OLX and Vinted: fake payment gateways, explained

Classifieds platforms are today the most common front for scammers in Poland. In its 2025 report, CERT Polska named OLX the most-impersonated brand in phishing — 28,462 incidents (Allegro: 22,513). The mechanism is clever because it reverses the roles: it’s the seller, not the buyer, who gets robbed.

The classic “buyer” scenario

You list an item on OLX or Vinted. A “buyer” shows up, very keen, wanting to pay immediately via “safe payment” or “buyer protection”. They move the conversation to WhatsApp and send a link — supposedly to collect the money. The page looks like the platform’s panel or a real payment gateway.

There, you’re asked for your card details and a BLIK code, or to log into your banking “to receive the transfer”. It’s a trap: you’re not receiving money — you’re authorising a withdrawal from your own account or handing over your login details.

Why it works even on careful people

• A genuine context — you really are selling something, so the message fits the situation.
• Perfect fakes — the pages copy the logos, colours and layout of real gateways.
• The chat moves off-platform — shifting to WhatsApp disables the site’s protection and moderation.
• Apparent logic — “you need to enter your card details to accept the payment” sounds plausible to someone who doesn’t do this every day.

The key truth that’s easy to forget: to RECEIVE money, you never give out a BLIK code or card details. BLIK codes and card details are only for paying. Any request for them “to collect” money is a scam.

Red flags

• The buyer wants to pay immediately via an external link and moves the chat off the platform.
• The link doesn’t go to the official OLX/Vinted domain (check the full address).
• Someone asks for your BLIK code, card details or bank login so you can “receive” money.
• Excessive urgency and ready-made excuses (“I’m at work”, “it’s a new system”).

How to protect yourself

Keep the whole transaction inside the platform — payments, chat, buyer protection. Don’t move to WhatsApp with a stranger. Never give a BLIK code or card details to “receive” anything. For online payments, use virtual cards and turn on push notifications.

If you’ve already clicked and entered details — block the card, change your banking password and report it to your bank and the police. Send the fake domain to CERT Polska. It’s the same “first minutes” principle we describe in our piece on incident response.

What receiving a payment actually looks like

A seller does not need to provide a card number, CVV, bank login or authorisation code to “receive” money from a buyer. Check transaction status by opening the official app yourself or typing the marketplace address. A screenshot, email or buyer message is not proof of payment. Ship only when the actual platform shows a paid order and provides its normal instructions.

Keep the conversation in the marketplace messenger. Moving to WhatsApp or SMS removes some reporting controls and makes it easier to substitute a link. An HTTPS padlock does not prove that a page belongs to OLX or Vinted; it only means that the connection to the domain shown in the address bar is encrypted.

What the fake form captures

The first screen may collect card data, the next impersonate a bank and another request an SMS code or in-app approval. In a support-agent variant, the caller walks the victim through each step or asks for remote-access software. The attacker may then see notifications and banking activity; none of this is necessary to sell an item normally.

Read the entire bank authorisation prompt, including the amount, recipient and operation type. Do not approve adding a card to a wallet, activating a new device or making a transfer merely because the caller labels it “verification”.

Responding after disclosing data

Call the bank immediately using the number on its official site or your card. Block the card, discuss online-banking restrictions and report unauthorised operations. From a clean device, change the email and marketplace passwords, terminate unfamiliar sessions and remove unknown devices. If you installed remote-access software, disconnect the device from the network and do not use it to reset passwords before it has been checked.

Preserve the full domain, conversation, phone number and transaction receipts. Report the profile and message in the app, the domain to CERT Polska and the crime to police. Prompt reporting gives the bank a better opportunity to stop additional activity, although recovery cannot be guaranteed.

Running an e-commerce platform or marketplace? Penetration tests and web application audits find the weaknesses before fraudsters exploit them — let’s talk.

Sources: Vinted — recognising phishing and spoofing, Vinted — reporting attempted fraud, CERT Polska — warning list.