Online marketplace fake overpayment (payment hold) scam

An active Fake Overpayment Scam (a.k.a Payment Hold Scam) is detected targeting sellers on multiple online marketplaces - both local and global like Craigslist, Facebook Marketplace, eBay, and other platforms. 

The attack aims to steal personal data, to steal money via "fee payment" and even to steal payment card information. 

This specific variant uses sophisticated banking impersonation and cryptocurrency collection methods.

The target that reported this attack had published an item for sale (a violin) on an online marketplace. They were approached by an scammer identity that acted as a motivated buyer. They built trust by agreeing to asking price without negotiation. The initial process created expectation of easy, profitable sale for the target. 

The scammer asked the target for personal information, documents and bank details to "provide payment". This is the initial theft of personal data, which can later be abused for this or other scams, identity thef or sold for profit. 

The scammer informed the target that they have paid and that they will also cover all transport fees.

The target received a series of three emails in quick succession from citibank@intle-payment.com. Naturally, Citibank will not send an email from such an account. Even more, the domain intle-payment.com is just 66 days old. A bank that's over 200 years old will not be using a fresh 2 months old domain for email notifications for financial payments.

First one impersonating Citibank with a fabricated transaction notification indicating that the money is "received by the bank" and will be released as soon as some transport fees are paid.

Immediately after this email two more emails followed, one providing "payment instructions" for the target to pay 50 euro via cryptocurrency and another threatening one implying that the target had only 12 hours to pay and mentioning "legal action". 

The intention is to scare the victim into rushing a payment without thinking too much, especially since they received a "proof" from the "bank" that the same money will be refunded.

The link "Citi-Bank Transfer" leads to https://buy.chainbits.com which may be a valid crypto purchasing platform, but may be another scam to collect the payment card data. We can't confirm either way, but stealing payment card data is a logical extra step in this scam. But even if a bank works with cryptocurrency, they will direct the user to THEIR OWN branded platform, not a random website.

After these emails were sent, the target got multiple calls and messages from a phone number +18597561701 demanding that the "processing fee" be paid immediately. This additional pressure is designed to push forward the target that's already concerned by the 12 hour deadline and threat of legal action in the emails.

Red flags and inconsistencies

Banking process

• International SWIFT payment fees are deducted from transfer amount, not paid separately
• Banks rarely use cryptocurrency - if at all, and is not their preferred payment instrument since it's much more volatile than fiat currency.
• Real banks never hold transfers for external "transport charges"
• Buying cryptocurrency via a bank link will lead to a bank website, not a random site on the internet.

Domains and emails

• Sent from a domain that has nothing to do with Citibank (whose primary domain is citi.com).
• Pressure tactics and threats - banks don't have deadlines for payments (unless you owe them money specifically)

Process

• If the buyer wanted to buy something and pay for logistics, they are fully able to pay the logistics company
• Persistent calling and pressure
• Phone number appears to be US based, but the fake Payment report mentions the "buyer" is from Switzerland

There are several variants of this scam, for everyone to be aware of:

• "Cashier's check sent but needs processing fee" - they send a check that's fake and will not be processed by a bank, but verification and rejection of a check takes multiple days, and the scammers pressure the target into paying "fees" immediately.
• Fake PayPal/Zelle/Venmo "payment frozen" notifications - very similar to this scenario, but with other payment platforms.
• "Buyer protection fee" requirements - very similar to this scenario, but instead of transport fees, there are other fees to explain the need for payment by the target.
• eBay "Payment processor compliance holds" or "International customs fee" - similar to this scenario, but instead of transport fees, there are other reasons to explain the need for payment by the target.
• "Overseas buyer" overpayments - Send difference back after keeping extra - the scammer creates a fake huge payment, and messages the target to just send back the difference since it's quicker than to cancel the overpayment.

The attack is becoming very efficient, because with bitcoin/crypto money transfers are much faster and difficult to trace. AI is used to generate fake documents and communicate in any language. AI also helps to create voice calls in any language to exert pressure on the target.

How to stay safe

• Don't rush - any deadlines and pressure to do something immediately is a red flag.
• International or overseas offers for local items make little sense. Unless you are selling something unique, nobody cares to buy it globally.
• If it's too good to be true, it's false - be very careful of immediate price acceptance without negotiation
• Never trust overpayments or complex payment processes
• Never trust payment mechanisms you are not comfortable with.
• Consult with someone else