Fake safe-payment links: how the 안전결제 phishing scam works
This is the most effective scam running on Korean secondhand platforms right now, because it turns your caution against you. You ask for safe payment — the safe-sounding thing — and they hand you exactly that, on a website they control.
Updated 8 October 2026
How it runs
You ask to use the platform's protected payment. Good instinct.
They agree enthusiastically and send a link — often with a domain that borrows the
real brand, like danggeun-pay-secure.co.kr or safe-bunjang.com.
The page is a careful copy: right logo, right colours, a padlock in the address bar
because anyone can get an HTTPS certificate.
You enter card details or make a transfer to the "escrow" account shown.
Money goes straight to them. There was never any escrow.
Why the usual advice fails here
"Check for the padlock" is obsolete — certificates are free. "Look for the brand" fails
because the logo is copied pixel for pixel. "Use safe payment" is the advice that led
you here. The reason this scam works is that every surface-level check passes.
The one rule that works
Real escrow never arrives as a link. On Karrot, Danggeun Pay is a button
inside the app. On Bunjang, 번개페이 is inside the app. On eBay, checkout is on
ebay.com and you got there yourself.
If a payment flow begins with a message someone sent you, it is not the platform's
payment flow. Close it and start the payment yourself from inside the app. A real
seller is unbothered by this; they get paid either way.
Tells, if you want them
Hyphens and extra words in the domain — the real one is short.
Asks for card number plus CVC. Escrow services take a payment; they do not need you
to key in a card on their own page.
"The app is under maintenance, use this instead."
The page works but nothing appears in your app's transaction list.
Urgency attached to the link: the window is short because the domain gets taken down.
If you entered card details
Call your card issuer and block the card now. Do this before anything else.
Dispute any charge that has already appeared.
If you also entered a bank login, change it and tell the bank.
Report the domain and the profile to the platform, and file with the police
cybercrime portal.