Brianna was excited after thinking she’d done a deal to sell pre-loved clothes. Moments later she realised $4,000 had been stolen in a sophisticated scam
A nursing student has revealed how someone posing as a buyer on a second-hand clothing store was able to steal $4,000 in a sophisticated online scam.
Brianna Ireland wanted to sell her spare tops, pants and gym clothes to make some spending money after recently moving for university and shaggydecided to list them on Depop – a popular online marketplace for pre-loved clothes.
The 19-year-old said she liked the eco-friendly idea of handing on the items and was contacted by her first buyer in early May, not long after setting up her page, and while still unfamiliar with how the process worked.
The buyer, known as Sarah, messaged Brianna and told her she needed to include her email address on her Depop profile page under the ‘my website’ field because the site’s checkout was asking for that information.
‘I was so excited to sell clothes, I just didn’t think anything of it … I was so caught up in the moment,’ Brianna told 7Life.
Student Brianna Ireland listed some pre-loved clothing items on Depop but a hacker posing as a buyer scammed her
Depop said the ‘buyer’ hacked a genuine user’s account and then emailed Ms Ireland a false sale verification form
The ‘buyer’ then told her to watch for a confirmation email in her inbox to give the sale the greenlight.
The email appeared soon after and included a link to ‘verify the purchase’ which took Ms Ireland to what appeared to be a ‘legit’ Depop site with the customer’s details including the shipping address, their email and phone number.
The website asked her to add her bank details so that she could be paid.
Ms Ireland said at this point she should have noticed the ‘red flag’ because she had already inputted her PayPal details to Depop but dismissed it, assuming that ‘maybe my PayPal account mustn’t have worked for whatever reason’.
She said after inputting her bank details the website seemed to freeze and then told her there was an error and a chatbot appeared asking her if she had a different bank account to try.
‘By this point, I was extremely confused as to why it was asking me this, and then it hit me.’
A frantic Ms Ireland checked her bank account and saw that a $529.22 withdrawal had just been made to ‘Bitinvestor’, based in Denmark.
She immediately rang her bank and was on hold for five minutes, a period in which the scammer tried to make another withdrawal.
By the time Ms Ireland spoke to a staff member, who quickly froze her account, she was in tears.
Another $3,500 had been withdrawn.
The nursing student said she dismissed red flags such as poor grammar as laziness but the experience would not deter her using the site again
But there was some good news, with the employee telling her because they had caught the second payment so quickly they were able to stop the transaction.
The initial $529 payment had already cleared and could not be returned.
‘I’m just so grateful I called the bank when I did, otherwise the payment wouldn’t have bounced back into my account and they definitely would have drained my entire bank account,’ she said.
After reporting the scam to Depop, Ms Ireland said they told her the scammer had hacked someone else’s genuine account to pose as the buyer.
In hindsight the full-time student said there were other indicators she should have picked up on such as the poor grammar, which she assumed was just laziness, and the domain the sale verification email was sent from, which she did not check closely.
She said she has learned her lesson and still uses Depop but is much more careful about the process when using the site and speaking to buyers.
A Depop spokesperson said the site has wide-ranging protection measures in place to block scams and fraudulent behaviour.
‘Our in-app payment systems are designed specifically to keep users safe, and legitimate payments on Depop will only ever be taken within the app or Depop.com.
‘Unfortunately, as peer-to-peer marketplaces become more popular, scammers are using increasingly sophisticated methods to encourage consumers to pay outside of secure platforms — this is an industry-wide issue.’
‘We strongly encourage consumers who are buying and selling anywhere online never to share personal information with other users, to be very wary about following links to other sites, and to report any suspicious behaviour.’
The company recommends only using the genuine Depop app or website to communicate with buyers or input information.
The genuine site is depop.com and genuine emails will be from the domain @depop.com, the business said.
Daily Mail Australia has contacted Depop for further comment.
- For more: Elrisala website and for social follow us on Facebook
- Source of information and images “dailymail“
