Week 13: Phishing emails target first-time sellers on classifieds platforms

31.03.2026 - Last week, Cybercrimepolice.ch reported that scammers are currently specifically targeting listings on online marketplaces. In this context, the NCSC has observed another, previously little-known scam: people listing an item on Ricardo for the first time are being targeted with highly convincing phishing emails. The messages feature the platform's official logo, are well written, and appear to be a legitimate security measure from Ricardo. Anyone unfamiliar with the platform is unlikely to recognise the scam at first glance.

The NCSC regularly receives reports of scams and phishing on online marketplaces such as Ricardo, whether people are buying or selling items. What is new is that the scammers are now specifically targeting people who are listing an item on Ricardo for the first time. As soon as a new listing appears on Ricardo, the attackers – posing as interested buyers – contact the seller. This supposed interest in the item serves only to gather information about the seller and set the actual scam in motion.

If you are targeted, you receive an initial email that looks deceptively genuine and appears to come from Ricardo. The message says your account needs to be verified and frames this as a standard security check for first-time sellers. It also tells you that you must reply to the email before you can complete the sale. As soon as you reply, you receive a second message, which includes a link or a QR code that you are asked to use to verify your bank details. If you follow the link or scan the QR code, you end up on a phishing website.

In other cases, the attack works a little differently. Instead of taking you to a fake website straight away, the link in the second email opens a WhatsApp chat. There, the scammers pose as official Ricardo support. They continue to pressure you, again claiming that security checks are required before your first sale can go ahead. Eventually, they send you a link to a phishing website designed to steal your login details.

Screenshots of scam emails that were supposedly sent by Ricardo.

Victims targeted deliberately

The method is tactically smart. First-time sellers usually have little experience with the platform and are not yet familiar with its usual communication processes. The scammers systematically exploit this lack of experience. The platform itself also facilitates this: on Ricardo, anyone can publicly see how long an account has existed and how many items a person has listed so far.

The NCSC believes that scammers systematically analyse this information to identify people who have recently registered on the platform, with the aim of targeting those who have little or no experience of selling. This does not require any special technical expertise. It simply involves regularly checking publicly available profile information and identifying those who have recently registered and have very few previous listings.

Recommendations

If you receive an unexpected verification email after posting a listing on an online marketplace, be cautious. Do not click on any links in such emails.
Only log in via the official website or app and check your account status there.
Be suspicious of emails that create a sense of urgency and pressure you to act immediately.
If you have already entered any details, change your password immediately and contact Ricardo directly.
Report any suspicious messages or activity to the classified ad platform. They can block scam ads, buyers and sellers.