Wallapop-style Second-hand trading apps are sometimes used to commit scams, and as users increasingly they are more cautious, new systems emerge. In this case, manage the sale by email posing as DHL to obtain the data of the credit or debit cardof user.
We are talking about a quite sophisticated mechanism, which has begun to be used in Wallapop, but which would also work in Vibbo or Milanuncios. The scam begins when someone is interested in a product that we have for sale, and proposes to communicate by email for the deal, with a message of this type:
"Hello is this item still for sale? if so please confirm me call your name personal email: ([email protected]) thank you."
The poor mail syntax should make us wary, possibly an automatic corrector has been used. In addition, by continuing trading outside the app we will not be able to use Wallapay, Wallapop's secure shipping and payment system.
Although managing sales outside of Wallapop is usually cheaper for us, it also reduces protection, and in cases of scams this is risky.
The Spanish Internet User Security Office (although fraud could occur in more countries) has verified that after sending the first email they will begin to request personal data, including name, physical address, telephone and email.
The arguments vary, but in any case the scammer claims that he will buy the product, trying to gain our trust, so he requests the address for the item's collectionand ensures that the courier agency DHL will take care of everything.
If we send you this information, you will reply to us by email posing as DHL. The Wallapop scam adds phishing as an additional element, that is, they try to impersonate a well-known company to reduce mistrust.
When receiving the false email from DHL is where the deception is discovered. In order for them to pick up the package and deliver the money paid by the buyer, they require us to verify the account by means of a bank card, or even a prepaid card for online purchases, in the style of Paysafecard.
If you look closely, the email header belongs to a Gmail address instead of the domain dhl.com:
Of course, we must not provide the credit or debit card, because the Wallapop purchase is not real, and they could make us unauthorized charges. If we have given the card number by mistake, we must contact the bank as soon as possible to cancel it.
In fact, it's best to don't give any personal information, and keep negotiating from the Wallapop chat. Even if we skip Wallapay, it is always safer not to communicate through external means.
In these cases the appropriate thing to do is report the scammer on Wallapop, so that they close your account, but you will probably reopen it.
When it comes to the courier impersonating DHL, expressions like "make sure you're honest" or "the delivery man can move with you" sound very strange. Although some scams use perfect Spanish, in other cases they can be identified by their poor command of the language:
If we still have doubts about the use of the second-hand platform, we have already explained how to sell on Wallapop, a simple process that is preferable to manage through the app, unless the person purchased lives in our same city and we can deliver the item by hand.
In any case, when using Wallapop and other buying and selling services we must be distrustful, and avoid any proposal that is too good or strange for For whatever reason, we already see that cybercriminals even impersonate companies like DHL to deceive us.
Have you been surprised that they impersonate DHL to facilitate scams on Wallapop? Are you worried about online crime?
