The Singapore Police Force issued an advisory on 23 October urging second-hand marketplace sellers to reject payment instructions embedded in PDF invoices purportedly from buyers, after investigators documented 63 cases with total losses of about S$180,000 since the pattern resurfaced on Carousell listings, according to the release posted on police.gov.sg.
How the fake invoice works
Fraudsters posing as buyers send a link or attachment styled as a shipping or escrow invoice. When the seller opens it on a mobile device, they are prompted to log in to internet banking to “receive” funds. The page is fake, but credentials entered there allow criminals to drain accounts or authorise transfers before victims notice. Police said the PDFs often mimic legitimate courier branding without being sent through official channels.
Unlike simple phishing SMS trails, this variant exploits sellers’ expectation that buyers will share paperwork for tracked delivery. Scammers combine chat urgency—“I need the receipt today”—with small upfront deposits to appear credible.
What police want sellers to do
SPF told sellers to take payments only through in-app or bank transfer methods they initiate, never through login pages delivered by strangers. Verify buyer profiles, insist on cash or PayNow at meet-ups for high-value goods, and report suspicious chats via the police anti-scam helpline. Officers stressed that marketplaces do not require sellers to authenticate bank access to release listing fees.
Carousell’s public safety pages remind users that the platform does not escrow payments via third-party invoice links. The company has been cooperating with police on account takedowns when alerted, though SPF noted many fraudulent profiles are spun up quickly with stolen photos.
Red flags beyond the PDF
Victims interviewed in prior cases said buyers refused face-to-face collection despite listing items as meet-up only, pushing courier arrangements instead. Others reported buyers overpaying then asking for refunds through a “vendor portal,” a variant of the same credential harvest. Police said anyone asked to install remote access tools while “testing payment” should stop immediately.
Banks have tightened fraud monitoring, but recovery is difficult once transfers leave local accounts. The 23 October advisory therefore focuses on prevention at the click stage rather than post-loss tracing.
Broader scam climate for casual sellers
The Carousell invoice wave arrives as overall e-commerce scam reports remain elevated in national statistics. Community volunteers running neighbourhood buy-sell groups told InfoHandle they are pinning SPF links atop chats ahead of year-end decluttering, when listing volume spikes.
For households clearing electronics and furniture, the practical rule after the advisory is simple: if a buyer sends a document that demands banking login, end the deal and file a report with screenshots. The 63 cases documented this quarter show the tactic still works when sellers rush to close a sale before weekend delivery cut-offs.
How losses reached S$180,000
Police breakdowns show several victims lost five-figure sums in a single session after entering one-time passwords on fake pages that mirrored their banks’ colours and fonts. Others lost smaller amounts repeatedly across multiple listings, treating each failed sale as bad luck rather than a coordinated pattern until account balances emptied.
SPF coordinates with the Anti-Scam Centre to freeze mule accounts when reports arrive within hours, but overseas transfers shorten recovery odds. The 23 October advisory therefore repeats familiar advice: activate transaction limits for online banking, use hardware tokens where available, and never share OTPs with anyone claiming to be a buyer.
Platform and bank responses
Major retail banks said they are flagging marketplace-related phishing domains faster, while Carousell encourages sellers to complete deals inside supported payment flows. None of that removes the seller’s obligation to treat unexpected PDF invoices as hostile until verified through official apps.
Neighbourhood police centres scheduled evening talks for estate councils on spotting phishing PDFs, extending the 23 October advisory into grassroots channels where many Carousell deals still close. Volunteers plan to demo how legitimate PayNow receipts differ from fake login pages that mimic bank branding.