An OLX listing problem by SMS? Verify the request through a trusted route

In its 1 October warning, CERT Orange describes texts impersonating OLX over listing problems or account verification. The scheme moves from collecting personal information to bank selection and attempts to obtain a second authentication factor. The warning does not report an OLX breach.

For a seller, the message may fit something they have just done. Instead of expecting people to memorise every possible fraudulent address, we propose a simple procedure: check the issue through an independently opened app or a trusted service address.

Who should consider this scenario

The direct audience is people using OLX listings. Organisational training can also include employees selling company equipment or using a personal phone during the working day. This is our example of how to apply the warning, rather than an account of an incident at a particular company.

Avoid teaching that every verification text is fraudulent. Recipients need a way to establish whether a request is real, rather than a list of exceptions. A message should not, on its own, determine the address, support number and next steps that we trust without checking.

A procedure: stop, open, confirm

1. Stop the action initiated by the text. Do not enter further information or codes on the page opened from the message. Do not continue a conversation with someone whose authority rests only on that message.
2. Open the service independently. Use the familiar app, a saved bookmark or the correct address entered yourself. Check the account and listing status.
3. Confirm the request. If help is needed, find support through the independently opened service. Do not use a number supplied by the suspicious page.
4. Read what you are approving. Establish what a code or banking-app notification actually authorises. Do not share codes with a person conducting supposed verification or approve an action you do not understand.
5. Report the attempt. At work, use the established security channel. Include the time, the request and the point where you stopped, without attaching passwords or authentication codes.

This is Breachroad’s proposed procedure. Its purpose is to regain control over the contact route. A professional-looking page or a message that fits a recent listing is no substitute for this check.

Training scenario: selling a monitor

In our fictional scenario, an employee lists a used monitor. A few minutes later, a text claims there is a problem with the listing. The page asks them to choose a bank to “confirm the account”. The employee must decide where to check the actual publication status and how to report the unusual request.

A good answer names a concrete action: closing the suspicious route and opening the service independently. A general promise to be careful is insufficient. The trainer can then change the pretext to an expiring account or a billing error and assess whether the participant follows the same procedure.

The exercise needs neither a working phishing page nor real banking information. A description and a decision question are enough. Afterwards, employees should know the reporting channel and understand that promptly reporting a mistake is encouraged.

If information has already been entered

CERT Orange recommends contacting the bank urgently after entering a password on a fraudulent page. Use the trusted banking app or an already known contact route, explain what you did and follow the bank’s procedure. Do not wait for another message from the supposed adviser.

Our additional recommendation for the workplace: if company credentials were also entered or a work device was involved, inform the responsible team promptly. Distinguish clicking from submitting information and approving an operation; that detail helps determine the response. Our first-hour phishing response plan explains further steps.

Cybersecurity and phishing training for organisations lets employees rehearse the procedure in familiar situations. See also our guide to fake payment scams on OLX and Vinted.

Source and Breachroad conclusions

Campaign details come from CERT Orange. The independent verification procedure, fictional scenario and training application are Breachroad recommendations. We do not infer victim numbers or the success rate of similar texts from the warning. The source was checked on 5 October 2026.