AntiBaitby FluenceSecurity

Alert · OLX, Allegro, classifieds

The “buy with OLX delivery” scam and fake “receive payment” links

You list something for sale and a “buyer” gets in touch. They write on WhatsApp, by text or by email that they have already paid, and send a link to “collect the money”. The page looks like the marketplace or a courier company, but it is a fake: it asks for your card details, and then money disappears from your account.

Last reviewed:

How the scam works

The targets are mostly sellers, who are promised an easy sale with delivery. A typical run:

  • The fraudsters get in touch on WhatsApp, show interest in the listed item, then say they have paid and send a link to a page where you can supposedly withdraw the money. The page resembles OLX, InPost, DPD, DHL or Poczta Polska and has a fake payment panel. Entering card details leads to losing the money in your bank account (CERT Polska, monthly summary 2/2026, in Polish).
  • The same scheme under the InPost name, aimed at OLX and Vinted users: the “buyer” says they paid for the item and sends a link to “withdraw the funds” (same source).
  • A message from a supposed marketplace employee or “payments team” asking you to click a link or give a BLIK code or an SMS code “to confirm the transaction” (OLX).
  • A “transfer confirmation” or screenshot as proof of payment, with pressure to ship right away (CERT Polska).
Illustrative pattern · messengerMade-up example, not a real message
From
WhatsApp, unknown number

“Hello, I’m buying your item with courier delivery. I’ve already paid, the money is waiting for you.”

“To collect it, just click and confirm your card details: olx-withdraw-funds[.]xyz”

Illustrative pattern · text messageMade-up example, not a real message
From
+48 5xx xxx xxx

Your item has been paid for. Collect the payment within 2 hours or the transaction will be cancelled: courier-payment-collect[.]xyz

The usual tricks

Talking off the platform

The scammer moves the conversation to WhatsApp, text or email, where the marketplace can’t see it. OLX: “Links sent by text or WhatsApp are sent by fraudsters” (OLX).

“Collect your payment”

The page asks for your card details so you can “receive” money. Allegro lists as a warning sign a link to a page where you must enter login or payment-card details (Allegro).

A fake courier company

The fake page imitates not only the marketplace but also InPost, DPD, DHL or Poczta Polska, so the “delivery” looks credible (CERT Polska).

A fake marketplace employee

A supposed OLX consultant or “payments team” asks for a BLIK code or an SMS code. A real OLX employee never asks for these (OLX).

Fake proof of payment

A screenshot of a transfer or a “payment confirmation” email proves nothing. CERT Polska advises waiting until the money actually shows up in your account (CERT Polska).

Haste

“The payment expires in two hours”, “the courier is on the way”. Time pressure is meant to get the card details typed in without a second thought.

How real OLX and Allegro transactions work

In the marketplaces’ own words (pages in Polish):

  • OLX: “an OLX employee will NEVER ask you to click a link to ‘collect a payment’”, nor for a BLIK code or an SMS code to confirm a transaction (OLX).
  • OLX: “transactions with OLX Delivery take place only on the OLX website or in the mobile app” (OLX). You get notified that someone bought your item in your OLX messages (OLX).
  • Allegro Lokalnie: “Every stage of buying and selling happens through the Allegro Lokalnie website” and “You don’t need extra links from people interested in the transaction” (Allegro).
  • Allegro: “Don’t ship the order until you have the buyer’s payment in the tab on Allegro or Allegro Lokalnie” (Allegro). OLX recommends holding the shipment until the money is in your bank account (OLX).
  • CERT Polska: don’t move the conversation with a buyer or seller off the marketplace’s official channels (CERT Polska).

If you entered card details or gave a code

If card details or a bank login went into the fake page, or a BLIK or SMS code was handed over, time matters. OLX says to contact your bank immediately if card details were given (OLX).

  1. Call your bank immediately

    If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.

  2. Secure your marketplace account

    If your OLX or Allegro login and password were entered, change the password on the real site, typing its address yourself. Report the user or the conversation with the site’s reporting tools.

  3. Forward the text to 8080

    In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.

  4. Report the site or email to CERT Polska

    Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to [email protected].

  5. Report the fraud to the police

    If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.

More in our guides: what to do after clicking a phishing link, how to report phishing.

Check before you click

Got a suspicious email? Check it with AntiBait.

Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.

Check an emailAll scam alerts

Sources

Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.

Other alerts