Hacked-account scams on the rise on Swiss marketplace Ricardo

On the Swiss online marketplace Ricardo, cases of hacked customer accounts used for unauthorized purchases are increasing. Swiss public television's «Kassensturz/Espresso» programme reported this on 26 March 2026.

One case described in the programme involved a seller who had listed two working smartphones for sale. Within 24 hours, the listings appeared sold, but the buyers named knew nothing about it: their Ricardo accounts had been hacked and used without their consent to make purchases.

How the scam works

According to SRF's account, the criminals proceed in several steps. First, they gain access to an email account, for example on Gmail or GMX, through phishing attempts or data leaked online. With that access, they reset the password of the linked Ricardo account and take it over. They then use the stolen account to contact real sellers and pressure them to close the deal quickly. Finally, they send a link by email, text message or WhatsApp that is supposed to be used to receive a payment, but is actually meant to steal data or money.

Ricardo has recorded a roughly 20 percent rise in fraud cases since the start of 2026. In February alone, several hundred fraud cases were reported to the platform. The number remains small relative to the overall volume: the platform handles more than 500,000 transactions every month.

Ricardo spokesperson Mojca Fuks rules out an internal security problem at the platform or a data leak caused by Ricardo itself. According to Fuks, there is no single explanation for the increase: it is more of a cat-and-mouse game, in which fraudsters constantly look for new methods. Swiss Marketplace Group, the company that runs Ricardo together with Tutti.ch and Anibis.ch, invests several million francs a year in security.

SRF and Ricardo recommend some precautions. Sellers should be wary of buyers who push for a quick deal and should cut off contact immediately if they receive a link to «receive» a payment. Credit card details should never be given out to receive payment for a sale. Two-factor authentication is also recommended, both for email and for services like Ricardo, along with strong, unique passwords for each service. Any attempted fraud should be reported directly to the platform.