Craigslist Camera Scam Squeezed for More Money

Hacker Noon Cybersecurity · Low sophistication
Last updated August 5, 2026

A buyer hunting for a bargain Sony camera on Craigslist was scammed during a “ship the item” transaction. The scammer kept everything in text messages, pushed payment to multiple random Hotmail addresses, and used manipulated shipping screenshots to ask for more money. The victim ultimately filed police and FTC reports and documented warning signs others can use to avoid similar losses.

Key findings

  • The scam happened during a Craigslist purchase once shipping was introduced: “as soon as you consider shipping the item, the guardrails are gone, and fraud quickly enters the picture.”
  • All communication stayed in text messages, avoiding voice verification and making it easier to fake identity and location.
  • The scammer used manipulated evidence: “The scammer sent me screenshots of shipping costs… It turns out they were digitally manipulated.”
  • Payment was routed to multiple randomized Hotmail addresses, a common sign of fraud and money-mule style collection.
  • The victim’s payment provider flagged the transaction: “My initial attempt to pay failed and resulted in my account being locked… warned of potential fraud.”
  • After payment, the scammer attempted to extract additional funds: “started trying to squeeze me for more cash.”

Who’s being targeted

  • Commonly targeted roles: All employees, Finance/AP (expense and reimbursement approvers), Procurement/purchasing, Executives (high-value purchase approvers).
  • Affected industries: Online marketplaces and classifieds, Consumers/individual buyers, Retail/e-commerce.
  • Attack channels: smishing.
  • Impersonated: Craigslist seller (individual).

Awareness takeaways

  • For any marketplace purchase involving shipping, verify the seller with a real-time voice call (or don’t proceed).
  • Treat screenshot-based ‘proof’ (shipping quotes, invoices, payment confirmations) as untrusted, verify independently.
  • Random email addresses and frequent changes to payment details are strong fraud indicators, stop and escalate.
  • If your bank/payment provider flags a transaction, take it seriously and pause, don’t push through because you want the deal.

Red flags to watch for

  • Seller refuses/avoids a real phone call or voice verification
  • Payment requested to a randomized email address that doesn’t match a real person/business
  • Pressure to move quickly because it’s a “deal”
  • Screenshots used as “proof” instead of verifiable carrier links/quotes
  • Multiple payment addresses used in the same transaction
  • Claims that calls “aren’t going through” to avoid verification
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

You find a Sony camera on Craigslist, crazy good price, seller says, “I’ll ship it.” That’s where this scam starts. They keep everything in text: “I only communicated with this person via text.” To pay, they send a random Hotmail like gosewischgeel384@hotmail.com, then new ones for “shipping” with fake screenshot proofs. The payment provider even locks the account, warns of potential fraud, but the buyer pushes through… and then the seller starts squeezing for more cash with “updated shipping” screenshots. Here’s the move: if a marketplace deal involves shipping and random emails or screenshots, stop. Don’t send a cent until you’ve spoken to the seller on a real-time voice call.

Categories

Similar attacks

Microsoft Takes Down Billion-Message Phish Supply Chain

Microsoft Takes Down Billion-Message Phish Supply Chain

Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…

October 15, 2026
Microsoft Disrupts 3 Massive Phishing Platforms

Microsoft Disrupts 3 Massive Phishing Platforms

Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…

October 14, 2026
Okta: Phishers Bypass MFA by Pushing Weaker Options

Okta: Phishers Bypass MFA by Pushing Weaker Options

Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…

October 7, 2026
Fraudulent Gov Email and Passkey Lures Hit Orgs

Fraudulent Gov Email and Passkey Lures Hit Orgs

The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…

September 14, 2026
Passkey Helpdesk Scam Hijacks Microsoft Accounts

Passkey Helpdesk Scam Hijacks Microsoft Accounts

Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…

September 13, 2026
Fake IT Calls Steal Microsoft 365 Access

Fake IT Calls Steal Microsoft 365 Access

Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…

September 10, 2026