The Perfect Deal or the Perfect Trap? How to Investigate Online Sellers Like a Pro
It was a Tuesday evening when Mark found it: the holy grail of online marketplace listings. A lightly used, top-tier Sony A7III mirrorless camera, complete with two lenses and a carrying bag, listed on Facebook Marketplace for just $600. For context, that bundle usually retails for well over $2,000.
Mark’s heart raced. He had been saving up for months, and this was the exact setup he needed for his upcoming trip to Europe. The seller, a guy named "David," had a friendly-looking profile picture featuring a golden retriever. The description was detailed, mentioning that he was selling it because he "recently upgraded and just wanted it gone to a good home."
Mark immediately sent a message: "Is this still available? I can pick it up tonight."
Within seconds, David replied. "Hey Mark! Yes, it is. But I actually just moved to a military base in Texas yesterday for deployment, so I had to take it with me. I can ship it to you overnight via FedEx if you can pay through Zelle or Apple Pay. Let me know quickly, I have three other people asking about it."
Suddenly, the excitement in Mark's stomach curdled into a knot of suspicion. The "perfect deal" had just hit the classic scammer trifecta: a price too low, an excuse for why they couldn't meet in person, and a high-pressure rush to pay via an untraceable method.
But Mark didn't just walk away. He decided to do a little digging. He was about to use Open-Source Intelligence (OSINT) to pull back the curtain on "David."
The Growing Epidemic of Marketplace Scams
Before we dive into how Mark exposed the scam, it's important to understand why this is happening. Across the US and the EU, online marketplace scams are an absolute epidemic. Platforms like Facebook Marketplace, Craigslist, eBay, and Vinted have become hunting grounds for organized cybercriminals.
According to recent consumer protection reports, billions of dollars are lost annually to fake sellers and payment fraud. The formula is almost always the same: steal photos of a high-value item (cameras, laptops, cars, purebred puppies), list it at a jaw-dropping price, invent a sympathetic reason why they can't meet in person (military deployment, sudden move, tragic loss), and demand payment through non-refundable platforms like Zelle, CashApp, or crypto.
The platforms struggle to moderate these fake accounts because scammers create them by the thousands, often using stolen identities. That means the responsibility of verification falls entirely on you, the buyer. Fortunately, you don't need to be a hacker to spot a fraud. You just need to know where to look.
Step-by-Step: How to Investigate a Seller Using OSINT
OSINT sounds like a term reserved for intelligence agencies, but it simply means using publicly available information to find the truth. Here is exactly how Mark investigated "David," and how you can do the same.
Step 1: The Profile Autopsy
Mark started by clicking on David's Facebook profile. At first glance, it looked okay—there was a profile picture and a cover photo. But OSINT requires looking closer.
- Check the creation date and activity: Mark noticed that David's profile picture and cover photo were both uploaded on the exact same day, just two weeks ago. Legitimate profiles usually have a history spanning years.
- Look at the URL: Mark checked the URL of the profile. While the display name was "David Smith," the URL slug read
facebook.com/sarah.jenkins.984. Scammers often buy hacked, aged accounts and change the display name, but they forget (or are unable) to change the original URL slug. - The Friends List and Reviews: David's friends list was hidden, there were no seller ratings, and there was zero interaction (likes, comments) from real people on his public posts.
Step 2: The Reverse Image Search (The Smoking Gun)
This is the most powerful tool in your anti-scam arsenal. Scammers rarely take their own photos; they steal them from legitimate listings on other websites to create duplicate scam listings.
Mark right-clicked the photos of the Sony camera and saved them to his desktop. He then went to Google Images (you can also use TinEye or Yandex Images) and uploaded the photos.
Boom. Within three seconds, Google returned a match. The exact same photos—down to the lighting and the angle of the camera strap—were found on a completed eBay auction from six months ago, sold by a user in California. "David" had simply right-clicked, saved, and re-uploaded someone else's life.
Step 3: Analyzing the Text
Scammers are running a volume business. They don't have time to write unique descriptions for every fake listing. They copy and paste.
Mark copied a specific, slightly unusual sentence from David's listing: "Includes the original box, manuals, and a custom leather half-case that has a small scuff on the bottom left corner."
He pasted that exact phrase into Google, putting quotation marks around it ("Includes the original box...") to force an exact match search. The search results brought up a Reddit thread from a photography gear-swap forum from 2023. The text was a 100% match.
Step 4: The Phone Number and Email Check
Before Mark could even confront him, David sent an email address to use for the Zelle payment, along with a phone number "just in case."
Mark took the phone number and typed it into Google. He also used a free reverse phone lookup tool. The results showed that the number wasn't a standard mobile line from Verizon or AT&T; it was a VoIP (Voice over Internet Protocol) number, like Google Voice or TextNow. While legitimate people use VoIP numbers, scammers rely on them almost exclusively because they are free, anonymous, and can be generated from anywhere in the world.
Next, Mark searched the email address. He didn't just Google it; he searched it on Twitter and scam-warning forums. Often, scammers reuse the same email addresses for receiving funds until they get shut down. In this case, the email didn't bring up any direct hits, but the VoIP number was enough to add to the growing mountain of red flags.
Step 5: Verifying Location Claims
David claimed he had just moved to a military base in Texas. Mark looked closely at the background of the camera photos. Through the window behind the camera, you could clearly see a row of distinct, terraced brick houses and a double-decker red bus passing by. That wasn't Texas. That was London.
While this level of geographical profiling (geolocation) isn't always possible, always look for inconsistencies in the background. Are the electrical outlets European while the seller claims to be in Ohio? Is there snow on the ground in the photo when it's August in Florida?
Step 6: The Communication Test
Mark decided to have a little fun. He replied to David: "Okay, I'm fine with shipping. But just to be safe, can you take a quick picture of the camera right now with a spoon resting on top of it?"
This is the ultimate scammer kryptonite. A real seller will think it's a weird request, but they'll do it because they want the $600. A scammer can't do it, because they don't actually have the camera.
David's response was immediate and aggressive: "Bro, I don't have time for games. I'm packing for deployment. I have three other people waiting. Are you sending the Zelle or not?"
The fake urgency. The refusal to provide proof of life. The trap was fully exposed.
The Outcome
Mark didn't reply. He reported the listing to Facebook, flagged the profile as fake, and blocked "David." When he checked back from a different account the next morning, the profile had been deleted. Mark kept his $600, and a few weeks later, he found a legitimate, fairly-priced camera from a local seller he met at a coffee shop.
Your Anti-Scam OSINT Checklist
You don't need to be a digital detective to protect your wallet. The next time you find a deal that makes your heart race, pause and run through this quick, actionable checklist:
- Reverse Image Search Everything: Never trust a listing photo. Run it through Google Lens or TinEye. If it appears elsewhere on the internet under a different name or date, walk away.
- Check the Profile URL: Does the name in the URL match the display name? If the display name is "John Doe" but the URL is "facebook.com/maria.garcia.12", it's a hijacked account.
- Search the Text: Copy a chunk of the description and Google it in quotes. Scammers copy-paste.
- Demand "Proof of Life": Ask the seller to take a new photo of the item with a specific, random object (a spoon, today's newspaper, a shoe) or a piece of paper with your name written on it.
- Beware the "Out of Town" Excuse: If you are on a local marketplace app and the seller suddenly claims they are out of state, in the military, or working on an oil rig and need to ship it—it is almost always a scam.
- Never Use Untraceable Payments for Strangers: Zelle, CashApp, Venmo (Friends & Family), Apple Pay, and wire transfers offer zero buyer protection. Once the money is sent, it is gone forever. Only use cash in person (at a safe public location) or PayPal Goods & Services.
What to Do If You Realize You're Being Scammed
If you're in the middle of a transaction and the red flags start waving, stop immediately. Do not let the seller pressure you. Scammers use urgency to bypass your critical thinking.
If you have already sent money, contact your bank or the payment platform immediately to report fraud, though recovery is often difficult. Report the user profile to the platform, and file a report with your local authorities or national cybercrime center (like the IC3 in the US or Action Fraud in the UK).
The internet is full of incredible deals, but it's also full of predators. By taking just five minutes to apply these basic OSINT techniques, you can ensure that the perfect deal doesn't turn into the perfect trap.