"I put the bike online at 2 p.m. By 2:40 p.m. I already had a text from a buyer. I thought it was wonderful."
It wasn't a buyer. It was a bot — or more precisely a small team equipped with tools that monitor new listings around the clock. Peer-to-peer selling has become one of the most profitable hunting grounds for smishing in France, because it brings together three ingredients scammers love: someone who is waiting to be contacted, a money transaction already in the works, and a mobile number that is often visible or easily obtained.
What makes these scams distinctive is that they look nothing like a classic fraudulent text. There's no glaring spelling mistake, no threat about a frozen account. There's a polite, credible message that arrives at precisely the moment you were hoping for it. That timing does all the work.
How your number ends up in their hands
You displayed it yourself
On Leboncoin, showing your phone number is still a widely used option, particularly for local sales (furniture, appliances, cars). Plenty of sellers switch it on thinking it will "filter out time-wasters". In practice, it makes the number readable by any visitor — human or machine. Scripts crawl the recent listings in a given category and département, extract the displayed numbers and file them into a fresh, highly qualified list: these people are selling something, right now.
You wrote it in the text or on a photo
The classic: "Call me on 06 XX… it'll be quicker". Some even slip it onto the photo itself, thinking they'll dodge the bots. Image text-recognition tools have become trivial; that precaution has offered no protection for a long time.
You handed it over in the in-app messaging
This is the most common tipping point. The exchange starts off properly in the platform's messaging system, then the other party suggests "carrying on by text, it's easier". You give out your number, and you step outside the only environment where the platform can flag suspicious messages, keep records and suspend an account.
Getting you out of the in-app messaging is precisely the scammer's goal. Everything else follows from there.
The four scenarios that come up most in 2026
1. The fake payment "on hold pending validation"
You receive a text announcing that a payment has been made and that it will only be released once you take action: confirm an account, validate a delivery address, pay a "protection fee". A link comes with the message and leads to a page that faithfully mimics the platform's interface or that of a payment service.
The page asks either for your credentials or — worse — for your bank card number "to receive the funds". A seller never needs to enter card details to get paid. That single rule neutralises the majority of attempts.
2. The "home delivery" link sent by the supposed buyer
The buyer explains that they live far away, that they'll use a courier, and texts you a link to "arrange collection". The site replicates the look of a well-known carrier and asks for your bank details so it can "refund your shipping costs". These fake carrier sites have become extremely polished since scammers started using automated page generators.
3. The overpayment to refund
A more homemade scenario, but formidably effective: the buyer claims to have transferred €800 instead of €80, screenshot of the transfer included, and asks you to send back the difference "quickly, it's the rent money". The screenshot is fabricated, the transfer doesn't exist, and the money you send back is very real. Reports of this kind are regularly mentioned by Cybermalveillance.gouv.fr among the classic frauds in peer-to-peer selling.
4. The verification code requested "to prove you're not a bot"
The other party announces they're going to send you a six-digit code and asks you to pass it along. In reality, they are creating an account (email, payment service, classifieds platform) using your number as the verification number. The code landing on your phone has nothing to do with the buyer: it's the key to an account opened in your name.
No legitimate buyer, on any platform, ever needs a code sent to your phone. Not one. It's the single most reliable alarm bell in all of online selling.
Why these texts work when others fail
Classic banking smishing plays on fear. Selling fraud plays on something else: anticipation and politeness.
When you're selling an item, you're the one in need. You're hoping for contact, you're worried the listing will never move, you want to come across as responsive and accommodating. A buyer who writes "Hello, is the item still available? I live in Lille, I can arrange delivery, I'll pay right away" ticks every box of relief.
On top of that, the SMS channel displays no trust signals whatsoever. No full sender address, no profile, no history, no ratings. Just a number starting with 06 or 07 — or an alphanumeric sender name when the scammer uses a professional messaging gateway, which lets them display "DELIVERY" or a platform name instead of a number.
The warning-signs table
| What the message says | What it actually means |
|---|---|
| "Let's carry on by text / WhatsApp, it's easier" | Getting you off the traceable messaging |
| "The payment is pending, validate via this link" | Phishing page |
| "Give your card details to receive the funds" | Bank data harvesting |
| "I sent you too much money, please refund me" | Fake transfer, real loss |
| "Give me the code you've just received" | Account hijacking |
| "My courier needs your details" | Fake delivery site |
| "I'm in a hurry, I'm travelling tomorrow" | Artificial time pressure |
Selling without exposing your number: the method
Keep the conversation where it started
As long as the exchange stays within the platform's messaging, you keep a record you can point to and the platform can step in. A serious buyer living 15 km away has no reason to refuse to stay there until it's time to arrange the meet-up.
Don't display your number in the listing
If the sale is local, a meet-up can easily be arranged through messaging. The number is only handed over at the last moment, to an identified person, for the logistics on the day.
Use a secondary number for sales
For anyone who sells regularly, a dedicated second number solves the problem at the root. A pay-as-you-go SIM card with no commitment is more than enough: it acts as a disposable address, and the day it's drowning in fraudulent texts, you replace it without touching your main number. Dual-SIM phones make the whole thing painless.
Take photos without revealing your address
An item photographed in the living room with a window showing a street sign, a letter lying on the table, a readable car key: these details feed the reconnaissance work. A neutral background changes everything, and a small foldable photo backdrop for objects — or simply a stretched sheet — is enough for clean listings, which incidentally sell better.
Verify payments at the source, never by text
The only verification worth anything is the one you initiate: opening your banking app or the platform's app under your own steam, without clicking on anything. A real payment shows up in the app. A fictitious payment exists only in a text message.
The hand-over in person
Local selling has its own risks, distinct from smishing but often set in motion by the same exchanges.
- Choose a public, busy place. A supermarket car park in daylight, a station concourse, a police station for valuable items: several police stations and gendarmerie brigades officially offer their forecourts as exchange points.
- Don't invite a stranger into your home for a portable item. If the item is a piece of furniture, have someone with you.
- Check the banknotes for large amounts. A counterfeit banknote detector pen costs a few euros and saves you a very bad evening; for a car or professional equipment, an instant transfer verified on your own phone remains the only reliable method.
- Refuse an unverified banker's draft. Fake banker's drafts are still in circulation; verification is done with the issuing branch, called on a number you found yourself.
Shipping: the second blind spot
When the item goes out as a parcel, two risks appear.
The first is the manufactured dispute: the buyer claims to have received an empty box or a broken item. The only effective counter is evidence. Photograph the item, its serial number, the packaging open and then sealed, and keep the drop-off receipt. A digital kitchen scale also lets you record the parcel's exact weight before sending: a discrepancy between the weight declared at drop-off and the one being contested is a formidable argument in the event of a claim.
The second is the fake tracking text. Once the parcel is on its way, both seller and buyer receive genuine tracking messages — which creates the perfect ground for slipping in a fake one. Fake delivery text campaigns remain, year after year, the most reported category of smishing in France. The rule doesn't change: never a link in a tracking text; you open the carrier's app or paste the tracking number into the official site.
What to do when it has already happened
If you entered your bank details
- Immediately call your bank's card-blocking number, or the interbank lost-and-stolen reporting line on 0 892 705 705.
- Block the card and monitor transactions.
- File a complaint, keeping the screenshots of the texts and the pages you visited.
- Dispute the unauthorised transactions: the French monetary and financial code provides for the reimbursement of unauthorised payments, except in cases of established gross negligence on your part. All the more reason never to have validated an authentication notification in your banking app.
If you passed on a verification code
The associated account must be taken back under control without delay: change the password, log out of all sessions, check the registered backup numbers and addresses. If the code related to a payment platform, contact its support to report the fraudulent account opening.
In every case
- Report the sender's number by forwarding it to 33700 (a free service run by the operators).
- Report the listing and the profile on the platform concerned.
- Report the phishing attempt on the Phishing Initiative platform or via Cybermalveillance.gouv.fr, which also points you towards the appropriate steps.
- For a completed banking fraud, the Perceval platform allows online reporting of fraudulent card use.
Five minutes of preparation before publishing
Before putting a listing online, a short routine dramatically reduces your exposure:
- Hide your phone number in the listing options.
- Reread the text and the photos to check that no number, no address, no number plate and no document is visible.
- Decide in advance which payment method you'll accept, and stick to it whatever offers come in.
- Remember that a sale that drags on costs you time, never money — whereas a rushed sale can cost you both.
For heavy sellers, a sales tracking notebook — even a plain exercise book — helps you keep a record of dates, amounts and tracking numbers. It sounds quaint in the age of apps, but it's exactly the document you go looking for when a dispute crops up six weeks later.
Peer-to-peer selling remains a healthy, useful practice, hugely popular in France. The only thing that has changed is that the SMS channel has become a gateway for fraud rather than a simple way to make contact. The defence requires neither technical skill nor permanent suspicion: it comes down to a single principle — keep the transaction in the space where it can be verified, and treat any message that pulls you out of it as suspect by design.
