It's a steal: how we listed fake 'bargains' on marketplace websites

Bargain hunters are at risk from fake listings on online marketplaces with no buyer protection scheme, a Which? Money investigation has found.

After creating new accounts, we were able to publish listings with suspicious features on Facebook, Gumtree and Nextdoor.

Although in some cases our ads were blocked on first attempt, on all platforms we were able to get ads listed for at least half a day – a lot longer in the case of our subsequent attempts on Facebook and Gumtree.

It comes amid a surge in purchase scams. UK Finance reports an increase in fraudsters pursuing higher volume, lower value attacks – victims lost £618 on average in the first half of 2024, according to its data.

Read on to find out what we uncovered, and how to protect yourself. 

Do you have buyer protection?

Marketplaces are second-hand selling sites and apps that offer a way to save money on items such as clothing, electricals, and mean you can shop more sustainably.

However, they can be a happy hunting ground for criminals, because the sites operate outside of consumer rights legislation. You don’t have the same rights if you buy from another person as if you’d bought from a retailer. 

It’s up to the marketplace itself how much it wants to intervene in these transactions. Some sites offer reasonably robust buyer protection schemes that return your money if goods aren’t delivered or aren’t as described. But others do nothing and leave all the risk to you.

Of the nine marketplaces we examined, six have some form of buyer protection. Amazon Marketplace, Depop, eBay and Vinted have protections switched on by default for most purchases. On Shpock, protection is applied to items when the seller has enabled delivery by courier or post. On Preloved, both buyer and seller have to agree to use the buyer protection scheme for it to apply.

To benefit from buyer protection, buyers generally have to pay via a site or app’s in-built payment mechanism (eg by clicking ‘buy now’ or ‘pay now’), with some sites levying a small extra buyer’s fee for the protection. 

Facebook Marketplace, Gumtree and Nextdoor don’t offer any payment protection against scams or ways to pay through the site.

• Find out more: Best and worst places to shop second hand online 

We create a fake listing

On marketplaces with no buyer protection, users are particularly reliant on the marketplace seeing and removing scams before they can attract victims.

To test these three sites’ gatekeeping, we created a bogus identity and used that to create a new account on each one, before immediately uploading a listing for a second-hand Nikon digital camera. 

Starting with Facebook and Gumtree, we used a glossy stock image of a generic camera, instead of genuine home pictures of a Nikon. 

In each of our listings we offered the item at a low price and stated it was available via postage – with the buyer having to pay prior to postage of the camera by bank transfer or PayPal’s Friends and Family option. 

• Facebook removed our Marketplace listing in less than 40 minutes and suspended our new account. It appeared suspicious of our initial failure to upload a profile picture, asking us to upload one so it could verify us. It later rejected our AI-generated image of a woman and deleted the account. 
• The Gumtree listing didn’t go live at all, and was kept ‘under review’. Less than an hour later, it appeared to have failed moderation and vanished. Subsequent attempts to list items on the profile all failed, implying that Gumtree had restricted the account.
• On Nextdoor, we created an account with the same bogus identity and AI-generated profile picture we’d used on Facebook. Our bogus Nikon listing went live and stayed up for about 18 hours, during which time two users messaged us asking to buy it, while another told us they weren’t ‘born yesterday’. After 18 hours, we were forcibly logged out and all attempts to log back in failed, indicating that our account had been suspended or deleted.

First in Which? Money magazine

This story first appeared in Which? Money magazine. Join for reviews, features and investigations, plus 1-to-1 guidance from our experts.

Sign up now

Making our listing more convincing

Evidently, Facebook Marketplace and Gumtree had blocked our blunt approach. But to give fraudsters some credit, many are smarter than this. 

Starting afresh with a different laptop, wi-fi connection and bogus identity, we created new profiles. 

On Facebook we uploaded an (AI-generated) image profile picture, with some very basic personal details. We briefly spent time browsing and following some pages and groups.

On both Facebook and Gumtree, we uploaded a more sensible ad for a Nikon D60, with genuine pictures (not stock images) and stated that the item could be collected in person. These went live without issue (the Gumtree ad was ‘under review’ for around 10 minutes).

After almost a full day we edited the still-live ads to state that items would be posted and we’d require pre-postage payment by bank transfer or PayPal Friends and Family. In this format, the ads went live once again and stayed live (with a review period of just a few minutes on Gumtree). 

After four days, we upped the ante, editing both to slash the price in half and to state that payment needed to be made via Apple gift cards – a payment method that is notoriously favoured by scammers. The codes from gift cards can be sold on and are very difficult to trace.

• The Gumtree listing once again passed a review in minutes and remained up for more than a day, before going ‘under review’ once again and then disappearing from search results.
• The Facebook listing remained live almost 48 hours after the edit, so we reported it to Facebook from another account. It rejected that report and refused to remove the listing, offering the chance to appeal within 180 days but offering no button or form to request it in reality. We eventually deleted the listing ourselves.

What online marketplaces say

We contacted Gumtree, Nextdoor and Facebook parent company Meta, to share our findings.

Meta, Facebook’s parent company, highlighted its ongoing work with Stop Scams UK and UK banks to identify and remove scams at source. 

It described Marketplace as a local meet up and collection service, telling us that the majority of payments are done when goods are exchanged. It said users should check whether a profile appears new or incomplete, check reviews of online sellers where available, insist on meeting in public to view the product before completing any transaction and only pay once you’ve seen the item.

It advised use of payment options that include strong protections, such as PayPal, but avoidance of its Friends and Family option.

Joseph Rindsland, head of trust and safety at Gumtree, said user safety was its ‘absolute priority’, with constant reviews and investment. 

He said: ‘Our strong human and automated moderation processes are effective at detecting risk factors, removing fraudulent ads and blocking offending users, as proven by the fact that all ads in this experiment were ultimately taken down by our dedicated safety team. While bad actors will always try to circumvent even advanced antifraud tools, we are regularly updating and enhancing our rules and filters.’

He said that Gumtree’s safety hub offers advice to site users, and that suspicious ads and replies can be flagged to the trust and safety team using the report function, where they will be investigated within four hours. Mr Rindsland added that 99% of [Gumtree] listings published in 2023 were without issue.

Nextdoor told us its platform is built on trust and has a dedicated trust and safety team to keep the platform safe. It said that it takes all reports of fraudulent behaviour seriously and said that its community guidelines explicitly prohibit phishing and other fraudulent activities.

Nextdoor highlighted several new measures including a warning reminder urging neighbours to be vigilant when clicking on links, sending money or being asked to verify their account and ‘will take appropriate action which may include the suspension or deactivation of accounts’ when guidelines are violated. Nextdoor said that by not having an integrated payment option, it ‘helps limit fraud’ because it 'avoids storing sensitive financial information such as credit card details, which lowers the risk of data breaches or hacking attempts'.

How can you spot a fake?

Protect yourself by avoiding listings with these characteristics:

• Bargain prices Scammers sometimes set a price eye-catchingly low in a bid for your attention. Look at lots of listings for the same item to get a feel for average prices.
• Strange payment requests Payment before postage can be risky. Sending money by bank transfer, gift card or PayPal Friends and Family could leave you unprotected. Your best bet in these situations is PayPal’s Goods and Services option, which opts you into its buyer protection scheme. Your seller may need to pay a small fee for this, which they may pass on to you. 
• Stock images Genuine sellers should be able to show you a photograph of the item in a home environment. Stock photos are suspicious and don’t show an item’s condition.
• Thin profiles Be wary of new or blank profiles with no profile picture, personal information, past activity or ratings. These could exist solely for creating scam listings.