The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards

A new phishing campaign is specifically targeting sellers on Discogs, the popular music marketplace and database. Attackers have constructed a multi‑page deception that begins with a fake human verification check and ends with a cloned Stripe payment form. The screenshots provided document this attack in detail. Understanding each step of the scam is the only way to avoid becoming a victim.

The Three‑Stage Deception

The scam uses a carefully choreographed sequence of web pages, each designed to lower suspicion and increase urgency.

Stage 1 – The Fake CAPTCHA

Threat Intel: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 1: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The victim lands on a page that displays “Just a moment…” and a small widget that says “Verify You’re Human” with a checkbox labelled “I’m Not a Robot”. The page is branded with “Powered by XCaptcha · Secure & Private”. In reality, XCaptcha is not a legitimate CAPTCHA provider. This is a classic trick: the attacker creates a fake bot check to make the user believe the site is security‑conscious. Clicking the checkbox does not perform any real verification. Instead, it either triggers the next page or simply records that the user is willing to interact with the fraudulent interface.

Stage 2 – The Discogs‑Branded Notice

Actual screenshot 2 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 2: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

After passing the fake CAPTCHA, the user sees a page styled to resemble an official Discogs notification. The header reads “Discogs > Account Settings & Access > Verification”. The message states: “Welcome to Discogs! To continue selling on our platform, you need to complete the verification process. This step ensures the security of our community.”

A fake support chat window is embedded on the same page. The chat text explains: “You will need to enter your card details to verify it and, subsequently, receive payment from your customer.” It reassures the user that “all your personal data is protected by our security department and remains confidential” and that “customer service operators are always online to help you.”

A large button labelled “Proceed to Verification” leads to the final stage.

Stage 3 – The Cloned Stripe Payment Form

Actual screenshot 3 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 3: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The third page is a near‑perfect imitation of a Stripe payment interface. The domain shown in the URL bar is discogs.page25479.lat/merchant/order/DaFsEh. The page displays the Stripe logo and a form requesting:

  • Card number (with a placeholder 1234 1234 1234 1234)
  • Month and year of expiry
  • CVV code (labelled “CV” on the screenshot)
  • Cardholder name (“Full name on card”)

A “Verify” button completes the action.

Why This Scam Is Particularly Dangerous for Discogs Sellers

Discogs is a platform where independent sellers list vinyl records, CDs, and music memorabilia. Many sellers are private individuals who do not have formal business training in cybersecurity. They are often motivated by the desire to sell a few items from their personal collection. This profile makes them ideal targets: they expect to provide payment information to receive money from buyers, and they may not immediately recognise that a request for card details is the opposite of what a legitimate selling platform would require.

The scam exploits a fundamental confusion between “verifying identity” and “providing payment credentials”. No legitimate marketplace asks a seller to enter their own credit card number as a way to verify their seller account or to receive payments. Payments from buyers are deposited into a seller’s linked bank account or PayPal account – not drawn from the seller’s card.

The presence of the fake support chat adds a dangerous layer of psychological manipulation. The chat creates an illusion of live, human assistance. A worried seller might be tempted to ask questions, and the automated responses (or a real criminal on the other end) would reinforce the legitimacy of the request. The phrase “customer service operators are always online to help you” is designed to prevent the victim from seeking help elsewhere.

Expert Analysis: Technical and Behavioural Red Flags

Cybersecurity professionals who have examined similar phishing kits identify several consistent patterns. This campaign exhibits all of them.

The URL is the most immediate red flag. The page is hosted on discogs.page25479.lat. The domain page25479.lat has no connection to Discogs. The real Discogs website uses discogs.com. Attackers register cheap, often free subdomains on obscure top‑level domains (.lat, .top, .xyz, etc.) to mimic legitimate addresses. Any URL that contains the platform’s name but is followed by a random string or an unfamiliar TLD should be treated as hostile.

The CAPTCHA page serves no technical purpose. Real CAPTCHAs (such as Google’s reCAPTCHA) are used to block automated bots from accessing forms or content. They are never used as a gateway to a subsequent page that then asks for payment card information. If a site shows you a “Verify You’re Human” widget and then immediately presents a financial form, you are looking at a phishing page.

The fake support chat is a behavioural exploit. Research into online fraud shows that users are more likely to comply with a request when they believe they have a safety net – someone to ask for help. The chat window creates that false safety net. In reality, the “operator” is either a script or a criminal whose only goal is to keep you on the page until you submit your data.

The Stripe form is a direct copy of a legitimate payment interface, but with a critical omission: there is no transaction context. A real Stripe payment form appears when you are actively purchasing something, and it shows the merchant name and the amount to be charged. This form shows neither. It asks for your card “to verify it and, subsequently, receive payment” – a nonsensical statement. Receiving money requires you to provide bank account or PayPal details, not your credit card number.

The Financial Impact: What Happens After You Submit

If a seller enters their card information into this form, the data is sent directly to the attacker. Within minutes, the attacker will test the card with a small authorisation (often $0.00 or $1.00) to confirm it is active. Then they will either:

  • Make high‑value purchases of digital goods that can be resold quickly.
  • Withdraw cash from ATMs if the card is a debit card and the attacker has cloned it.
  • Sell the full card details (number, expiry, CVV, cardholder name) on underground markets for others to abuse.

The seller may not notice the fraudulent transactions until days later, by which time the money is gone and the card is compromised.

How to Protect Yourself: Expert Recommendations for Discogs Users

The following advice is based on standard security practices and the specific tactics revealed in this phishing campaign.

Never initiate account actions from links in unsolicited messages. If you receive an email, direct message, or any notification that claims you need to verify your account, do not click embedded links. Open a new browser tab, type discogs.com manually, and log in to your account. Any legitimate verification requirement will be displayed inside your account dashboard or communicated through the platform’s official messaging system.

Understand how Discogs actually handles seller payments. Discogs itself does not process payments directly. Sellers on Discogs typically use PayPal or Stripe as separate payment gateways. To receive money from a buyer, you provide the buyer with your PayPal email address or a Stripe payment link. You are never asked to enter your credit card number into a Discogs page for the purpose of receiving funds. If a page asks for your card to “verify” your seller status, it is a scam.

Look at the browser’s address bar before entering any information. Legitimate Discogs pages always have a URL starting with https://www.discogs.com/ or https://discogs.com/. If you see a domain like discogs.something.lat or discogs-verify.xyz, close the tab immediately.

Do not trust on‑page chat windows that appear in unsolicited verification flows. Real customer support chats are accessible only after you log into your account and navigate to the help section. A chat that appears unbidden on a verification page is a manipulation tool.

Enable two‑factor authentication on your Discogs account. This will not prevent a phishing page from stealing your card, but it will prevent an attacker from taking over your Discogs account even if they later obtain your password through another method. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.

Use virtual or single‑use card numbers for online transactions. Many banks and services (such as Privacy.com, Revolut, or Citi’s Virtual Account Numbers) allow you to generate a temporary card number linked to a spending limit. If you ever encounter a suspicious verification request, using a virtual card with a $1 limit would reveal the scam immediately: the charge would be rejected or you would see an unauthorised attempt.

Monitor your card transactions daily. Set up SMS or push notifications for every transaction. The sooner you spot a fraudulent charge, the faster you can report it to your bank and limit your liability.

What to Do If You Have Already Entered Your Card Details

If you recognise that you have submitted your payment information to a page similar to the one described, act immediately.

Contact your bank or card issuer using the phone number on the back of your card. Do not use any contact information found on the suspicious page. Request that the card be blocked and replaced. Ask the bank to review recent transactions for unauthorised activity.

File a report with your local police. In many jurisdictions, online fraud is a criminal offence. A police report may help you dispute fraudulent charges with your bank.

Change your Discogs password. Even if the phishing page did not explicitly ask for your password, the attacker may have captured it if you used the same device or if the page was part of a wider compromise. Use a strong, unique password.

Report the phishing URL to Discogs. Send an email to their support team with the full URL and screenshots. This helps the platform take down the fraudulent site and warn other users.

Final Words

Phishing attacks that target platform sellers are becoming more sophisticated. They no longer rely on obvious spelling mistakes or generic greetings. They clone the look and feel of legitimate services, add fake CAPTCHAs to create an illusion of security, and embed simulated support chats to disarm critical thinking.

The single most effective defence is a simple rule: never enter your credit card details on a page that claims to be verifying your identity or unlocking your seller status. Real verification uses passwords, two‑factor codes, or identity documents – not payment instruments.

Share this analysis with anyone who sells on Discogs. The more sellers understand these tactics, the harder it becomes for attackers to profit.

How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users

A growing number of cybercriminals are creating fake account verification pages designed to steal financial data from users of shared accommodation platforms such as Flatmates.com.au, flatmate.com, and similar services. The scam begins with an urgent message claiming a user’s account has been restricted and requires identity verification within a strict time limit. The message is designed to create panic. The victim is then directed to a fraudulent web page that mimics a legitimate verification portal.

The attacker’s goal is simple: trick users into entering credit card details, bank account information, or other sensitive data. Once the information is submitted, criminals can drain bank accounts or use the stolen data to commit identity fraud.

Understanding how this scam operates and knowing exactly what to look for is the difference between keeping your money and losing it.

The Anatomy of the Attack: What the Screenshots Reveal

The phishing kit used in this campaign consists of several distinct but interconnected pages, each designed to lower the victim’s defences step by step.

Phase 1: The Urgent Account Restriction Notice

The first screen presents itself as an official notification from the platform. It reads: “Your account is temporarily restricted. You need to verify your identity to remove all the restrictions. You need to confirm your bank details within 24 hours.” The message includes a “Status: Verification required” field and a prominent “Verify” button.

Security Notice: This spoofed page was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform.
Figure 1: Live screenshot of the active phishing operation captured during routine moderation.

This approach directly mimics the urgent account verification scams that cybersecurity researchers have documented across multiple industries. As noted in analyses of such attacks, these fake messages claim an account needs checking due to strange activity or security measures and warn that if verification is not completed, the service might stop working. The entire structure is designed to create panic and bypass rational thought.

Phase 2: The Fake Payment Information Form

After clicking the verification link, the victim is directed to a second page that appears to be a bank card addition form. The page displays logos for VISA, American Express, Discover, PayPal, Apple Pay, and Google Pay in an attempt to appear trustworthy and legitimate.

Actual screenshot 2 of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform.
Figure 2: Live screenshot of the active phishing operation captured during routine moderation.

The form itself explicitly requests the following data:

  • Full card number (with a placeholder reading “Kaartnummer” meaning “Card number”)
  • Expiry date (MM/JJ representing month/year)
  • CVV code (placed directly next to the expiry field with the label “123”)
  • Cardholder name (“Naam op de kaart”)

The page concludes with a “VERZENDEN” (Send/Submit) button and claims that all operations comply with PCI DSS (Payment Card Industry Data Security Standard). The PCI DSS logo is a fraudulent addition included solely to give the page an air of legitimacy. No legitimate service would request a full card number, expiry date, CVV, and cardholder name together in a single unsecured form. Genuine platforms use tokenised payment systems where this sensitive data never touches their own servers.

The Expert Analysis: Why This Scam Is Particularly Dangerous

From a technical and psychological perspective, this phishing operation demonstrates a high level of sophistication in its design and execution. Several factors make it especially threatening to users who may not be technically sophisticated.

The use of an artificial 24-hour deadline is a classic social engineering tactic. When a user believes an account is at risk of being permanently restricted or losing access to funds, the urgency overrides critical thinking. Criminals exploit this vulnerability systematically.

Including payment method logos on the page builds false credibility. The presence of well-known brand marks such as VISA, PayPal, and Google Pay subconsciously signals to the user that the page is secure and authenticated. In reality, these logos can be copied by anyone from publicly available sources.

The explicit request for a CVV code alongside the card number is a critical red flag. CVV codes are explicitly designed to verify that the cardholder is physically in possession of the card during a transaction. While some legitimate recurring payment setups may request a CVV for initial authorisation, they do so in an isolated, one-time context and never as part of a standalone identity verification form. Any service that requests CVV together with the full card number and expiry date in a single form intended for “verification” is almost certainly fraudulent.

Key Red Flags: A Checklist for Users

To help users identify this and similar scams in the future, security experts have compiled a set of actionable indicators. Any page exhibiting the following characteristics should be treated as an immediate threat:

Urgency language and time limits: If a page threatens account restriction or service termination unless verification is completed within a specified time window, it is almost certainly a phishing attempt. Authentic platforms rarely use such tactics and would instead direct users to complete verification through their official app or website.

Requests for payment card information as identity verification: No legitimate accommodation or service platform uses a payment card as a means of identity verification. Identity verification involves government-issued identification, two-factor authentication codes sent to registered email or phone numbers, or biometric authentication. Entering card details into a page that claims to verify identity is equivalent to handing a stranger the keys to your bank account.

Poor grammar, inconsistent language, or mixed languages on the same page: The screenshot shows a mix of English (“Verification”) and Dutch (“Bankkaart toevoegen,” “Kaartnummer,” “Verzenden”). While some legitimate services operate in multiple languages, phishing pages frequently mix languages because they are copied from translated templates that were never properly localised.

Absence of specific platform branding or logos: The screenshots reference the platform name only in the URL and the initial restriction message. The verification pages themselves omit the platform’s official logo, colour scheme, or footer information. Legitimate verification processes are fully integrated into the platform’s branded interface.

PCI DSS compliance claim without visible SSL certificate or security verification: Displaying a logo that claims PCI DSS compliance does not make a page secure. True compliance involves a range of backend security measures. Without an active, verified SSL certificate and transparent data protection policies, the claim is meaningless.

Request for CVV in a standalone verification form: As noted previously, this is the most specific and damning indicator of a phishing page.

Expert Advice: What to Do If You Encounter This Scam

Security professionals and accommodation platforms have issued consistent guidance for handling such threats.

Never click verification links in unsolicited messages. If you receive an email, text message, or social media direct message claiming your account is restricted and requiring immediate action, do not click any links contained within the message.

Navigate directly to the platform. Instead of clicking any link, open a new browser tab and manually type the official domain of the accommodation platform you use. If you are a user of Flatmates.com.au, type “flatmates.com.au” directly into the address bar. Navigate to your account dashboard. Any legitimate verification requirement will be displayed there. If no such notice appears, the original message was a fraud.

Contact support through official channels. If you are unsure whether a message is legitimate, contact the platform’s support team directly using the contact information listed on the official website. Do not use the contact details provided in the suspicious message itself.

Enable two-factor authentication (2FA) on all accounts. Two-factor authentication adds a critical layer of security by requiring a code from your phone or an authenticator app in addition to your password. This prevents attackers from accessing your account even if they steal your login credentials.

Monitor your financial accounts. If you have already entered card details into a suspicious page, contact your bank or card issuer immediately. Request a new card number and review recent transactions for unauthorised charges.

The Broader Implications: Why Accommodation Platforms Are Targeted

The increasing targeting of shared accommodation platforms by cybercriminals reflects a broader trend in how phishing attacks are distributed. As noted in fraud prevention literature, flatmate scams operate by creating fake profiles to gather personal information such as email addresses, phone numbers, and even financial details. The shift toward standalone phishing pages that appear to originate directly from the platform itself represents an escalation of the threat.

Unlike rental listing scams that rely on fake properties or overpayment schemes, this approach directly requests the financial data that enables large-scale account theft. By compromising a single user’s payment card, attackers can not only drain that user’s account but also use the stolen credentials to register on other services, conduct fraudulent transactions, or sell the information on dark web marketplaces.

The platforms themselves have taken steps to combat this threat. Official guidance from Flatmates.com.au advises users to be wary of potential phishing sites by checking the URL prior to logging in or providing information. The platform states, “We only use the domain flatmates.com.au” and directs users to safety resources for step-by-step instructions on how to protect themselves. However, platform security measures are only effective when users actively recognise and avoid fraudulent pages.

Final Recommendations

Every user of shared accommodation platforms should adopt the following practices as a matter of routine:

Maintain a single consistent process for all account-related actions. When any notification claims action is required, pause. Open the official application or website manually. Do not trust links in messages. Do not trust QR codes. Do not trust phone numbers provided in the body of emails.

Regularly review your account activity. Check for unfamiliar login locations, unrecognised linked payment methods, or changes to your profile details. Report any suspicious activity to the platform immediately.

Stay informed about current phishing techniques. Scammers adapt their tactics rapidly. Following cybersecurity resources and platform-specific safety guides helps maintain awareness of evolving threats.

Remember that account verification and identity confirmation on legitimate platforms happens through the platform’s own secure interface, typically within the application or website you originally signed up for. No legitimate service will ask for your full payment card details through a standalone web page reached by clicking an external link.

If you believe you have already provided payment information to a fraudulent page, contact your financial institution without delay. Time is critical. The longer stolen card data remains active, the greater the potential for financial loss.

11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)

By Cybersecurity Analyst Team
May 2026

If you sell clothes, electronics, or collectibles on Poshmark, Mercari, eBay, or Depop, you are a prime target for a new wave of sophisticated phishing attacks. The screenshots below show a real-time scam that attempts to drain your bank account – not by hacking, but by tricking you into handing over your payment credentials.

We analyzed a live phishing page that perfectly mimics Poshmark’s verification flow. Here’s how it works, the 12 warning signs you need to memorize, and expert advice to keep your hard-earned money safe.

How the Scam Unfolds (Based on Real Screenshots)

Step 1 – The fake urgency timer
The victim lands on a page that looks like Poshmark’s support interface. A countdown timer (23:58:35) creates panic: “You have 24 hours to complete verification. After this time, your order will be automatic.”

Incident Report: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 2 – Fake live chat “operator”
A chat window shows a friendly “Operator” saying: “Good news – you’re almost done. Just one final step left to complete the process.” This mimics real customer support to lower your guard.

Step 3 – Redirect to “secure verification”
Clicking the “Verify Account” button leads to a second page – a near-perfect clone of a Stripe bank verification form, asking for:

  • Full card number (with placeholder 1234 1234 1234 1234)
  • Expiry date (MM/YY)
  • Cardholder name
  • Billing address (street, city)
Actual screenshot 2 of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform.
Figure 2: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 4 – Theft
Once you submit, the data goes directly to attackers. They will drain your card within minutes – often using small test transactions first, then larger purchases or cash withdrawals.

11 Red Flags That Give Away the Phishing Attack

#Red FlagWhat You See (from screenshots)
1Artificial time pressure“Verification Time Limit” with a 23‑hour countdown – real platforms never lock orders behind a timer.
2In‑page “support chat” that feels scriptedThe operator repeats generic phrases like “Scroll down” and “Good news — you’re almost done” – no real interaction.
3Verification requires payment card dataNo legitimate marketplace asks for your credit card number to verify your identity. They use email, SMS, or 2FA.
4Fake Stripe brandingThe page says “Securely connect to your bank account through the Stripe system” – but Stripe never embeds full card entry forms this way without an official redirect.
5The URL is not the real marketplace domain(Not visible in screenshots but crucial) – attackers use domains like poshmark-verify.xyz or random subdomains. Always check the address bar.
6No way to log into your real accountThe fake page has no “sign in” link to your existing Poshmark profile. It’s a standalone form.
7Poor grammar and capitalizationExample: “Your order will be automatic.” (missing “cancelled” or “processed”) and inconsistent spacing.
8The “company” footer doesn’t link to real pagesFooter shows “About”, “Our Community”, “Blog” but links are dead or point to #. Real marketplaces have live, functional footers.
9Transaction ID & contact data mismatchThe scam shows a fake Transaction ID and dummy contact data ([email protected], (201) 555-0123) – these are placeholders, not your real info.
10No ability to skip or cancel verificationReal platforms let you decline verification or complete it later via official app. The fake page forces you forward.
11Request for billing address + card + name + expiry – all on one pageThat’s the full magnetic stripe data. No legitimate service needs the entire set just to verify your account.

Expert Advice: How Sellers Can Keep Their Money Safe

Do this immediately

  1. Never enter card details for “identity verification” – on any platform. Use the official app’s built-in payment methods only.
  2. Open a separate browser tab – manually type poshmark.com (or your platform’s real URL) and log in. If there is a real verification pending, it will show there. If not, the page is a scam.
  3. Enable two-factor authentication (2FA) on your selling account and your email. This prevents attackers from resetting your password even if they steal your login.
  4. Use a virtual credit card or payment service – for any online selling, use privacy.com, Revolut virtual cards, or Apple Pay with dynamic security codes. Never expose your main debit card.

If you already entered your card details

  • Call your bank immediately – tell them your card details were compromised. Request a block and a new card.
  • Check your recent transactions – look for $0.00 authorizations, $1.00 test charges, or any small amounts. Report them as fraud.
  • Change your marketplace password – even if you didn’t enter it, the attacker may try to reuse your email/password combination.

Share this warning with other sellers

Many sellers are targeted via fake “buyer messages” that say “I tried to buy your item but you need to verify your account” – always ignore and report such messages.

Final thought

Phishing has evolved. It no longer looks like a poorly written email from a Nigerian prince. It looks like Poshmark’s chat support. It looks like Stripe. It uses real brand logos and psychological pressure (timers, operators, security badges).

The only thing that protects you is a habit: stop, check the URL, and never type your card into a page you did not reach by typing the official domain yourself.

If you found this article helpful, share it with every marketplace seller you know. Together we can make these scams unprofitable.

Have you spotted a similar phishing attempt? Report the URL to [email protected]

Warning For Anyone Who Sells Stuff Online: Your Banking App’s Push Notification Might Be The Last Thing You See Before Your Money Vanishes

Who This Guide Is For

This article is written specifically for one group of people: regular buyers and sellers on peer-to-peer marketplaces like Jimoty, Mercari, and similar platforms. If you have ever listed an item for sale, replied to a classified ad, or entered your payment details on a website that connects strangers to buy and sell things, this guide is for you.

You are not a cybersecurity expert. You probably do not think about phishing attacks when you are trying to sell an old bicycle or buy a second-hand smartphone. That is exactly why the criminals behind this new scam have chosen to target people like you.

In Japan alone, phishing reports reached approximately 2.45 million cases in 2025, shattering all previous records. The Financial Services Agency of Japan has issued repeated warnings about impersonation scams targeting financial accounts, and the attack we are about to dissect represents the newest, most dangerous evolution of these threats. It is not a theory. It is not a distant possibility. It is happening right now to people using the same platforms you use every day.

The Scam That Knows How Much Money You Have

Let me paint a picture for you.

You are selling something on Jimoty, one of Japan’s largest classifieds platforms. You have been chatting with a potential buyer. Everything feels normal. Then you receive a message that looks like it came directly from the platform itself. It says your account has been restricted. It mentions the Financial Services Agency of Japan. It says you need to verify your identity immediately or you will lose access to your account.

There is a link. You click it. The page that opens looks exactly like the official Jimoty interface. Same colors. Same logos. Same layout. It even shows that your email and phone number have already been partially verified – a clever trick to make you trust the page.

Analysis Memo: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "Warning For Anyone Who Sells Stuff Online: Your Banking App’s Push Notification Might Be The Last Thing You See Before Your Money Vanishes" phishing interface captured during link moderation on our platform.
Figure 1: Verified screenshot of the live scam infrastructure intercepted by our security systems.

You breathe a sigh of relief. This must be real. They already have some of your information.

Then the page asks for your credit card details. Not just the number and expiration date. Not just the CVV code. It asks for something no legitimate website has ever asked you before: the exact current available balance on your card.

Actual screenshot 2 of "Warning For Anyone Who Sells Stuff Online: Your Banking App’s Push Notification Might Be The Last Thing You See Before Your Money Vanishes" phishing interface captured during link moderation on our platform.
Figure 2: Verified screenshot of the live scam infrastructure intercepted by our security systems.
Actual screenshot 3 of "Warning For Anyone Who Sells Stuff Online: Your Banking App’s Push Notification Might Be The Last Thing You See Before Your Money Vanishes" phishing interface captured during link moderation on our platform.
Figure 3: Verified screenshot of the live scam infrastructure intercepted by our security systems.

This is not a mistake. This is not a glitch. This is the core feature of a new type of automated financial fraud called a fiat drainer.

How The Fiat Drainer Actually Works

Let me explain what is happening behind the scenes in plain language.

A traditional phishing attack simply steals your card details. The criminals then try to use those details to make purchases or withdraw money. They are guessing how much money you have. They are hoping your bank does not block the transaction.

A fiat drainer is different. It is smarter. It is more efficient. And it is far more destructive.

When you enter your card balance into the fake verification page, you are not just providing information. You are giving the criminals a precise target number. Their automated system reads that number and immediately calculates the largest possible transaction that can be approved without triggering your bank’s fraud alerts.

Here is what happens next, step by step.

First, you enter your full card number, expiration date, CVV, and your current balance. The page looks legitimate. It might even display logos of well-known payment processors to put you at ease.

Second, once you submit the form, the criminals’ system processes your information in real time. It knows exactly how much money to take. Not a small test transaction. Not a random amount. The exact amount that will drain your available balance completely.

Third – and this is the part that terrifies even experienced security professionals – the system is designed to bypass the two-factor authentication that is supposed to protect you. It captures the one-time password sent to your phone via SMS. It tricks you into approving push notifications from your banking app. It might even attempt to activate your device’s camera under the false pretense of biometric verification.

By the time you realize something is wrong, your money is already gone. The entire process takes seconds.

The Three Tricks That Make This Scam So Dangerous

The criminals behind this operation are not amateurs. They have studied how regular people think and behave online. They have built their attack around three psychological tricks that are almost impossible to resist unless you know what to look for.

Trick One: The Manufactured Emergency

The fake account restriction notice is designed to create panic. It cites real regulations from the Financial Services Agency of Japan. It uses official-sounding language. It tells you that you have limited time to fix the problem before your account is permanently locked.

When people panic, they stop thinking clearly. They stop checking URLs. They stop asking questions. They just want to solve the problem as quickly as possible. The criminals are counting on exactly that reaction.

Trick Two: The False Baseline Of Trust

The fake page does something very clever. It displays your email address and phone number as already verified. It shows checkmarks next to completed steps. This creates the illusion that you are continuing a process that has already started, not starting a new one from scratch.

Your brain interprets those pre-filled fields as evidence that the page is legitimate. After all, how would a fake website know your contact information? The answer is that the criminals collected it earlier, perhaps from a previous data breach or from the initial message they sent you. But in the moment, most people do not make that connection.

Trick Three: The Balance Question That Should Never Be Asked

This is the most revealing part of the entire scam. No legitimate business has any reason to ask for your current card balance. Not your bank. Not your credit card company. Not any online marketplace. Ever.

When you see a page asking for your available balance, you are looking at a definitive sign of fraud. There is no innocent explanation. There is no legitimate use case. The only reason to ask for that information is to calculate how much money can be stolen from you in a single transaction.

Real Examples From The Front Lines

Security researchers at Antiphishing.biz recently intercepted one of these attacks in progress. The fraudulent page was hosted on a disposable domain called chilw-order.lat – a meaningless name that would never be used by a legitimate company. The page was impersonating Jimoty’s infrastructure and targeting Japanese consumers specifically.

The researchers documented that the attack relied on three distinct technical phases embedded within a single web page. The first phase displayed the fake account restriction notice citing Japanese financial regulations. The second phase requested the card details including the exact available balance in JPY. The third phase attempted to capture SMS one-time passwords and trick users into approving mobile banking push notifications while simultaneously attempting to activate device webcams under the guise of biometric verification.

This is not a theoretical threat. It is a fully operational criminal system that has already been deployed against real people.

In a separate but related trend, security researchers have observed the emergence of drainer-as-a-service kits being sold on underground marketplaces. These turnkey solutions allow even technically unsophisticated criminals to launch sophisticated phishing campaigns with minimal effort. The operational footprint of these drainer operations is smaller than ransomware, their visibility is lower than many credential-harvesting operations, and they are supported by a well-developed underground marketplace offering ready-made deployment packages.

Expert Advice: How To Protect Yourself Starting Today

You do not need to be a cybersecurity expert to protect yourself from this scam. You just need to follow a few simple rules every single time you interact with any online marketplace.

Rule One: Never Click Links In Messages About Account Problems

If you receive a message claiming your account has been restricted or needs verification, do not click any links in that message. Open a new browser tab. Type the marketplace’s official website address manually. Log into your account normally. If there is a real problem with your account, you will see a notification inside your account dashboard after you log in through the official website.

This single habit will protect you from almost every phishing attack in existence. Criminals rely on you clicking their links. Take that option away from them.

Rule Two: Check The Web Address Before You Enter Anything

Before you type any personal information into a website, look at the address bar of your browser. The real Jimoty website uses jmty.jp. The real Mercari uses mercari.com. The real Yahoo Auctions uses auctions.yahoo.co.jp.

If you see anything else – any variation, any extra words, any unfamiliar endings like .lat or .top or .xyz – close the tab immediately. The presence of a padlock icon in the address bar means nothing. Criminals can get SSL certificates for their fake websites just as easily as legitimate businesses can.

Rule Three: Never Share Your Card Balance With Anyone

Memorize this statement: No legitimate business will ever ask you for your current card balance. Not for verification. Not for security. Not for any reason.

If a website asks for your balance, you are looking at a scam. Close the page immediately. Report it to the platform if possible. Then go about your day knowing you just avoided a financial disaster.

Rule Four: Be Skeptical Of Pre-Filled Information

If a verification page already contains your email address or phone number, do not take that as proof of legitimacy. Criminals can obtain this information from many sources. They can also simply display placeholder text that looks like your information but is actually generic.

The only verification that matters is the web address in your browser’s address bar. Nothing else.

Rule Five: Use Virtual Cards When Possible

Many banks and financial services now offer virtual card numbers – temporary card numbers that you can generate for specific transactions or set with spending limits. If you regularly buy and sell on peer-to-peer marketplaces, using virtual cards adds an extra layer of protection. Even if a criminal obtains your virtual card number, they cannot exceed the limit you set, and you can cancel the virtual number at any time.

Rule Six: Slow Down

This is the most important advice I can give you. Phishing attacks work by creating urgency. They want you to act quickly without thinking. When you feel that sense of panic – when a message tells you your account will be locked if you do not act immediately – that is your signal to stop completely.

Take a breath. Close the message. Open the official website manually. If the message was real, you will see the same notification after you log in. If it was fake, you just saved yourself from losing your money.

What To Do If You Think You Have Been Targeted

If you have already entered your card details into a suspicious page, do not panic. Act quickly but calmly.

Contact your bank or credit card issuer immediately using the phone number on the back of your card. Do not use any contact information from the suspicious message or website. Tell them your card details may have been compromised and request a new card.

Review your recent transactions for any unauthorized charges. Look for small test transactions as well as larger ones. Report any suspicious activity to your bank immediately.

Change your password for the marketplace platform. Use a strong, unique password that you do not use anywhere else. Enable two-factor authentication on your account if the platform offers it.

Monitor your account activity for the next several weeks. Some criminals wait before using stolen card details to avoid detection.

Finally, report the phishing attempt to the platform’s security team. Your report could help protect other users from falling victim to the same scam.

A Final Word From The Security Team

The criminals behind fiat drainer attacks are constantly evolving their tactics. They change their domain names. They refine their fake pages. They find new ways to bypass security measures. But one thing never changes: they need you to take an action they have scripted for you.

Your best defense is not a piece of software or a security product. Your best defense is awareness. Every time you are about to enter your payment information into a website, pause. Ask yourself whether the request makes sense. Ask yourself whether a legitimate business would ever ask for the information you are about to provide.

If something feels wrong, trust that feeling. Close the page. Open the official website directly. Verify through official channels. The extra thirty seconds it takes to do this might be the thirty seconds that save your entire bank account.

This attack was detected, analyzed, and neutralized by the Antiphishing.biz security team during daily link moderation procedures. The dangerous destination URL has been fully defanged within their infrastructure. But new domains will appear tomorrow, and the week after, and the month after that. The information in this guide will protect you regardless of what domain name the criminals choose.

Stay safe. Stay skeptical. And remember – no legitimate website will ever ask you how much money you have before taking it.

Before You Hit “Verify” On That Depop Alert, Read This Or Watch Your Money Disappear

Who This Guide Is For

This article is written specifically for you – a Depop seller who uses the platform to make a living, earn extra cash, or simply clear out your closet. You are not a cybersecurity expert. You do not have time to analyse every link that lands in your inbox. You just want to sell your items without drama.

And that is exactly why scammers have you in their crosshairs. Depop has grown into a massive global marketplace, and where money flows, criminals follow. According to a recent survey, 57% of Depop buyers reported being targeted by some kind of scam, the highest rate among all second‑hand platforms. Sellers are being hit just as hard – especially with the kind of phishing attack we are about to unpack.

This guide will show you exactly how the scam works, why it feels so real, and – most importantly – how to spot it before you lose a single penny.

The Scam That Pretends To Be Your Friend

Let me walk you through what happened to a real seller who almost fell for this trap. You will recognise the sequence immediately.

Step 1: The Panic Inducer

It starts with a message that looks like it came directly from Depop. The headline screams: “Orders Suspended”. The message tells you that your store operations have been temporarily halted because of a problem with your payment details. You need to “verify” your information immediately, or you will not be able to complete your pending sales.

A large, friendly “Verify” button waits for you at the bottom.

Security Notice: This scam layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "Before You Hit “Verify” On That Depop Alert, Read This Or Watch Your Money Disappear" phishing interface captured during link moderation on our platform.
Figure 1: Live screenshot of the active phishing operation isolated on our infrastructure.

This is the hook. The scammer knows that the worst thing that can happen to a seller is lost orders. The thought of a sale slipping away creates instant anxiety. And when people panic, they stop double‑checking things. They click.

Step 2: The “Friendly” Operator

After you click, a chat window pops up. A support agent named “Amelia” welcomes you.

Her message is carefully written to sound warm and reassuring: “The process is secure and only done once” – and then she adds the killer line: “Amelia is a real person, not a robot.”

Actual screenshot 2 of "Before You Hit “Verify” On That Depop Alert, Read This Or Watch Your Money Disappear" phishing interface captured during link moderation on our platform.
Figure 2: Live screenshot of the active phishing operation isolated on our infrastructure.

This is pure psychological manipulation. By claiming to be a human being, the scammer tries to build instant trust. They want you to feel like you are talking to a helpful customer service representative who has your back. In reality, “Amelia” is either a script or a criminal sitting in a different time zone, waiting for you to hand over your card details.

Step 3: The Card Harvesting Form

The final page looks almost official. It displays logos of Visa, American Express, and Discover. It even claims: “All transactions comply with PCI DSS” – a fake security badge designed to make you think your data is safe.

Actual screenshot 3 of "Before You Hit “Verify” On That Depop Alert, Read This Or Watch Your Money Disappear" phishing interface captured during link moderation on our platform.
Figure 3: Live screenshot of the active phishing operation isolated on our infrastructure.

But look closely at what this page asks for:

  • Full card number
  • Expiration date
  • CVV (the three‑digit security code)
  • Name on the card
  • Billing address (street, city, postal code)

This is everything a thief needs to clone your card and empty your account. With these five pieces of information, a criminal can make fraudulent online purchases, sell your card details on underground markets, or even attempt identity theft.

And here is the part that should stop you cold: No legitimate platform, including Depop, will ever ask for your CVV to “verify” your account or restore your selling privileges. Period. End of story.

Why This Feels So Real (And Why You Almost Believed It)

If you are thinking “I would never fall for something this obvious” – stop right there. This scam works on smart, careful people every single day. Here is why.

They use your own fear against you. The threat of lost orders triggers a fight‑or‑flight response. Your brain stops analysing the URL and starts looking for the fastest way to fix the problem. The “Verify” button offers a quick solution. That is the trap.

They fake the feeling of human support. The chat window is not a random pop‑up. It is designed to mimic the live chat tools that legitimate companies use. The name “Amelia” sounds friendly. The claim that she is a real person lowers your guard. You start to think, “If there is a human on the other end, this must be legit.”

They steal credibility from trusted brands. The Visa, American Express, and PCI DSS logos do not belong to the scammer. They are copied from real websites and pasted onto the fake page. Your brain sees those symbols and relaxes, because you have seen them a thousand times on legitimate checkout pages.

The domain name looks almost right. The fake page in this attack was hosted at likedepop.securedirect.cfd. It contains the word “Depop”, which is enough to fool a quick glance. But the real Depop domain is depop.com. The .cfd ending is a major red flag – legitimate businesses do not use cheap, obscure domain extensions.

The One Rule That Will Protect You From Every Phishing Attack

If you remember only one thing from this guide, make it this:

Never, ever click a link from an unsolicited message that claims your account has a problem.

Instead, do this:

Open a new browser tab. Type depop.com manually into the address bar. Log in to your account the normal way. If there is really an issue with your account, you will see a notification inside your dashboard after you log in. If you see nothing – the message was a scam. Close it and move on.

That one habit – typing the official URL yourself instead of clicking a link – will neutralise 99% of phishing attacks, including this one.

Expert Tips: How To Stay One Step Ahead

Here is the advice that security professionals give to their own families. Follow these rules, and you will make yourself a very hard target for scammers.

Turn on two‑factor authentication (2FA) right now. This is the single most effective security measure you can take. Depop supports 2FA. Go to My Depop > My account > Two‑factor authentication and toggle it on. This means that even if a scammer steals your password, they cannot access your account without the one‑time code sent to your phone. It adds an extra lock to your front door.

Never trust a chat window that asks for card details. Legitimate customer support will never – ever – ask you to type your credit card number, expiration date, or CVV into a chat box. If a pop‑up chat starts asking for this information, you are looking at a phishing page. Close it immediately.

Check the URL like a detective. Before you enter any sensitive information, look at the address bar. Is the domain exactly depop.com? Are there any extra words, misspellings, or unusual endings like .cfd, .top, .xyz, or .lat? If anything looks off, close the tab.

Be suspicious of urgency. Any message that says “act now or your account will be suspended” or “you have 24 hours to verify” is almost certainly a scam. Real companies do not pressure you with ticking clocks. They give you time to respond through official channels.

Use a virtual card for online selling. Many banks and services (such as Revolut, Privacy.com, or Citibank) offer virtual card numbers – temporary cards with spending limits. If you use a virtual card for your marketplace transactions, even if a scammer steals the number, they cannot exceed the limit you set. And you can cancel the virtual card instantly without affecting your main bank account.

What To Do If You Already Entered Your Card Details

Do not panic. But do not wait, either. Take these steps immediately.

Call your bank right now. Use the phone number on the back of your credit or debit card. Tell them that your card details may have been compromised in a phishing attack. Ask them to block the card and issue a new one. If any fraudulent charges have already appeared, report them immediately. The faster you act, the more likely you are to get your money back.

Review your recent transactions. Look for small test charges (often $0.00 or $1.00) as well as larger amounts. Criminals sometimes test a card with a tiny transaction before making a big purchase. Report anything you do not recognise.

Change your Depop password. Even if the phishing page did not ask for your password, it is better to be safe. Choose a strong, unique password that you do not use on any other website.

Enable 2FA if you have not already. This will prevent anyone from taking over your Depop account, even if they manage to steal your login credentials later.

Report the phishing page. Send the URL and screenshots to Depop’s security team. Your report could help protect other sellers from falling into the same trap.

A Final Word From The Security Team

The phishing attack described in this guide was intercepted, verified, and disabled by the Antiphishing.biz security team during their daily link moderation work. The dangerous domain no longer works. But new ones appear every week, using the same tactics, the same fake chat windows, and the same urgent messages.

The criminals behind these attacks are counting on one thing: that you will act before you think. They want you to click first and ask questions later. Do not give them that satisfaction.

Build a new habit today. When a message lands in your inbox claiming your account is in trouble, do not click. Do not panic. Do not chat with “Amelia”. Open a fresh browser tab. Type depop.com with your own fingers. Log in. Check for yourself.

That extra thirty seconds will save you from a world of financial pain. Stay safe out there.

If you found this guide helpful, share it with every seller you know. The more people understand this scam, the harder it becomes for criminals to profit.

That “Buyer” Just Sent You A Payment Confirmation? Stop. Read This First Or Watch Your Bank Account Empty.

Who This Guide Is For

This is for you – the Tise seller who uses the app to clear out your wardrobe, make some extra cash, or run a small second-hand business. You are not a cybersecurity expert, and you should not have to be one just to sell a pair of jeans online.

Tise is a beloved platform, especially in Norway and the rest of the Nordics. It calls itself the largest community for buying and reselling second-hand fashion in the region, with millions of users across Norway, Sweden, Denmark, and Finland. And last year, the global giant eBay saw how special this community is, acquiring Tise to help it grow even further. It is a great place. But as the community gets bigger, the people who want to take advantage of it get smarter.

This guide will show you exactly how a new, highly convincing scam works. We will walk through every step the criminals take, from the first message in your chat inbox to the fake page that tries to steal your card details. We will look at the tricks they use to make you panic, the small details they copy to make their fake page look real, and – most importantly – the simple, everyday habits that will protect your money forever.

The Story Of A Scam That Almost Worked

Let me tell you what happens to a Tise seller when they become the target of this attack. You will recognise the sequence immediately, because it is designed to look just like a normal sale.

Act One: The “Interested Buyer”

It all starts with a message inside your Tise chat. A person expresses interest in an item you have listed. They seem genuine. They ask a normal question. You feel good – a sale might be coming.

Then, suddenly, they claim to have made the payment. They say they have sent the money. But there is a problem. To “receive the funds” or “confirm the sale”, you need to click a short link they provide. They might even sound helpful or a little urgent, saying something like, “Just click this link to complete the transaction on your end.”

This is the hook. The scammer knows that you are excited about the sale. You want it to go smoothly. And because the message comes from inside the Tise chat – where all your legitimate conversations happen – your guard is already down.

In many cases, the link is sent through a shortener or an intermediate web address. This is a deliberate tactic. The criminals use these extra steps to hide the real destination from automated security scanners, making it harder for anyone to flag the link as dangerous before it reaches you.

Act Two: The Page That Looks Just Like Home

When you click the link, you are not taken to Tise. You are taken to a page that is designed to look exactly like Tise.

The criminals have built a perfect visual copy. The layout uses the same typography, the same logo formatting, the same search bar placement, and the same corporate color palette as the real Tise. They even use flawless Norwegian text. If you are a local seller, this page speaks your language with complete accuracy.

This is not a coincidence. This is brand impersonation. The goal is to make you feel comfortable and familiar, so you do not question where you really are.

Act Three: The 24-Hour Lockdown Message

At the top of this fake page, you see a headline that stops you cold: “Hei, din Tise-konto er midlertidig begrenset” – “Hi, your Tise account is temporarily restricted.”

The message below explains that your seller account has been locked. It says you have a strict deadline – within 24 hours – to confirm your identity and your bank details. If you do not act, you will lose access to your account.

This is the panic trigger. The thought of your account being locked, especially right when you are trying to complete a sale, creates instant anxiety. Your brain shifts into problem-solving mode. The urgency pushes you to act fast, without double-checking anything.

And right there, on the page, is a large, inviting button that reads “Verifiser nå” – “Verify now”.

Act Four: The Form That Takes Everything

You click the button. A new page opens. It asks for your full credit card number, expiration date, CVV code, and your BankID codes.

Let me be extremely clear: This is not a verification. This is a harvest.

With these four pieces of information, the criminals do not need to guess anything. They can drain your bank account immediately. They can initiate unauthorized wire transfers without any further input from you. They can sell your complete financial profile – your name, your card number, your security codes – on underground marketplaces where other criminals buy them in bulk.

And here is the part that should make you angry, not scared: A legitimate marketplace never demands that a seller enter full credit card details to receive money for a sold item. Payments on Tise are handled through pre-linked bank accounts. You set up your payment method once. You do not re-enter your card information every time someone buys something from you.

The Three Dirty Tricks That Make This Scam So Dangerous

The criminals behind this operation are not guessing. They have studied how real people think and behave online. They have built their attack around three psychological tricks that are almost impossible to resist unless you know what to look for.

Trick One: They Start Inside The Trust Zone

The initial message arrives in your official Tise chat inbox. That is the most trusted place on the platform. You have had dozens of real conversations there. Your brain has learned to associate that inbox with safety and legitimacy.

By starting the attack there, the scammer bypasses your first line of defense. You do not question the message because it is sitting right next to all your other real conversations. This is a deliberate choice. They are hiding in plain sight.

Trick Two: They Create A Manufactured Emergency

The 24-hour lockdown notice is pure panic fuel. When people are afraid of losing their account – and the money that comes with it – they stop thinking clearly. They stop checking URLs. They stop asking smart questions. They just want to fix the problem as fast as possible.

Incident Report: This deceptive layout was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the dangerous destination URL has been safely deactivated within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "That “Buyer” Just Sent You A Payment Confirmation? Stop. Read This First Or Watch Your Bank Account Empty." phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the live scam infrastructure captured during routine moderation.

The scammers are counting on that exact reaction. The deadline is fake. The lockdown does not exist. The only real emergency is the one they created inside your head.

Trick Three: They Steal Legitimacy From Real Brands

The fake page uses the exact same fonts, colors, and logos as the real Tise. It even copies the official language and tone. This is not an accident. The scammers know that your brain sees those familiar elements and relaxes. The brand has done the hard work of building trust over years. The criminal just steals that trust and uses it against you.

And in case you still have doubts, the page displays a title in your browser tab that says “Tise | TISE.NO”. That looks convincing. But the actual address in your browser’s address bar – the real URL – has nothing to do with Tise. It is a cheap, generic domain like the one identified in this attack, ordernzt.net. The fake title is just window dressing.

The One Rule That Will Save You Every Time

If you remember only one thing from this entire guide, make it this:

Never, ever click a payment or verification link sent to you by another user inside a marketplace chat.

No matter how official the message looks. No matter how urgent the warning seems. No matter how nicely the “buyer” asks.

Instead, do this simple, five-second habit:

Open a new tab in your browser. Manually type the real Tise website address – tise.com or tise.no – into the address bar. Log into your account the normal way. Then check your account dashboard.

If there is a genuine problem with your account, you will see a notification there. Right inside the official platform. If you see nothing – and you will see nothing – then the message you received was a scam. Close it, report it, and move on with your day.

That one habit – typing the official URL yourself instead of clicking a link – will shut down this entire attack before it even gets started.

Expert Tips: How To Stay One Step Ahead Of The Scammers

Here is the advice that security professionals share with their own families. Follow these rules, and you will become a very difficult target for criminals.

Turn on two-factor authentication (2FA) right now. This is your digital seatbelt. It means that even if someone steals your password, they cannot get into your account without a one-time code sent to your phone. Tise supports this. Go into your account settings and turn it on. It takes two minutes and adds a massive layer of protection.

Keep all conversations inside the Tise chat. The Tise Help Center explicitly warns users: if someone asks to move the conversation to another platform like Messenger, WhatsApp, or SMS, that is a major red flag. There is no legitimate reason to take a transaction outside Tise’s own system. Doing so is almost always an attempt to bypass the platform’s security controls.

Never click links sent by another user. This is Tise’s own advice, and it is golden. Links sent in chat messages are often attempts at phishing, where the person tries to obtain sensitive information such as card details. The link might look unusual or overly long, or it might pretend to belong to a legitimate service like a shipping company. If it is a link, do not touch it.

Check the address bar like a detective. Before you enter any personal information on a webpage, look at the browser’s address bar. Is the domain exactly tise.com or tise.no? Are there any extra words, misspellings, or strange endings like .net, .top, or .xyz? If anything looks off, close the tab immediately. The Antiphishing.biz team noted that the fake page in this attack used the domain ordernzt.net, which has no connection to the real platform.

Understand how payments actually work. Tise handles payments through pre-linked bank accounts. You set up your payment method once. You do not re-enter your card details to receive money for a sale. If a page asks for your full credit card information, CVV, or BankID codes to “verify” you, you are looking at a scam. Legitimate marketplaces never demand this.

Be suspicious of urgency. Any message that says “act now or your account will be locked” or “you have 24 hours to verify” is almost certainly a scam. Real companies do not pressure you with ticking clocks. They give you time to respond through official channels.

Use a virtual card for online selling. Many banks and services (such as Revolut, Privacy.com, or others) offer virtual card numbers – temporary cards with spending limits. If you use a virtual card for your marketplace transactions, even if a scammer steals the number, they cannot exceed the limit you set. And you can cancel the virtual card instantly without affecting your main bank account.

What To Do If You Think You Have Been Targeted

Do not panic. But do not wait, either. Take these steps immediately.

Call your bank right now. Use the phone number on the back of your credit or debit card. Tell them that your card details may have been compromised in a phishing attack. Ask them to block the card and issue a new one. If any fraudulent charges have already appeared, report them immediately. The faster you act, the more likely you are to get your money back.

Review your recent transactions. Look for small test charges (often very small amounts like $0.00 or $1.00) as well as larger ones. Criminals sometimes test a card with a tiny transaction before making a big purchase. Report anything you do not recognise.

Change your Tise password. Even if the phishing page did not ask for your password, it is better to be safe. Choose a strong, unique password that you do not use on any other website.

Enable 2FA if you have not already. This will prevent anyone from taking over your Tise account, even if they manage to steal your login credentials later.

Report the phishing attempt to Tise. Use the in-app reporting tools to flag the user who sent you the suspicious message. The Tise Help Center has a simple way to do this. Your report could help protect other sellers from falling into the same trap.

Consider filing a police report. In some cases, especially if you have suffered a financial loss, contacting the police can be an important step.

A Final Word From The Security Team

The phishing attack described in this guide was intercepted, verified, and disabled by the Antiphishing.biz security team during their daily link moderation work. The dangerous domain no longer works. But new domains will appear tomorrow, and the week after, and the month after that.

The criminals behind these attacks are counting on one thing: that you will act before you think. They want you to click first and ask questions later. Do not give them that satisfaction.

Build a new habit today. When a message lands in your chat inbox claiming a payment has been made or your account is restricted, do not click. Do not panic. Do not follow the link. Open a fresh browser tab. Type tise.com or tise.no with your own fingers. Log in. Check for yourself.

That extra thirty seconds will save you from a world of financial pain.

Stay safe out there. And if you found this guide helpful, share it with every seller you know. The more people understand this scam, the harder it becomes for criminals to profit.

Tech Support / Flight Booking Scam

Anatomy of a High-Tier Support & Billing Scam: The Trapped Invoice Method

Threat Intel: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

Actual screenshot of "Tech Support / Flight Booking Scam" phishing interface captured during link moderation on our platform.
Figure 1: Actual screenshot of the active phishing operation intercepted by our security systems.

This image captures a live instance of an aggressive, targeted financial fraud operation known as a “Tech Support / Flight Booking Scam.” Unlike generic mass phishing, this method relies heavily on multi-channel social engineering and highly customized billing infrastructure to bypass traditional security detection.

The Vector of Attack

The deception begins before the victim ever encounters this payment gateway. Typically, the target receives an urgent email or SMS notification masquerading as an automated receipt from a well-known enterprise—frequently an airline, travel agency, or tech corporation.
The notification states that a substantial charge (in this case, $1,278) has already been authorized on their account for an item they never purchased (“Seats”). To create a state of panic, the message explicitly avoids containing a direct refund link. Instead, it provides a toll-free customer assistance number: 1-860-616-0240 (which the perpetrators subtly embedded directly into the URL path of the website).

The Call Center Intervention

When the panicked victim dials the provided number, they do not reach an automated enterprise system. They are connected directly to a fraudulent call center operative. The operative acts as a “support agent,” verifies the fake invoice number (31654), and assures the victim that they can reverse the pending transaction.
To “process the cancellation,” the operative generates a single-use, highly customized short link via an API and sends it to the victim via SMS or chat.

The Deceptive Interface Analysis

The screenshot reveals why this specific landing page is highly effective at exploiting human psychology and bypassing baseline technical automated defenses:

  • Pre-Filled Immobilization (The JWT Exploit): Under “Transaction Details,” every field—including the victim’s full legal name, private email address, phone number, and exact target amount—is permanently hardcoded and locked. The fields are completely uneditable (editable: false inside the technical token). This creates an illusion of a secure, formal system that already “knows” who they are, reinforcing the false legitimacy of the support agent.
  • The “Process Payment” Inversion: The psychological core of the trap relies on an absolute inversion of reality. The operative tells the victim that they are entering their payment details into a “secure cancellation portal” to verify their identity and receive a reverse credit. In reality, the victim is filling out a standard merchant billing portal. Clicking the blue button executes a live charge, immediately pulling $1,278 out of the victim’s account.
  • Exploitation of Third-Party Trust: The page embeds official merchant integration styles for Google Pay and Apple Pay alongside a standard reCAPTCHA widget. The presence of these secure, recognizable global tech components lowers the victim’s critical suspicion, making them feel as though they are interacting with a heavily audited payment architecture.

Key Red Flags for Fraud Detection

  1. The Inversion of Refunds: Legitimate companies never require a customer to input a full credit card number, expiration date, and CVV code on a web form to receive an automated refund or cancellation.
  2. Raw IP and Unverified Domain Chains: The payment form relies on a completely unverified, external payment routing domain (mypayvault.com) that has no structural or legal affiliation with the company the victim initially believed they were contacting.
  3. URL Embedded Directives: Finding a phone number or consumer identifier hardcoded straight into the URL structure (/Airtickt240-860-6160) is a definitive technical marker of an automated campaign infrastructure rather than a standardized corporate billing route.

Fake Xfinity Login Pages

We have discovered a phishing campaign that uses fake Xfinity pages to steal your login credentials. Below is how the attack works, based on real screenshots.

How the Scam Works

Step 1 – The “Thanks for choosing xfinity” lure
The victim lands on a simple page with an Xfinity logo, a “Thanks for choosing xfinity” message, and a button that says “click here to continue”.

Incident Report: This scam layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the hostile origin link has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "Fake Xfinity Login Pages" phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the active phishing operation isolated on our infrastructure.


This page has no real function – its only purpose is to make you click the button and move to the fake login form.

Step 2 – The fake sign‑in page
After clicking, you are taken to a second page that mimics Xfinity’s real login screen.

Actual screenshot 2 of "Fake Xfinity Login Pages" phishing interface captured during link moderation on our platform.
Figure 2: Visual proof of the active phishing operation isolated on our infrastructure.

It asks for:

  • Email / mobile / username
  • Password (not shown in the screenshot, but the next field is implied)

The page includes fake legal text: “By signing in, you agree to our Terms of Service and Privacy Policy.”
There is a “Let’s go” button to submit your data.

Step 3 – Credential theft
When you enter your Xfinity ID and password, the information is sent directly to the attackers. They can then:

  • Access your Xfinity account (TV, internet, billing)
  • Change your plan or order services
  • Use the same email/password combination to attack other accounts (email, banking, social media)

Red Flags You Should Notice

Real Xfinity login pageThis phishing page
URL starts with https://login.xfinity.com/ or customer.xfinity.comSuspicious, unrelated domain (often github.io, free hosting, or misspelled domains)
Shows a green lock icon and valid security certificateNo visible security indicators, or a certificate not issued to Comcast
Has “Forgot password?” or “Create an account” linksMissing standard account recovery options
Professional, consistent designSimple, stripped‑down design – often only the logo and a form
No “click here to continue” intermediate pageUses an unnecessary extra click to lower your guard

How to Protect Yourself

  1. Never click links in unexpected emails, SMS, or social media messages – even if they look official.
  2. Always type the address manually into your browser: xfinity.com or customer.xfinity.com.
  3. Check the URL carefully before entering any password. Look for misspellings (e.g., xfinity-login.xyz) or unusual domains.
  4. Enable two‑factor authentication (2FA) on your Xfinity account – it blocks attackers even if they have your password.
  5. If you already entered your credentials – go to the real Xfinity website immediately, change your password, and check for unauthorized changes to your account.

Share This Warning

Phishing pages like these are hosted on many different domains. If you see a page that looks like the screenshots above – do not enter any information. Instead, report it to Xfinity (Comcast) and help others by sharing this warning.

Banesco Phishing – Fake “Contigo” Login Page

This screenshot shows a phishing page impersonating Banesco, a major bank operating in Venezuela, Panama, and other Latin American countries. The page mimics the bank’s online login interface to steal customers’ usuario (username) and contraseña (password).

Threat Intel: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the dangerous destination URL has been safely deactivated within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

Actual screenshot of "Banesco Phishing – Fake “Contigo” Login Page" phishing interface captured during link moderation on our platform.
Figure 1: Actual screenshot of the live scam infrastructure intercepted by our security systems.

Threat Analysis: Banesco Phishing – Fake “Contigo” Login Page

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The link leads to this fake Banesco login page. The victim is asked to enter:

  • Usuario (username)
  • Contraseña (password)

Options like “Recordarme” (remember me) and links for forgotten credentials are included to appear legitimate. After clicking “CONTINUAR,” the credentials are captured and sent to the attacker. The victim may then be redirected to the real Banesco website to reduce suspicion.

The goal:
The attacker steals online banking credentials to:

  • Log into the victim’s Banesco account
  • View balances, transfer funds, and make unauthorized payments
  • Commit fraud or identity theft

Red flags to watch for:

  • Suspicious URL: The page is hosted on a domain that is not the official Banesco domain (e.g., banesco.com or banesco.com.pa). Legitimate Banesco login pages are only on official bank domains.
  • Unsolicited login request: Banesco does not send links requiring customers to log in to resolve account issues. Always type the official URL directly.
  • Minimal design / missing security features: While the page uses the Banesco logo and color scheme, it lacks the full security notices, personalization, and multi‑step authentication (e.g., security image, captcha, or token requests) present on the real login page.
  • No personalization: A legitimate Banesco login may display a security image or partial account information after username entry – this page does not.

What to do if you encounter this:

  • Do not enter your username or password.
  • If you are a Banesco customer, always access online banking by typing the official URL directly (e.g., banesco.com or your country’s specific domain) or using the official mobile app.
  • If you have already entered your credentials, contact Banesco immediately to change your password and secure your account.
  • Report the phishing page to Banesco’s fraud department.

Protective measures:

  • Bookmark the official Banesco login page and use that bookmark.
  • Use a password manager – it will autofill only on legitimate domains.
  • Enable two‑factor authentication on your bank account if available.
  • Be suspicious of any unsolicited message that asks you to log in via a link.
  • Check the URL carefully – look for misspellings, extra words, or unusual top‑level domains.

The “Carte Vitale” Renewal Scam

This phishing method targets residents of France, but similar schemes are used globally to mimic national health insurance services. Scammers use fake websites like ameli-vitale.fr to steal your sensitive data.

1. The Hook (The “Urgency” Trick)

You receive an SMS (smishing) or an email claiming that your Carte Vitale (French health insurance card) has expired or needs to be updated. The message often includes a warning: “If you do not update your card, your healthcare reimbursements will be suspended.”

2. The Trap (The Fake Website)

The link leads to a professional-looking site that perfectly mimics the official Ameli portal.

Security Notice: This malicious interface was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the hostile origin link has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

Actual screenshot of "The “Carte Vitale” Renewal Scam" phishing interface captured during link moderation on our platform.
Figure 1: Live screenshot of the ongoing fraudulent campaign captured during routine moderation.
  • Official Domain: The ONLY legitimate site is ameli.fr.
  • Fake Domains: Scammers use look-alike addresses such as ameli-vitale.fr, service-vitale-info.com, or renouvellement-vitale.net.

3. The Goal (Data & Money Theft)

Once you are on the fake site, the scammers ask for:

  • Personal Information: Full name, address, and Social Security number (to use for identity theft).
  • Credit Card Details: They claim you need to pay a small “shipping fee” (usually around €0.99) for your new card.
  • The Kill: After you enter your card details, they may also try to intercept your bank’s 2FA (SMS code) to authorize much larger fraudulent transactions.

How to Protect Yourself:

  • Carte Vitale never expires: In France, the physical card does not have an expiration date. You never need to pay to “renew” it online.
  • Trust only the official app: If you have doubts, log in directly through the official Compte Ameli mobile app or type ameli.fr manually in your browser.
  • Check the URL: If the domain contains extra words, hyphens, or ends in anything other than .fr, it is a scam.
  • Government agencies won’t text for money: Official health services will never ask for your credit card details via SMS or email.

Stay safe: If you receive a text about your health card—delete it immediately.