In a context of high exposure to online scams, incidentals fraud PayPal targeting sellers on second-hand platforms is far from being an isolated phenomenon. According to Crédoc, 73% of Internet users were confronted with an attempted scam or fraud on the Internet in 2025, and 39% say they have already been victims. Cybermalveillance.gouv.fr places phishing at the top of the threats targeting individuals last year, with 32.9% requests for assistance.
Second-hand platforms constitute a particularly favorable environment: rapid exchanges, unknown profiles and pressure to conclude quickly. The buyer appears serious, confirms that he wishes to acquire the item and announces Immediate payment via PayPal. A few minutes later, the seller receives an email informing them that the payment is “pending” and that fees must be paid to finalize the transaction. It is at this precise moment that the fraud takes place: convinced of quickly recover the proceeds of its salethe victim agrees to advance 20, 30 or sometimes 50 euros.
How fraudsters hijack PayPal codes
The scenario is based on very well-maintained confusion. Yes, PayPal may charge certain fees, including on payments for goods and services, international transactions or currency conversions. On its help pages, the platform details these specific cases. Most often, these fees are automatically deducted at the time of the transaction or covered by the payment issuer. They appear directly into the PayPal account from the seller and not in the form of an amount to be sent separately to “unblock” a payment.
François Duvar, cybersecurity expert, deciphers the mechanics: “The seller thinks that the money is already there and that only one formality is missing. It is precisely this sense of urgency that fraudsters exploit. » The expert also insists on the most reliable reflex: “It is always necessary open your PayPal account directly from the application or the official website, without going through the link received in the email or SMS. If the payment does not appear in the account activity, it should be assumed that it does not exist. »
A mechanism that can quickly increase the damage
Once the first costs have been paid, the scammer often comes back: “verification incomplete”, “payment suspended”, “additional security check”. The seller is reluctant to stop: he has already paid and hopes to recover the price of his item. This is where the damage increases. “The more money the victim has advanced, the more he wants to believe that the transaction will be successful. The fraudster voluntarily maintains this illusion until the last moment”underlines François Duvar.
In some cases, the fake link is also used to retrieve PayPal credentialsA IBANa bank cardor even an address or telephone number. This information can then be reused to attempt other fraudulent operations or fuel new phishing campaigns. The most expensive scenario also exists: the seller pays the incidentals… then ships the package without ever receiving the announced payment.
How to react and spot warning signs
If in doubt, or if an amount has already been paid, it is better to act without delay. If bank details or a card have been entered via a false link, you should contact your bank immediately to object or contest the transaction. Victims can also make a report on Cybermalveillance.gouv.fr or via the PHAROS platform. Finally, keeping all exchanges, emails, SMS and screenshots can be useful for documenting the facts and supporting possible actions.
Several signals should also alert you. A buyer who is particularly in a hurry, who refuses secure payment from the platform or pushes them to click on an external link, requires vigilance. Same caution when a request for money occurs before payment is received or when a message displays an unusual address or an insistent tone. Finally, a payment visible only in an email, but absent from the account PayPalshould be considered an immediate alert.
As François Duvar summarizes: “The simplest point to remember is also the most effective: a payment that does not appear in your PayPal activity does not exist. » Note that this type of maneuver constitutes fraud, an offense punishable by 5 years of imprisonment and 375,000 euros fine, in accordance with article 313-1 of the Penal Code.
