The ad on OLX or Facebook Marketplace is yours and it is real. OLX is a Polish classifieds site. The message that then moves the chat to WhatsApp and sends a link is not part of that ad.
This scam usually targets sellers. You list a chair, a bike, or a phone, and within minutes someone writes who wants to buy it without haggling.
What the conversation looks like
The messages below are put together from warnings by CERT Orange Polska and the Polish police. They are not copied from one conversation, but the order is typical.
“Buyer”: Hello, is the bike still available? I’ll take it, no haggling. Can you give me your WhatsApp number? It’s easier to arrange there.
The first step is getting you off the site. On WhatsApp, OLX cannot see the chat and cannot warn you about the link.
“Buyer”: I’ve already paid through OLX with courier delivery. To receive the money, you need to confirm the payment at this link.
“Buyer”: The courier comes today, so please do it within 10 minutes.
The rush is deliberate. You are not supposed to have time to open OLX and check whether any payment is there at all.
Sometimes instead of a link they ask for an email address: “the purchase process needs your email”. A moment later an email “from OLX” arrives, with the same link. The sender’s address in that email has nothing to do with OLX.
What comes after the click
The page looks like OLX. It shows the photo and the name of your item, so it looks believable. Then a list of banks appears. CERT Orange described a version where ten banks worked — the scammers had prepared a copy of each bank’s website.
After you pick a bank, you see a login page that looks real. Sometimes it even carries a warning about scammers. You type your login and password. Then a message appears along the lines of “processing the transaction, this may take up to 5 minutes”.
During those minutes the scammer is at a computer, logging into your bank. They ask for a text-message code or for approval in the app, because “verification requires it”. That approval is a transfer out of your account.
How to recognise it
To get money for a bike you sold, you do not log into your bank through a link from WhatsApp, Messenger, or a text message. No such procedure exists. Payment and shipping stay on the site where the ad is.
The address bar should show the site’s ordinary address, for example one ending in olx.pl. The word “OLX” inside a longer address confirms nothing. CERT Orange described a page that looked like the Polish bank mBank, whose address ended in .top.
Watch the language too. Fake pages often have sentences that read like a bad translation, or grammar a real company would not publish.
The same on Marketplace
On Facebook Marketplace the pattern is similar. The buyer asks for a deposit, for “purchase protection”, or sends a link to “collect the payment”. Facebook does not take payment for these listings through a link pasted in Messenger. If the deal cannot be finished inside the ad itself, it is not that site’s path.
When the password was already typed
Do not open the link “just to look”. If the password was already typed, minutes count. Call the bank at once and ask them to block the card and access to the account. Then the police, and a report on the site where the ad lives.
The points are in the payment-link checklist. What to do after typing a password: the first minutes after a code.