New Zealand Post is reminding customers that it does not hold or process Facebook Marketplace payments with a new scam doing the rounds on the platform.
Netsafe says they've seen this kind of con before, where instead of a second-hand bargain scammers are actually after your bank account password.
It seems harmless enough selling a second-hand Lego Tower Bridge set and it wasn't long before Aimee O'Malley found an interested Facebook Marketplace buyer.
"A person called Erica. And she asked if she could buy it off me, and if I was OK to ship it, because she was from Kerikeri," she said.
'Erica' said because the item was oversize she would arrange postage through NZ Post at her own expense.
Then she sent a link to O'Malley appearing to show that the cost of the item and postage had been paid, and was sitting there, ready to be withdrawn.
It had the little NZ Post sign, and it was an NZ Post link.
Other Facebook Marketplace users said they have encountered the same message, with the link ultimately asking them to click on their bank so the payment can be transferred through to them.
"It took me through to my Westpac login page, like to put my login, my personal login and my personal password," O'Malley said.
Unfortunately, that's not actually your bank account.
"It's a page that looks like the login to your bank account, what they're doing is they're sitting in the middle between you and your bank, they're stealing your details, your passwords and trying to log into your bank account," said Netsafe chief online safety officer Sean Lyons.
Netsafe said while the 'NZ Post' version of this scam appears to be new they've seen similar versions with buyers claiming to use 'PayPal' or 'eBay' for payment.
Scammers then start making consistent withdrawals from the seller's bank account.
"Maybe a small amount of money, but regularly, weekly or monthly, coming out of your account, in the hope that you don't notice," Lyons said.
NZ Post said it is crucial to note that it does not facilitate payment transactions for third parties on any e-commerce platforms. It has told Marketplace users who have enquired about the link they've been sent, that it strongly advises reporting the Facebook account it came from.
O'Malley was one of those users who luckily called NZ Post before going any further with the so-called sale.
"Just be wary!" O'Malley said.
Not just buyer beware after all, but sellers beware too.
