Here's How Scammers Try to Get Your Bank Information

Here's what it's all about

• Ricardo warns of a new phishing scam: After a sale, scammers pose as prospective buyers or buyers and lure victims to fake Ricardo or TWINT websites to steal login and e-banking credentials.
• The Consumer Protection Agency welcomes the warning but calls for more visible safety instructions and targeted information for new sellers.
• Payment confirmations should only be checked directly on Ricardo or in the official app. No logins or additional confirmations are required to receive a payment.

Summary created with

The online marketplace Ricardo recently sent an email to its registered users warning them about a new scam that occurs after a sale: Scammers pose as buyers and claim to have already made the payment. They then send a link to a fake website that looks deceptively like the real Ricardo or TWINT sites. The goal is to steal login credentials for Ricardo, TWINT, or even online banking.

In the email, Ricardo reminds users never to click on suspicious links and to log in only through the official website or app. The company also urges users to report any suspicious requests or buyers directly. blue News has a copy of the email.

Consumer Protection: An Email Alone Is Not Enough

For Lucien Jucker, a lawyer and head of Data Protection & IT at the Consumer Protection Agency, however, the warning does not go far enough.

"In my opinion, there should be additional information about current scams and general safety tips. Ricardo does actually provide this information, but many visitors to the site will likely overlook the link in the footer. Yet the information is actually helpful and easy to understand."

In fact, Ricardo provides security tips and a guide to current online scams on its website. However, both pages are accessible only via the footer—the bottom section of the website.

At the same time, it’s clear that Ricardo cannot display these prompts to all visitors on a permanent basis. “However, it would certainly make sense for new sellers, in particular, to be notified directly by Ricardo after they list their first item,” says Jucker.

The Most Important Security Measure: No Logins for Incoming Payments

When asked about the most important step to take to protect against this scam, Jucker explains: “No confirmation or entry of login information is required to receive payments. By default, buyers can pay directly through Ricardo or via bank transfer.”

Ricardo states that the sellers’* bank details are stored in the Ricardo account and are displayed to buyers* after the purchase. For a TWINT payment without MoneyGuard, only the cell phone number is required; confirmation from the sellers is not necessary.

Specifically, if you are asked to enter login credentials or confirm an alleged payment, you should be suspicious. With the MoneyGuard escrow and buyer protection service, sellers simply need to ship the item. Payment is automatically released upon receipt of the goods and after the deadline has passed.

New Scam Targets Newcomers in Particular

According to the Consumer Protection Agency, the scammers’ tactics have recently changed. “As far as we know, scammers actually placing orders on Ricardo is a relatively new scam. Apparently, they particularly target new sellers because these sellers haven’t yet received genuine payment confirmations and therefore don’t know what emails from Ricardo actually look like.”

Anyone selling on Ricardo should therefore check payment confirmations exclusively on the platform itself or in the official app. Always enter the website address manually. Never enter your login or online banking credentials on websites accessed via links in emails. Additionally, no additional confirmation from sellers is required to receive a payment.