Industry News Marketplace Trust & Safety

How to Prevent Fake Listings and Phishing

By Beatriz

Contents

    Estimated reading time: 10 minutes

    Besedo blog header: “How to prevent fake listings and phishing.” A mock rental listing for a sunny 2-bed city-centre flat at €350/mo is flagged “Price too good to be true,” next to a chat message asking for a deposit through a link flagged “Phishing link.”

    Platforms prevent fake listings and phishing by verifying listings and accounts at creation, detecting off-platform payment attempts in messages, combining automation with trained human reviewers, and keeping auditable records of decisions. European regulators are scrutinising how platforms handle fraud.

    Key Takeaways

    • Fake listings can start fraudulent conversations, while phishing can also exploit legitimate listings or compromised accounts.
    • Verification at creation and re-checks over time help catch fraud before it reaches users.
    • Phishing can reach users through platform messages, email or other channels, so listing review alone can’t catch it.
    • Automation handles volume, and trained reviewers/fraud specialists handle new and ambiguous cases. The two work best in one system with a feedback loop.
    • Auditable records of every decision let you show that your controls work.

    On 21 October 2026, the European Commission opened formal proceedings under the Digital Services Act (DSA) into how Booking.com handles fraudulent listings and phishing scams. The proceedings will assess whether the platform diligently assessed and mitigated those risks. No breach has been established

    The announcement named three areas: fraudulent and non-compliant listings, phishing scams that exploit reservation and guest data, and paid-for listings that aren’t clearly labelled as ads. The first two are core trust and safety problems for any platform with third-party content.

    Booking.com reported a 500% increase in fraudulent listings between 2022 and 2024. This problem is much wider than any one platform. A 2026 survey by the EU Agency for Fundamental Rights (FRA) found that 24% of respondents had at some point been deceived, through instant messages or emails, into transferring money, making payments or disclosing personal data. Fake online shopping, where paid-for goods or services never arrive, was the most common type of fraud among victims.

    This guide to marketplace fraud prevention covers how these scams work, what effective fraud controls looks like, and what to ask a vendor. It uses “platform” for any online service with user-generated content, and “marketplace” for platforms where users buy, sell or rent from each other.

    How do fake listings and phishing scams work?

    Fake listings (also called fraudulent listings) offer supply that doesn’t exist or isn’t the poster’s to offer, such as a property, a product or a service. Common patterns include copied photos and descriptions, hijacked or impersonated accounts, and prices set too low to be true. In Besedo’s 2025 survey, 40% of users said they had been scammed by marketplace listings. Once a fake listing is live, every user who finds it is exposed.

    Phishing usually happens after the listing, in the conversation. The scammer uses real context, such as a booking, an order or a recent message, to push the user off-platform. The user is asked to pay by bank transfer, click a link or “confirm” card details. It works because the message looks relevant: in the FRA survey, 24% of respondents said they had been tricked by an instant message or email. Ofcom, the UK communications regulator, makes the same point from a platform angle in its review of fraud enabled by user-generated content: the payment itself often happens off the platform, after the conversation starts on it. A listing review will never see that step.

    The two can reinforce each other. Fake supply creates the conversations, and phishing monetises them.

    How to stop fake listings at the door

    Stopping fake listings early protects users and also conversion. In Besedo’s 2025 survey, 80% of buyers said they skip listings they don’t trust. A solid approach includes:

    1. Verify at creation. Check new listings and accounts for duplicate or stolen images, mismatched details, high-risk patterns and reused contact information before they go live.
    2. Re-check over time. A listing that was legitimate at sign-up can be sold, hijacked or edited later. Re-score accounts when their behaviour changes.
    3. Look for networks, not single listings. Fraud is often organised, and shared devices, payment details and text patterns can reveal clusters.
    4. Make reporting simple and fast. User reports are a signal. Route them quickly and close the loop with the reporter.

    For more on building these checks into a marketplace, see Besedo’s guide to scam and fraud detection and other marketplace moderation challenges.

    How to detect phishing in user messages

    Phishing prevention is a conversation problem, so it needs conversation-level controls:

    • Detect attempts to move users off-platform, such as external links, requests to pay outside the platform and shared personal contact details early in a chat.
    • Flag urgency and pressure language, especially when combined with payment requests.
    • Warn users in context, at the moment a risky message arrives.
    • Escalate high-risk cases to human review before harm occurs.

    Don’t rely on users to report it. In the FRA survey, only 15% of fraud victims reported the fraud to the police, and 44% reported it to any organisation, including banks, platforms and telecom companies. Many incidents never reach the platform, so detection has to work without a report.

    Scam tactics change often, so detection has to be updated continuously, not configured once. Besedo tracks how online scams evolve as new tactics appear.

    Why automation alone isn’t enough

    Automation is essential for speed and volume, but models can lag behind new scam patterns, local languages and borderline cases. Fully manual review has the opposite problem: it’s accurate on ambiguous cases but too slow and costly at scale.

    The threat is also moving fast. Europol’s 2026 threat assessment describes online fraud as the fastest-growing area of organised crime, with criminals using generative AI to tailor social engineering and to speed up and conceal their schemes. Europol notes that phishing remains one of the most common methods.

    The goal is not to choose between high automation and high accuracy. The strongest setups run both in one system. Models handle the volume. Trained reviewers handle the ambiguous and new cases. Their decisions feed back into the models so detection improves over time. That is the idea behind AI plus human moderation.

    This is also where in-house builds can struggle. They often depend on a few engineers and a patchwork of tools, and every new fraud technique pulls developers away from the core product. That accumulates as Moderation Debt: the hidden cost of fraud controls that were patched together instead of built to scale.

    How to prove your fraud controls work

    Regulators, partners and customers increasingly ask for evidence, not just policies. A control you can’t evidence is hard to defend. Make sure you can answer:

    • Which fraud risks did we identify, and when did we last review them?
    • What controls address each risk, and who owns them?
    • What are our detection, response and false-positive rates over time?
    • How do we handle reports, and how quickly?
    • Can we reconstruct why a given decision was made?

    Auditable decision logs, consistent reporting and a regular review cadence turn a risk assessment from an annual document into a living record.

    What should you ask a trust and safety vendor?

    Whether you’re replacing an in-house build or adding to one, these questions separate vendors who can show results from those who can only describe features. Ask for evidence, not just answers.

    Question to ask What good looks like Red flag
    Coverage
    1. How does detection work across listings, profiles and messages? What good looks likeOne system covers all three and shares signals between them Red flagSeparate tools you’d have to stitch together
    2. How well do you handle our languages and markets? What good looks likeNative coverage of your European languages by reviewers who know local context and payment habits Red flagReview teams far from your markets
    How it works
    3. How do automation and human review work together? What good looks likeClear rules for what is automated, what goes to trained reviewers, and how new scam patterns reach the models Red flagAutomation only, or manual review only
    4. Does human review feed back into the models? What good looks likeReviewer decisions retrain detection on a regular cycle Red flagNo feedback loop, so the same mistakes repeat
    5. How fast can we go live, and how fast can rules and models change? What good looks likeA defined onboarding timeline, and rule changes you can make without an internal support ticket Red flagVague answers on how quickly the system adapts to new tactics
    Proof
    6. How do you measure accuracy, and can you show it on our data? What good looks likePrecision, recall and false-positive rates from a pilot on your own content Red flagBenchmarks only from the vendor’s own data
    Accountability
    7. What records do you keep, and can we export them? What good looks likeDecision logs, audit trails and reports you can export, so you can reconstruct why a decision was made Red flagNo way to explain individual decisions
    8. How do you handle reports and appeals? What good looks likeOne workflow for user reports and appeals, with response times tracked Red flagReports and appeals handled outside the system
    9. Who owns the operation, and what happens if someone leaves? What good looks likeDocumented processes, with knowledge not held by a few individuals Red flagAn operation that depends on one or two people
    Cost
    10. What does the total picture cost? What good looks likeA full view of models, review staff, reporting tools and engineering time Red flagA low headline price with add-ons needed to fill gaps

    What does this look like in practice?

    At Besedo, we treat trust and safety as Trust & Safety Infrastructure: service, software, human reviewers and technology operating as one system, instead of separate tools stitched together. The aim is to keep platforms’ spaces clean without forcing a choice between speed and accuracy.

    For example, Besedo’s published case study shows Swiss marketplace anibis.ch reaching 94% automation at 99.8% accuracy, and moving from manually checking about 10% of listings to moderating 100% of them. Anibis case study. See how it works for online marketplaces.

    CTA besedo banner are fake listings slipping through

    FAQ


    What is the Digital Services Act?

    The DSA is the EU regulation that sets rules for online intermediaries and platforms on illegal content, transparency and risk management. The obligations depend on the type of service and the relevant provisions. Designated VLOPs and VLOSEs have additional obligations relating to systemic risks.


    Does the DSA apply to online marketplaces?

    The DSA applies to a wide range of online services in the EU, including platforms and marketplaces, with obligations that vary by size and role. Additional rules apply to online platforms that allow consumers to conclude distance contracts with traders, subject to the scope and exceptions in the Act.Your legal team can confirm what applies to your service.


    How can a platform prevent fake listings?

    A platform can reduce the risk of fake listings by verifying listings and accounts when they’re created, re-checking them as behaviour changes, looking for connected networks of fraud and combining automated detection with human review.


    How do you detect phishing on a marketplace?

    Marketplaces can use measures such as monitoring messages for attempts to move users off-platform, payment requests outside the platform, suspicious links and pressure language, and by escalating high-risk cases for human review.


    What should a fraud risk assessment cover?

    A fraud risk assessment should identify how the platform can be abused, describe the controls that address each risk, measure how well those controls work, and document how decisions are made and reviewed. The DSA specifically requires designated VLOPs and VLOSEs to assess systemic risks, including categories of risk set out in Article 34. These risks may include the dissemination of illegal content through fraudulent listings or scams and actual or foreseeable negative effects on consumer protection. They must take appropriate, proportionate and effective measures to mitigate the systemic risks identified. The same systemic-risk assessment obligations do not apply to every platform.


    How do you choose a trust and safety vendor?

    Look for coverage across listings, profiles and messages, a combination of automation and trained human review, a feedback loop between the two, native support for your markets’ languages, and auditable records that stand up to audits and regulatory questions. Test accuracy on your own data before you commit.


    Sources:

    Contents