Scammers operate on every classifieds platform, trying to steal money or payment data from sellers and buyers. This page explains how the most common phishing attempts work and how to protect yourself.
Ibex Arms will never ask you…
- for your card details to “receive” a payment. Receiving money never requires the full card number, expiry date or CVV code.
- for your password via a link, email, SMS or chat message.
- to pay or get paid through the platform: Ibex Arms does not process payments. Transactions happen only between seller and buyer.
- to create shipping labels or use a “partner” courier. There is no Ibex Arms shipping service.
- to confirm or unlock your account via a QR code, SMS or WhatsApp.
How the typical scam works
- A fake buyer contacts you shortly after your listing goes live, often in a great hurry and without asking anything about the item.
- They propose handling payment or shipping via an alleged "courier service" or "secure payment service".
- They send you a link or QR code (via chat, SMS, e-mail or WhatsApp) to a page imitating a well-known service, where you are asked to enter your credit card details "to receive the payment".
- Whoever enters their details receives nothing: the scammers use the card to withdraw money.
The most common scams, channel by channel
In the platform chat
A fake buyer accepts the price without haggling and immediately suggests a “secure payment service” or a courier who will collect the item. They want to get you out of the chat, where links are blocked.
By email
A message imitating Ibex Arms, a bank or a courier: “you have received a payment”, “confirm your account”, “listing in violation”. The link leads to a cloned page that steals credentials or card details.
By SMS
A short text with a shortened link: “parcel on hold”, “payment pending”, “verification required”. On a phone the real address is hard to read — which is exactly what they count on.
On WhatsApp or Telegram
After first contact, the other party asks to continue there. Outside the platform they can send you links and QR codes unfiltered, and we can no longer review the conversation.
With a QR code
A QR code “to receive the payment” or “to confirm shipping”. Scanning it opens a fake page without you ever seeing the address: it is a disguised link.
Fake shipping and payment services
Pages copying the look of well-known couriers or payment services, with the service name in the address to seem genuine. They ask for card details “to credit the amount” — in reality they use them to withdraw.
Examples of scam messages
Messages reconstructed from real cases. Each box highlights the clues that give it away.
The seller in a hurry
Hi! I already have several requests. If you want to close right away, just make the bank transfer and I will ship it today, so you are sure to get it. I cannot do a hand-over, I am away for work until the end of the month.
- Pressure with “other requests”
- Asks for payment before you have seen the item
- Refuses hand delivery with an excuse
- After the transfer they vanish: the item does not exist
The buyer who buys sight unseen
Hello, I will take it, full price is fine. I pay through the protected delivery service and send the courier to collect it. You will get a link to receive the money, just enter your card details for the credit.
- Buys without seeing the item and without negotiating
- Introduces an external “service” that does not exist
- Asks for card details to “receive” a payment: never needed
- Ibex Arms has no couriers or delivery services
The fake payment SMS
IBEX ARMS: you have received a payment of CHF 850.00. To release it, confirm your details within 24 hours: ibexarms-payments.ch/release
- Ibex Arms does not process payments: it cannot have received one for you
- Fake domain: “ibexarms-payments.ch” is not “ibexarms.ch”
- A 24-hour deadline to stop you from thinking
The fake support team
Your listing violates the rules and will be removed within 24 hours. To prevent this, log in to your account via this link and confirm your identity.
- Threat + urgency: the classic combination
- We never send links “to log in to your account”
- If there were an issue with a listing, you would see it in your dashboard
How to read a link before clicking
The real domain is the one right before the first slash “/”, read from right to left. Everything before it can be made up.
ibexarms.ch/listing?id=123
Correct domain: “ibexarms.ch” right before the slash.
ibexarms-payments.ch
A hyphen changes everything: it is a different domain, which anyone can register.
ibexarms.ch.account-check.com
The real domain is “account-check.com”. Here “ibexarms.ch” is just a decorative subdomain.
ibexarrns.ch
Look closely: “r” + “n” instead of “m”. On a phone it is almost invisible.
bit.ly/3xK9…
Shortened link: the destination is hidden. From a stranger, do not open it.
- Hover over the link without clicking: the real address appears at the bottom of the browser. On a phone, press and hold.
- If you want to visit a service, type the address by hand instead of following the link you received.
- An “https” padlock does not mean the site is genuine: scam sites have it too.
Test yourself
Could you tell a genuine message from a fake one? The free test by “eBanking – but secure!” (Lucerne University of Applied Sciences) shows real examples and where people get fooled.
Take the phishing testThe golden rules
- As a seller, never share your credit card details to receive a payment. Receiving money never requires the full card number, expiry date or CVV code.
- Never share your credentials or credit card data, neither by phone nor on a website you reached via a received link or QR code.
- To log in to a service, always type the website address manually into your browser.
- Always check that the website you are visiting matches the official address of the service provider.
- Stay vigilant when scanning QR codes.
- Ibex Arms offers neither delivery nor payment services: transactions take place exclusively between sellers and buyers. Therefore, do not click on any link and do not scan any QR code received from other users via chat, SMS, e-mail or WhatsApp.
More warning signs
- The other party immediately wants to move the conversation to WhatsApp, Telegram or e-mail.
- They offer more than the asking price or buy without negotiating and without seeing the item.
- They put pressure on you: "I must close the deal today", "I'm leaving tomorrow".
- They ask for an advance payment (Twint, bank transfer, gift cards) to "reserve" the item.
- Messages in unnatural or error-ridden language, often machine-translated.
What we do
- The Ibex Arms chat automatically blocks links: no user can send you links to payment pages or external websites.
- Listings reported by multiple users are automatically hidden pending review.
- Every listing has a "Report listing" button: use it whenever something feels off. Reports are anonymous.
Fell victim to a phishing attempt?
- Contact your bank or card issuer immediately and have the card blocked.
- Change your Ibex Arms password right away, along with any other service using the same password.
- Report the incident to the Swiss National Cyber Security Centre (NCSC) and, in case of financial loss, file a complaint with the police.
- Report the listing or user involved to us: we act quickly.