How to Spot a Scam as a Marketplace Seller

Recently, I received a message via Michael’s Makerplace platform saying that I allegedly made a sale. If you’re not familiar with this platform, it is a marketplace for handmade creators similar to Etsy. I made a post about it when it opened, so you may read it here. The message turned out to be a marketplace scam! I will quote the message below and attach a screenshot, as well as describe how to recognize and deal with the scam.

“Dear User, we are pleased to inform you that your item has been successfully purchased and the buyer has selected the USPS shipping method. To obtain the shipping address and confirm the funds to the seller, please copy the link, paste it into your browser address bar and complete the initial verification of the shipping service. If you have any questions or need additional assistance, feel free to contact our support team. Regards, Technical Support”

The message allegedly came from the Technical Support, but why would a sale notification come via a private message rather than system email notification. Technical Support doesn’t message users in their dashboard, this messaging mailbox is for customer communication only. Additionally, the wording and spacing is off in some places of the message. For example, “confirm the funds to the seller” doesn’t quite make sense. Next, they are asking to copy and paste a link in your browser. That’s a major red flag 🚩 right there! Any request to complete an external form is a scam. I would recommend to not open the link at all, as simply opening it might infect your device.

Finally, Michael’s Makerplace has a separate order manager in the dashboard. To check whether there’s an order, just click “Orders” on the left of your dashboard. If there is no such order, then it’s definitely a scam. You may safely report and delete the message.

How to recognize a fake URL?

To recognize a fake website, look at the end of the URL rather than at the beginning. The “https://” is the protocol that tells your browser how to access the URL. Then, the scammers like to throw in several legit-looking website addresses. The domain name right before the forward slash is an actual website. In this case, “ne****1-13.top” is the actual website. I masked with asterisks a part of the website address for security reasons. What scammers want you to look at is the beginning of the URL that sort of looks safe as it starts with “usps.” It can be mistaken for the United States Post Office website, and that’s exactly what the scammers are counting on. So please do not get confused by the legitimately looking beginning of the URL, as it is a subdomain of a strange and unfamiliar website. There can be several subdomains, so every time you see a dot after “https://” and up until the last dot before the “/”, it separates a subdomain. For example, https://subdomain1.subdomain2.subdomain3.domain.com/php/script.other/page.php. In this example, I bolded the actual website that you’ll end up visiting. Please don’t try to visit it, I made up this URL as an example.

Here’s a diagram on how to recognize a fake URL:

What’s the point of fake websites?

With the rise of online shopping, comes the rise of marketplace scams. Such questionable websites might have several goals. For example, gathering personal information or installing malicious software. The design of such website might look similar or sometimes even exactly the same as a legit website. The expectation here is that unsuspecting user would enter their account information thinking it’s a legit website. In reality, scammers will obtain user’s actual password for that legit website. Additionally, there might be an address and personal information confirmation form. Never enter any information on such websites, see the above section on how to recognize a fake URL. Finally, such websites might contain malicious scripts that exploit user’s device vulnerabilities and hijack or infest the device. Whenever you receive a questionable link, never open it. If unsure, seek help in your favorite search engine or ask friends and family. It’s better to ask a silly question, than deal with the consequences of an uninformed click.

To Conclude

Here’s a list of questions one has to ask themselves to avoid being scammed:

1. Did the message come through a legitimate channel? 🚩
2. Does grammar and punctuation make sence? 🚩
3. Is it styled or plain text without images and breaks between paragraphs? 🚩
4. Does it contain a link to an external website? 🚩
5. Is the URL legit? 🚩

If the message in question fits any of these, do not click the link, instead ask friends of family or consult with a search engine. Be safe!