page that “almost perfectly emulates the legitimate Wallapop site on the Internet”, as Panda Security pointed out months ago.
On this page, the seller finds options that instantly confirm the email, reset the password or confirm the credit card to make payments. However, this is a carefully designed site to get the full card number, expiration date and CVV code.
