Ilia Nikolaevich ZavialovDigital security consultant

Buying

How Ilia Nikolaevich Zavialov checks the other side of a deal before paying

Buying from a stranger found online is where most fraud losses begin, and it is also the part of a transaction that receives the least deliberate attention. The listing gets read, the price gets compared, the message thread gets skimmed, and then the money moves. Almost nobody spends as much effort on the seller as on the goods themselves. The question worked through here is a narrow one: what can actually be established about the other side of a deal in the minutes before payment, and which of those checks still carry weight when the seller is willing to lie about everything.

English version for the United States.

Overview / Blog

· 14 min read · Ilia Nikolaevich Zavialov

How Ilia Nikolaevich Zavialov checks the other side of a deal before paying
  1. Why this check pays for itself in ordinary transactions

    In the United Kingdom payment fraud figures for 2025, purchase scams accounted for 71 per cent of all authorized push payment cases, with 118.1 million pounds lost and a rise of 20 per cent over the previous year. Authorized push payment fraud as a whole came to 248,070 cases and 576.4 million pounds. Measured against the 1.28 billion pounds taken by payment fraud of every kind that year, the purchase share of the money looks modest. By case count it dominates everything else, and that ratio describes the problem precisely: a very large number of ordinary people losing an ordinary amount each.

    The same shape appears in the American reporting from a different angle. The Federal Trade Commission logged 3 million reports and 15.9 billion dollars of stated losses for 2025, against 2.6 million reports and more than 12 billion the year before. Growth of that size inside a single year follows from the falling cost of running familiar schemes and from the number of attempts one operator can make in a day.

    Sixty six per cent of authorized push payment cases begin online, on a listing, an advertisement or a social feed, and a further 17 per cent arrive through telephone networks. That distribution matters for the check, because it says first contact almost always happens somewhere identity costs nothing to assert. A shop page, a seller profile and a working telephone number can be produced in an afternoon and abandoned within the week.

  2. The seller who exists only inside the listing

    The first useful question about a counterparty is whether it has any existence away from the page where it is selling. A trading name should return something when searched on its own, a registration number should resolve to an entry carrying dates and officers, and a telephone number should appear in more than one context that the seller does not control. Each of those signals is weak by itself and becomes informative when several of them line up around the same identity.

    In practice this means searching the name and the number as plain text, in a separate window, away from the listing itself. It means looking at whether the photographs in the advertisement appear elsewhere under different contact details, which a reverse image search answers in seconds. None of these steps takes more than a minute, and together they cover the majority of throwaway identities.

    A thin footprint is no evidence of fraud on its own, and that is worth saying plainly, because an honest small trader also has a thin footprint. The distinction lies in whether the thinness is consistent. A genuine new business has a short history that hangs together, with a registration date, a first review and a first post sitting in the same period. A fabricated one has gaps where a history should be, or a history that begins abruptly at full volume.

  3. Age of an identity against the quality of its presentation

    Presentation has become almost free. A shop front with a clean logo, product photography, a page of policies and a wall of testimonials can be assembled in a day by somebody holding no goods at all. Buyers read polish as a proxy for substance because for a long time polish was expensive. That relationship has broken, and any check built on how professional a seller looks now measures the wrong thing.

    Time behaves differently. An account with three years of unremarkable activity behind it is expensive to counterfeit for the simple reason that it costs three years. This is why the creation date of a profile, the date of its earliest posts and the spacing of its activity carry more weight than everything visible on the surface. An operator who needs a fresh identity every few weeks cannot afford to age one properly.

    Reviews deserve the same treatment, read by date and by distribution before the average is looked at. Twenty positive reviews left across two years by accounts with histories of their own mean something. Twenty posted in a fortnight by accounts created in the same fortnight mean the opposite, and the pattern is visible without any special tooling. The complete absence of a lukewarm review across a large number of sales is itself unusual, since real trading produces the occasional disappointed buyer.

    Photographs carry a similar signature. Catalogue images taken from a manufacturer say nothing about whether this seller holds the item, and the same set of amateur photographs appearing under three different names across two marketplaces says a great deal. The question worth asking of any image is whether it could have been taken by this seller, in this place, of this specific object.

  4. A price is a description of what is being sold

    Every discount has a cause, and in an honest transaction the cause is usually boring: stock left over from a season, a superseded model, a returned item, or an owner who wants the thing out of the house this month. Causes of that kind survive a direct question, because the seller has a specific and slightly tedious explanation that fits the object in front of them. Unexplained cheapness works differently, and its purpose can be stated plainly. It buys speed.

    A price well below the market rate compensates the buyer for the checks they are about to skip. It creates a reason to move before somebody else does, and the urgency it manufactures is the actual product on offer. The size of the gap between the asking price and the ordinary price is a rough measure of how much verification the seller expects to be waived.

    The behavior worth watching is what happens when the price is questioned. A trader with real stock gives a flat answer and returns to the practical business of arranging delivery. A seller with nothing to deliver responds to the question with pressure, sentiment or a new deadline, because the conversation has moved somewhere the story cannot follow. That reaction is available for free, before any money is committed.

  5. The payment route is the part that cannot be undone

    Payment methods divide into those where somebody other than the seller can stop or reverse the transfer and those where nobody can. A card payment for goods, a platform's own protected payment and an escrow arrangement all sit in the first group. A bank transfer to a personal account, a cryptocurrency wallet, a gift card code read out over the telephone and a payment marked as being between friends all sit in the second. The whole of the fraud depends on moving the buyer from the first group into the second.

    This is why the payment instruction is the single most informative moment in a purchase. A seller who insists on an irreversible route has revealed what the transaction is for, and no explanation offered alongside the insistence changes the mechanics. The explanations are always plausible, which is what makes them work: a fee, a technical fault, a suspended account, a discount for paying directly, a preference for keeping things simple.

    The response that costs nothing is to wait. If the protected route is genuinely broken it will come back, and a seller with goods will still be there. The request to move off the protected route serves one purpose, and declining it removes the entire loss scenario, whatever the seller's intentions turn out to have been.

  6. A familiar voice on the telephone has stopped being evidence

    Voice has quietly lost its standing as an identifier. In controlled testing, listeners separated a genuine recording from a synthetic one in 37.5 per cent of attempts, a result worse than they would have managed by guessing. That figure deserves a moment of attention, because most people still treat hearing a voice as confirmation that they know who is speaking.

    For a purchase, this changes what a telephone call is good for. A call still reveals a great deal about how a seller handles questions, how specific their answers are and whether their account of the item holds together under detail. Identity is the one thing it no longer establishes, and any check that ends with the phrase «I spoke to them» is resting on the part that has stopped working.

    The repair is procedural. A number taken from the conversation itself proves nothing, since the caller chose it. A number taken from a register entry, an official site, a printed invoice or an earlier statement is independent of the caller, and dialling it puts the burden of being reachable back where it belongs. The same principle applies when a seller rings to hurry a payment along, which is the moment a call is most worth verifying.

  7. Asking for something only a holder of the goods could produce

    There is a family of requests that separates a seller holding the item from a seller holding photographs of it, and all of them work the same way. The buyer asks for something that could only be made now, by a person standing next to the goods: a picture with a handwritten slip carrying today's date and the buyer's name, a short video shot from an angle the buyer chooses at the moment of asking, or a serial number read off the object and checked against the manufacturer's records. None of these requests is unusual, and honest sellers meet them without much comment.

    The request works by imposing cost. A determined operator could stage any one of them, and occasionally does. What they cannot do is stage them for every buyer, because these schemes run on volume and volume dies the moment each contact demands ten minutes of individual work. Raising the price of pretending is the realistic goal of a pre-payment check.

    The reported numbers support that reading. In imposter reports to the Federal Trade Commission, four out of five involved no monetary loss at all, which means attempts outnumber successes by a wide margin and the economics rest entirely on the minority who skip the check. A scheme forced to work hard on each contact stops being profitable long before it stops being possible.

  8. Time pressure as a diagnostic instrument

    Urgency in a purchase almost always belongs to the seller. Another buyer is waiting, the price expires tonight, the courier is booked for the morning, the account is closing at the weekend. Every one of these creates a deadline that exists inside the seller's story and nowhere else. Each of them targets the same thing, which is the interval in which a check would otherwise happen.

    The counter-move is to put the transaction down for an hour and watch what the deadline does. A genuine sale survives an hour without difficulty, because the goods are real and the seller has other work to get on with. A manufactured deadline reacts, usually by intensifying, and the reaction carries more information than anything said before it.

    The typical stated loss on an imposter report sits at around 700 dollars, and that figure explains the design. It is small enough that most people absorb it and move on without pursuing recovery through a bank or a police report, and large enough to be worth collecting several million times over. The scheme is calibrated to a sum that does not justify a fight, which is exactly why an hour of delay before payment is the cheapest defense available.

  9. Turning the check into a routine that survives the moment

    Ignorance explains very few of these cases. People who lose money to a purchase scam can usually recite the warning signs afterwards, in order and correctly. The checks get skipped because they are being decided in the same moment as the purchase, under time pressure, with the pleasant feeling of a good deal already in place. A routine written down in advance takes the decision out of that moment and puts it somewhere calmer.

    The routine itself is short enough to keep on a single page and does not change between transactions. Establish that the seller exists away from the listing, look at the age of the identity, ask what explains the price, request something only a holder could make, and pay by a route somebody else can stop. Applied in that order it takes a few minutes, and it fails safely, because any step that cannot be completed is itself the answer.

    Keeping a record matters for the cases where the check is skipped or passed and the transaction goes wrong regardless. Screenshots of the listing, of the conversation and of the payment instruction as it was given, saved before the seller deletes anything, are what a bank and a reporting body can act on. Recovery depends almost entirely on speed and on evidence that existed before the money left, which makes the record one of the steps of the check.

Each check and the kind of seller it removes

The checkWhat is examinedWhat it removes
Life away from the listingTrading name, registration number, an address that answersA seller invented for one deal
Depth of the account historyDates, continuity, ordinary unrelated activityA profile assembled this week
Origin of the photographsWhether the same images sit elsewhere under other contactsA borrowed catalogue
A cause for the priceWhat explains the discount and whether it survives a questionBait pricing
The payment routeWho besides the seller has the power to stop the transferA payment nobody can reverse
A callback to a known numberA number taken from a register entry or an old invoiceA voice supplied by the caller
Proof only a holder could makeToday's date and a name written beside the objectStock that does not exist
An hour of delayHow the seller behaves once the clock stopsPressure doing the deciding

Questions and answers

How do I check a seller before paying?
Establish that the seller has an existence away from the listing, look at how long the account and its history run, ask what explains the price, and request something only a person standing next to the goods could produce now. Then pay by a route where somebody other than the seller can stop the transfer. The whole sequence takes a few minutes and fails safely, because any step that cannot be completed is already the answer.
What is the safest way to pay a private seller?
A route with an intermediary who can reverse it: a card payment for goods, the platform's own protected payment, or an escrow arrangement. The defining feature is that somebody other than the seller holds the power to stop the transfer. Marking a payment as being between friends switches that protection off deliberately.
The seller says the platform payment is broken. Is that plausible?
It is entirely plausible, and it changes nothing about what to do. If the protected route is genuinely down it will come back, and a seller with goods will still be there. Waiting carries no cost beyond patience, while moving off the protected route carries the whole of the risk.
Do five-star reviews on a seller profile mean anything?
They mean something when they are spread over time and left by accounts with histories of their own. A block of identical praise posted within a fortnight by accounts created in the same fortnight is a manufactured wall. The complete absence of a lukewarm review across many sales is itself unusual.
Can I trust a voice on the telephone to confirm who I am dealing with?
Listeners in controlled testing separated genuine recordings from synthetic ones in 37.5 per cent of attempts, so recognition has stopped serving as evidence of identity. The check that still holds is a callback to a number obtained independently of the conversation, from a register entry, an official site or an earlier invoice.
What should I do if I have already sent the money?
Contact the bank immediately, because recovery depends mostly on how quickly the receiving account can be frozen. Preserve the listing, the conversation and the payment instruction as screenshots before the seller deletes them. Then file a report, so that the account and the identity end up on record for the next buyer.

Written by Ilia Nikolaevich Zavialov, digital security consultant. Overview of the method