# Fake Buyer Scams: Why You Never Enter Card Details to Get Paid Source: https://issitelegit.com/blog/fake-buyer-scams-why-you-never-enter-card-details-to-get-paid Published: 2026-11-07 · By IsSiteLegit · Data as of 2026-11-07 **Short answer:** A real buyer never needs your card details, PIN or bank login to pay you. If a buyer sends a link and asks you to enter card details to receive money, it is a scam. ## Key findings - Receiving money never requires you to enter your card number, expiry date or security code on a page a buyer sent you. - On 2026-11-07, public phishing feeds listed 300 phishing links, so fake payment pages are common. [1] - In those feeds, 55% of phishing links sat on free hosting platforms, so a normal-looking address proves little. [1] - Keep the chat and the payment inside the marketplace's own system, and do not move to email or messaging apps. ## How does the fake buyer scam work? The scammer acts like an eager buyer, then sends a link so you can "receive" payment or "confirm delivery". The link leads to a fake page built to steal your details. A typical story goes like this: 1. You list an item for sale. 2. A buyer messages fast, agrees to the price and does not haggle. 3. They say the money is "held" and you must verify your account. 4. They send a link that looks like a marketplace, bank or courier page. 5. You enter card or login details, and the scammer takes them. Some versions use a fake courier. The buyer says a delivery company will collect the item, and you must pay a small fee on a page they send. There is no courier and no buyer. ## Why don't you need card details to get paid? To receive money, a sender only needs your name, email, phone number, or bank account details, depending on the method. You never need to type a card number, expiry date, security code or PIN. Card details are for paying out, not for getting paid. If a page asks for them to "release" funds, it is taking money or data from you, not giving it. Also be wary of pages asking for: - Your online banking login or one-time codes - A photo of your card - A small "verification fee" - Your marketplace password ## How can you spot a fake payment page? Look at who sent it and how. A genuine payment step happens inside the marketplace or on the payment company's real site, not through a link from a stranger. ### Warning signs - The buyer pushes you to leave the marketplace chat for email or a messaging app. - The link comes with urgency, such as "claim within 24 hours". - The address is a look-alike, such as paypa1-login.example, rather than the real paypal.com. - The page asks for more than you would expect. - The buyer will not pay in person or through the marketplace's own tools. Look-alike names are not the only trick. In the phishing links listed by public phishing feeds on 2026-11-07, 55% were on free hosting platforms rather than on a lookalike domain [1]. A scam page can therefore have an ordinary-looking address. Judge the situation, not just the look of the link. Our guide on [checking a link before clicking](https://issitelegit.com/guides/check-a-link-before-clicking) explains more. ## How many fake pages are out there? A lot. On 2026-11-07, public phishing feeds listed 300 phishing links [1]. Not all target marketplace sellers, but they show how steady the flow of fake pages is. Some imitate payment brands. For example, PayPal appeared in the brand-targeting links in those feeds [1]. ## What can a check tell you, and what can't it? A check can show things like how new a domain is, whether it appears on security blacklists, and whether the name imitates a known brand. It can't read a scammer's mind, and it can miss brand-new scam sites that no feed has listed yet. In the last 7 days, 313 websites were checked on IsSiteLegit [2]. Most were rated likely legit, but 30 were rated caution, 6 high risk and 1 known malicious [2]. Treat any result as one input, not a guarantee. If a buyer asks for card details, the answer is no whatever the page says. ## How can you sell safely? 1. Keep chat and payment inside the marketplace. 2. Do not click links from buyers. 3. Ask for payment through the platform's own tools, or take cash in person. 4. Do not ship until the money is really in your account, checked in your own banking app, not through a link. 5. Be wary of buyers who overpay or want to rush. ## What should you do if you already paid or clicked? Act quickly, but stay calm. - If you entered card details, call your bank or card issuer straight away and ask them to block the card. - Change passwords you entered, and any reused elsewhere. - Report the buyer to the marketplace. - Report the scam to the authorities, such as [reportfraud.ftc.gov](https://reportfraud.ftc.gov) in the US or [Action Fraud](https://www.actionfraud.police.uk) in the UK. - Keep screenshots of the chat and the page. Not sure about a link or a site? You can [check a website with IsSiteLegit](https://issitelegit.com/) for free and see the evidence behind the result. ## Frequently asked questions ### Is it safe to give a buyer my bank account number? Sharing the details needed to receive a transfer is usually low risk, but only share what is needed. Never share online banking logins, one-time codes or card security codes. ### Why do fake buyers want to move to another app? Away from the marketplace, there are no safety tools and no record the platform can review. It also makes it easier to send you links to fake pages. ### What if the buyer says the marketplace requires me to use their link? That is a common lie. Open the marketplace app or type its real address yourself and check whether any such request appears there. ### Can a fake buyer scam work on cash sales? It is much harder. Meet in a public place, check the cash, and hand over the item only when you are happy. ## How we got these numbers The figures in this post come from the public security feeds listed under Sources, as they stood on 2026-11-07, and from the websites people checked on IsSiteLegit in the 7 days before. We count the listed links and group them by the brand their web address imitates, their domain ending and their hosting platform. We never publish the listed links themselves. An AI model wrote this post from that data. Software published it only after an automatic check confirmed that every number comes from the data, every made-up example address uses the reserved .example ending, and every link goes to our own pages or an official agency. No person reviewed it before publication. Where we link to a website’s IsSiteLegit result, a "likely legit" rating describes what our automated checks found when they ran. It is not an endorsement of the company, its products or its offers. ## Sources 1. OpenPhish phishing feed. OpenPhish, 2026-11-07. https://openphish.com/ (Public security feed) 2. Websites checked on IsSiteLegit in the last 7 days. IsSiteLegit, 2026-11-07. https://issitelegit.com/recent (IsSiteLegit data) 3. reportfraud.ftc.gov. U.S. Federal Trade Commission (FTC). https://reportfraud.ftc.gov (Official guidance) 4. Action Fraud. Action Fraud (UK police). https://www.actionfraud.police.uk (Official guidance)