Vinted: The classifieds portal wants to make it harder for scammers

Enlarge image

App Vinted: The company says it never asks for an email address or phone number after a sale is over

Photo: Hans Lucas / IMAGO

In the forum of one of the largest second-hand platforms in Germany, users try to protect themselves.

In posts with titles such as "phishing fraud / data rip-off," members of Vinted warn each other about scams circulating on the platform, including one that the Lower Saxony State Criminal Police Office (LKA) recently pointed out.

Criminals pretend to be people interested in buying, but invent additional steps in the payment process or payment problems that supposedly can only be solved when the seller takes action.

The aim is to persuade sellers to enter their credit card details, including the control number, on prepared websites.

According to the LKA Lower Saxony, some of these sites even have live chats in which the scammers pretend to be support staff.

The data transmitted in that pressure situation then ends up in the hands of the fraudsters - who use it to shop elsewhere.

The scammers usually report such scams via the platform's messaging system.

But then they try to shift the communication away from the original platform such as Vinted or Ebay classifieds, for example by asking users for their e-mail addresses under pretense.

They then bombard these addresses with phishing emails that appear to come directly from the platform.

When asked by SPIEGEL, the LKA Lower Saxony said that since the beginning of the year it has become aware of a low three-digit number of fraud cases in its own state alone that are related to Vinted.

So far in the current year there has been a slight increase in the number of cases compared to 2021.

A sometimes overlooked giant

The classifieds portal is the successor to the platforms Mamikreisel and Vinted Circles, which primarily appealed to women.

Vinted, which deliberately comes with a gender-neutral name, has eleven million registered users in Germany alone.

Clothing is sold there, but also toys and technical accessories, for example.

Making your first purchase or sale on Vinted is easy.

However, the platform hardly prepares new members for the fact that, with a bit of bad luck, you can quickly run into criminals there, apart from a subpage of its help area.

In its welcome messages to new members, Vinted prefers to encourage them to post an offer and invite friends to the platform.

In response to a SPIEGEL query about the scam described by the LKA Lower Saxony, Vinted said it could confirm that there were phishing attempts on its own platform.

Sellers were asked for their payment card details after giving fraudsters their personal email address.

The scammers would have pretended to be the buyer.

"This can happen when the victims leave the platform and accept the scammers' invitation to trade outside of Vinted's protected payment system," says Vinted.

The company therefore advises its users to always communicate directly via Vinted and not to carry out transactions outside of their own platform.

Likewise, Vinted emphasizes that it never asks for an email address or a phone number after the end of a sale.

For payment, you also “never send e-mails or private messages that contain a request to share payment information in an external link”.

Vinted wants to do more to keep its users safe

In view of the phishing attempts he is aware of, Vinted has apparently decided to raise the awareness of its users for the topic.

"In order to sensitize members to the risk of increasing phishing activities on the Internet, the company will provide active members with further information on how to recognize phishing attempts and fake news and how to protect themselves against them," the service writes to SPIEGEL.

According to the company, “inbox messages to active and new members that draw attention to potential phishing attempts” are planned in Germany.

"It also includes tips on how users can trade safely on Vinted." In addition, a separate help center article on the subject of phishing is in the works, "which uses examples to demonstrate what potential phishing attempts look like".

According to Vinted, those measures should start in the next two weeks.

In principle, the platform could probably do a lot more to at least make popular scams more difficult.

So far, for example, no warning has appeared if users send email addresses to each other via chat.

On the other hand, if you are sent a link to an external website and want to open it, at least a general clickable warning is displayed: "You are leaving Vinted: To protect yourself from fraud, we recommend that you always direct your communication through Vinted and always through to pay our payment system.«

In many cases, an email address or an account from Apple, Google or Facebook is sufficient to register with Vinted.

The platform asks some users for a telephone number during registration.

When asked by SPIEGEL, Vinted did not want to disclose the exact circumstances under which this measure was taken.