/ Shopping

Scam watch: PayPal T&Cs exploited to defraud seller

Online shopping scam

A Which? member asked us for advice when his daughter unwittingly became liable for an online selling scam using Paypal.

Which? member Richard Hogg told us: ‘My daughter placed an advert on Gumtree to sell her laptop for £250. She received a call from a lady who wanted to buy it, provided it was OK for her dad to transfer the cash, as she didn’t have a bank account.

‘My daughter gave her account details. The money arrived, so she arranged with the buyer for the laptop to be collected in person.

‘A few days later, she was confused to get a call from PayPal saying that one of its customers had paid her for an iPhone but hadn’t received it.

‘Further investigation revealed the scam – the scammer saw the advertised laptop, then placed her own ad to sell an iPhone for £250. Once someone contacted her to buy the phone, she asked if they would transfer the cash into her friend’s account, as she didn’t have one.

‘They agreed and the scammer provided them with my daughter’s Paypal details. The buyer of the iPhone then put the £250 into my daughter’s account, which my daughter presumed had been transferred by the father of the lady who was buying her laptop.

‘When the buyer of the iPhone didn’t receive their paid-for goods, they asked PayPal for a refund. Despite my daughter being the victim of a slick scam, PayPal insisted that she refund the money, as its terms state that customers must only hand over an item to the person who actually paid for it.

‘The scammer has her laptop and the police aren’t interested.’

Our advice on online selling scam

The police concluded that no crime had been committed because the member’s daughter had the money in her bank account – and it should be PayPal that pursues the matter. Sadly, however, because PayPal’s terms of sale were broken, little can be done to get the laptop back.

This is a really sophisticated scam. The only way to avoid it is to refuse payment from anyone other than the person buying the item – and to always post items to the address associated with the PayPal account. We’d recommend obtaining proof of postage too.

Have you ever been affected by a similar type of scam involving a PayPal transaction?


Yes, a slick scam. I am missing a point though, for I cannot see how PayPal is involved if the scammers were obtaining and passing on the daughter’s bank details ( sort code etc). Was it maybe the daughter’s PayPal address which was passed? Perhaps I am a nit picker, but to understand PayPal t&cs, that would be an essential skill.


I must admit I’m equally confused. How did the victim not check who had transferred the money? I admit it was a very slick scam but surely more careful checking would have revealed the problem? The Police said no crime had been committed, but surely fraudulent misrepresentation had occurred? Yes – the members’ daughter had the cash n her account, but the person who took the laptop in effect stole it, as it wasn’t her who’d provided the cash. A lot of unanswered questions…


I can’t see how any bank details have been passed on, simple fraud

Person A selling laptop
Person B says they want to buy and asks for paypal details
Person B advertises iPhone
Person C buys iPhone and pays money to Person A’s Paypal account
Person A hands over laptop to Person B
Person C complains iPhone not delivered

Person C gets refund as iPhone doesn’t exist, person B has laptop, person A has lost out.

Person C doesn’t know who they have paid other than Paypal address, Person A likewise


I am confused. Was the scammer the lady who wanted to buy the laptop in the first place? Or a third person?


THis interests me in so far as the scammer had details of the paypal account going by the prestige of this company and the $billions going through its hands it has a high reputation to uphold. But I found a website detailing how a paypal account can be hacked —more quickly than you think (quote ) . Malware was not used but -quote- they simplky called in , offered the SSN and the four numbers of an old account card , and got in. An email address was added to the account that was made Primary address . This was done against a US software engineer who goes to great lengths to expose scammers on the web. But that wasnt the end 20 minutes later the rogue email address had been added BACK into his account and HIS email address removed and password changed , as he says -quote- “so much for paypal “monitoring ” my account they ( paypal ) couldnt even spot the same fraudulent email address when it occurred the second time . HE then had to provide details of himself again for paypal as paypal had locked the account only when his money was being wired to a 17 year old hacker ( I have withheld his name ) . whats the point – paypal can and is hackable.


What I fail to understand is who did Jims daughter hand the laptop over to “in person” and was she given a false contact address and as Ian makes the point who transferred the money? Was this another case of banking confidentiality on the part of PayPal refusing to disclose the identity of the payer? I am not at all familiar with Paypals T&C’s so can someone enlighten?


Duncan, your comment was as complicated, if not more so than the subject on hand 🙂


Yes – so far as I can see this was a telephone trick. I can’t find any suggestion that PayPal had been hacked.

I am innocent of this form of trading so I don’t know how PayPal set out their terms and conditions, but they ought to make bold and highlight the rules about handing over articles for sale – (a) what should buyers present as verifiable proof of identity, and (b) what identity checks should sellers carry out on their doorsteps; and what is the procedure when (a) doesn’t satisfy (b)? And what rules do Gumtree have – why are PayPal calling all the shots?


As my post says Beryl- -quote- “whats the point ” ( of my post ) that Paypal is not secure . What you are dealing with here Beryl is the technical means used to access somebodies account in Paypal there is no “simple ” way of putting it , much as I would like to simplify it I would need to go through it a step at a time and therefore provide a means for all Which viewers to become hackers.


John , once the hack occurred the scammer THEN had the ability to call Paypal and arrange the transaction as the convo said -quote- the scammer provided my daughters bank details .


No hacking was required in this case. The scammer already had the bank details for the fraudulent iPhone sale because she had offered to buy the laptop. There was no iPhone for sale – that was the ruse. What we don’t know is who collected the laptop.

I agree with Ian. This was a criminal act and the police should have pursued it back through Gumtree’s and PayPal’s records.


No hacking needed at all. Paypal was secure. Fraud was because you should never hand over goods in person for a Paypal transaction, send by post or accept cash on collection


I’ve just been transferring my energy to E.ON – thanks John W., you prompted this as they have a new deal that suits me. However, that has left my brain a little tired, and I, too, am confused by this tale. If money was transferred to Jim’s daughter’s bank account directly from the purchaser’s bank account, then I don’t see where PayPal come into this. Clearly I have missed something, but I wish these Intros were edited to make sure they were clear as to facts. Perhaps it could be modified to explain the true situation more clearly?


Paypal hold all your bank details anybody gaining access to Paypal then has the ability to influence money transactions. Unless somebody is saying they were obtained by accessing the bank or somebody intercepted any transactions taking place on the web to obtain the bank details . This isnt a case of the bank details appearing out of thin air.