Secure payment scam on Leboncoin and account hacking
Solved
BastienChill
Posted messages
5
Registration date
Status
Membre
Last intervention
-
Xytras -
Xytras -
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
18 answers
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
to: all
Hello everyone,
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...
I would like to share with as many of you as possible an extremely well-crafted scam on the Leboncoin website.
For your information, the matter is not yet resolved; I have simply notified my bank and the Leboncoin customer service, whose responses I am waiting for.
In this case, it is a scam targeted at the buyer, not the seller, as we usually think regarding the secure payment on Leboncoin. I will detail all the steps below:
D-2 / Friday
I find an interesting ad (but not too much, otherwise it would be suspicious, obviously) for a new computer for sale at €1700. I'm interested in the offer, so I contact the seller via the dedicated messaging system. No response; the ad is deleted, and I think it's too late, what a shame...
The seller eventually replies and informs me that the item is still available, but a buyer flaked on him, so to cancel the transaction, he had to delete the ad, not knowing how else to do it. He gives me his phone number and tells me he will send me the link to the new ad via SMS. So far, nothing is alarming.
D0 / Sunday
Two days later, he posts the ad online, I find it, but it is listed under another account; this is suspicious. I contact him again via the Leboncoin messaging system. I ask him for the invoice for the device several times; he doesn't send it to me but tells me it is with the computer, so that "everything will be checked on site."
He offers shipping (which works for me in this particular case) and payment through the secure Leboncoin payment system, arguing that I have nothing to fear because if it doesn't suit me, I can cancel everything and get my money back.
For your information, I had never made a purchase through this system before, but I had only read negative reviews regarding sellers who faced issues with buyers who took advantage of their protection through this type of payment. I think I have nothing to lose because it's secure; I’ve looked into how the secure payment works, and it reassures me in this "risk-taking," considering that if the item is damaged or not received, or any other problem of the sort, I am comforted.
I make an offer of €1500, the seller accepts, and I confirm the payment via the secure payment service Leboncoin; he tells me he will handle the shipping as soon as possible. I provide him with my first and last name as well as the address of the Mondial Relay point where I wish to pick up the package. He confirms that there is no issue and that he will be quick.
D+1 / Monday
The seller wants me to call him in the late afternoon, without saying why. I call him in the evening; he answers after the third call. He tells me that it's his colleague who will handle the shipping the next day. At the moment, I don't quite understand, as his call seems pointless, other than trying to reassure me as if he were attempting to deliver quickly...
D+2 / Tuesday
Leboncoin debits the amount for the item plus Leboncoin security.
I read that I should wait 10 days from the payment date to confirm receipt of the package or to report that there was a problem, and that after 14 days without a response from the buyer, the money would be transferred from Leboncoin to the seller.
D+3 / Wednesday
The rest of the conversation takes place via SMS.
The seller sends me a screenshot from the Colissimo site confirming the drop-off: "Date / Your package has been dropped off at a point of..."
At this point, there's a problem because the shipment is not via Mondial Relay. I tell him that this photo provides me with no information and that I want him to give me the package tracking number.
At that moment, I can't cancel anything. In fact, since the payment was validated, I can do nothing except wait for the package.
I explain once again to the seller that I want a shipment via Mondial Relay to the relay point I indicated, and not by Colissimo, as the package will be refused at the relay point address since it is not an address where I am domiciled.
He calls me in the afternoon and tells me that it's his colleague who is transmitting the screenshots to him little by little because he is the one receiving the tracking information. I ask him to provide me with the tracking number by the end of the day; he tells me he is trying to do his best, but his colleague only responds via email and is very busy.
D+4 / Thursday
Screenshot of the Colissimo tracking: "Date / Your package is in transit on our logistics platforms to be delivered to you as quickly as possible."
I again ask for the tracking number as well as the address to which the package was sent. He tells me that he only receives the screenshots that he sends to me and that he doesn't have the time to discuss because he is finishing his break and has to get back to work. I repeat that I will not receive the package if it is not sent as initially agreed via Mondial Relay and to the requested relay point address. He says he will call me in the evening to talk about it in person so that I can be delivered as quickly as possible.
He doesn't call me in the evening.
D+5 / Friday
2:37 AM, he sends me a photo of a woman in revealing clothing as well as a screenshot of the email his colleague sent him: he informs him that he has no network where he is, that he is with family, and that he has successfully sent the various packages as the seller asked him. He says he will continue to send the tracking notifications for the package. His colleague adds that he will send the "receipt" once he returns on Friday during the day (D+5, today).
At 7 AM, upon receiving the messages, I request the cancellation of the order, knowing that only the seller can cancel the transaction at this stage, before delivery.
He tells me he will send me the tracking number today when he comes back. I reply that he will not scam me and that I want him to explain the photo of the naked woman he sent me. He replies that it was a mistake while sending... He tells me he doesn’t understand why he would scam me (what a joke). He wants me to give him until 4 PM to provide me with the tracking number.
He does not update me until 8 PM. I repeat that I want to cancel the order and that if nothing is done on his part, I will file a complaint with Leboncoin the next day. He responds that the Colissimo "has not been sent" and that it will be returned to him the following Tuesday, and then he can take care of the shipping himself without any problem this time. I repeat that I wish to cancel the order; he insists, and I repeat myself several times.
No further response.
D+6 / Saturday
No news; I file a complaint by sending a message regarding my desire to cancel my order to Leboncoin through the help form.
I inform the seller, and he does not respond.
// And then everything escalates.
D+6 / Saturday
To note: I am still logged into my Leboncoin account via the mobile app and on my computer through my internet browser.
On my account, I realize that the conversation thread with the buyer related to the purchased item has been deleted. However, I am pretty sure that it is not a mistake on my part since deleting a conversation thread involves two steps, requiring confirmation. That’s when I go to my personal section on Leboncoin, under my account information. That's where I discover that it is no longer my information but that of someone else (name, first name, phone number, email address, postal address, etc).
At that precise moment, I understand that I have been hacked on my Leboncoin account. Indeed, to correct this information, it requires the account password. I then realize that I have not been receiving alerts and notifications via email as usual for some time now. I still do not know since when my account has been hacked because I have received no notification (by email or through the app) regarding the change of my personal information. My email address having been changed, I receive nothing from Leboncoin on my personal email address.
The hacker who accessed my account has validated, on my behalf, the receipt of the package from my personal space. This allowed for the validation of the second payment step from Leboncoin to the bank account of the seller-scammer, outside of my will, of course.
I still have access to my hacked account because I am still logged in by default on the mobile app and on the website via the browser. Not knowing how to react, I send a form to Leboncoin detailing what is happening to me (with fewer details than here) regarding the hacking and secure payment. I provide my true information (email address, name and first name, phone number), which was previously my account information before the hacking.
However, even though I receive a confirmation of submission from the site, I do not receive a copy of my message by email because the registered email is that of the hacker. So they are the ones receiving a copy of the message, and you will see what that implies...
I also send a similar message via my father's Leboncoin account form.
At noon, I receive an email from "leboncoin" with a strange email address (aide@cgu-document.fr) indicating that my account has been hacked and that I can now reconnect with my old email address and a provided password, which can be changed afterward. The problem is that for this to take effect, I am asked to log out of my account from all the devices used where I am currently connected. This seems really suspicious, although the formatting is very similar to the usual Leboncoin emails. However, I have noticed the following mistakes made by the hackers/scammers:
- The recipient email is mine, not that of my old Leboncoin account, but my personal email that is not linked to Leboncoin, but...