Fake payment links in reselling: never click to get paid

"Click here to receive your payment"

A buyer on a local marketplace says they've paid for your vintage camera and sends a link to "claim your funds". The page that opens looks like a payment service or a delivery company, asks you to sign in, then asks for your card details "to verify your account". Nothing about the sale required a link. That's the scam: a fake payment link designed to steal your login, your card or both.

This guide covers fake payment links in reselling, using CISA's guidance on recognizing and reporting phishing and eBay's policy on offers to buy or sell outside eBay, checked November 8, 2026. CISA marks its page as archived content, but its advice on spotting phishing remains a useful official reference.

What phishing looks like, according to CISA

CISA describes phishing as criminals trying to get people to open harmful links, emails or attachments that request personal information or infect devices, often through email, text, social media messages or phone calls designed to look like a trusted person or organization.

CISA notes that poor spelling used to be a common sign, but that messages can now have perfect grammar, so look for the other signs.

Why sellers are targeted

Sellers are expecting money, so a message about a payment feels relevant. The scam flips the normal flow: instead of the buyer paying through a system you already use, you're asked to go somewhere new and enter details to receive money. A payment sent to you shouldn't require you to type your card number into a page someone else linked.

Step 1: Never receive money through a link a buyer sends

Make it a rule. Payments arrive in an app or account you already use, opened by you, not through a link. On marketplaces with checkout, the sale completes in checkout, and the payout appears in your seller account.

Step 2: Keep the conversation on the platform

eBay's policy says buyers and sellers can't share external website addresses, contact details or payment information before completing a sale on eBay, and that transactions outside eBay aren't covered by its protection programs. A buyer pushing you to another app, email or link is a warning sign on any platform.

Step 3: Check payments in your own app

If a buyer says they've paid, close the message, open your payment app or marketplace account yourself, and look. CISA's advice is that if a message could be real, don't click its link or call its number; look up another way to contact the company, such as its verified website.

Step 4: Don't share codes

Some scams ask you to read back a verification code "to confirm you're a real seller". A code sent to your phone is a key to an account, often yours. Never share it.

Step 5: Report and delete

CISA's advice is to report phishing using the platform's reporting options and then delete the message without clicking any link or attachment, including "unsubscribe". Report the buyer through the marketplace as well.

Worked example: two messages compared

In this chosen example, a seller receives two messages about the same sale.

The second message didn't need you to go anywhere new or enter anything.

If you clicked or entered details

• Change the password for the account you entered, and any account that shares it.
• Turn on two-step verification if it's available.
• Call your bank or card issuer using the number on your card if you entered card details.
• Check recent account activity for anything you didn't do.
• Report the message to the platform where it arrived.

CISA's page describes a shopper who signed into a fake site and had their password and card stolen. Acting quickly limits the damage.

Overpayments too: A link is one trick; an overpayment is another. The overpayment scam guide covers buyers who send too much and ask for change.

Common mistakes

• Clicking a payment link because the sale feels real.
• Entering card details to "receive" money.
• Moving a marketplace chat to text or email at a buyer's request.
• Sharing a verification code.
• Replying to a phishing message instead of reporting it.

Money comes to you, not through a link

You never need to click a buyer's link or enter card details to get paid. Check payments in your own app, keep sales in the platform, share no codes, and report anything that asks you to go somewhere new.