The mechanics are straightforward enough that a Reddit comment explains it in one sentence: “They want you to wait the 48 hours so Vinted auto confirms it, they get the money for an item they never sent or owned and you get nothing with nothing you can do about it.”

The seller lists an item at a competitive price, takes payment, and ships a piece of paper in a lightweight envelope instead of the product. The paper claims the item is “on its way” in a second package, with a 1-7 day estimated arrival window. The envelope generates a valid tracking number. It scans as delivered. Vinted’s auto-release system sees: item shipped, item delivered, 48 hours elapsed, no dispute filed. Payment releases. The seller withdraws immediately.

A user who compared the letter to one shared on the subreddit three years earlier found identical wording, font, and imagery. Same scam, same template, still running.

The Auto-Release Window Is the Vulnerability

Every major C2C marketplace uses a variant of the same trust mechanic. Vinted releases payment 48 hours after delivery confirmation unless the buyer disputes.

The auto-release window exists for a legitimate reason: sellers need to be paid, and holding payment indefinitely would make marketplace selling economically unworkable. But the same mechanic that protects legitimate sellers from buyers who never confirm receipt creates a window that fraudulent sellers can exploit by generating a delivery confirmation without delivering anything of value.

This is the same structural vulnerability we covered when we reported on the Shopify fake invoice scam: fraudsters sending fake invoices through Shopify’s own notification infrastructure because the platform’s legitimate systems provide the trust signal that the scam depends on.

The Vinted paper scam is the same principle applied to physical delivery: use the platform’s own delivery confirmation system to trigger payment release for an item that was never shipped.

What You Should Know If You’re an Ecommerce Operator

The mirror image of this scam is the malicious returns fraud we covered in the CCTV exposé piece earlier this month: buyers sending back empty boxes or wrong items while the platform’s refund automation processes the return and issues a credit. Both scams exploit the same gap, the platform’s automated trust mechanics cannot verify what is actually in the package.

For marketplace operators and brands selling on C2C platforms, the practical implications are several.

The dispute window is the primary protection. Every marketplace has a window during which buyers can dispute a transaction. Understanding the specific dispute window on each platform and ensuring buyers know how to use it before the window closes is a material fraud prevention function. Vinted’s 48 hours is short.

The “item not as described” versus “item not received” distinction matters operationally. Multiple commenters in the Reddit thread flagged that if you report the scam as “item not received,” the system may reject the dispute because something was delivered. The correct claim is “item not as described.” For any ecommerce operator advising sellers or running a marketplace, this distinction is worth building into your buyer education materials.

Delivery confirmation is not proof of item delivery. It is proof that a package was scanned. A scammer who ships a piece of paper has the same delivery confirmation as a seller who ships the correct item. The weight discrepancy is often the only technical signal available: a package containing a folded piece of paper weighs virtually nothing. Multiple users in the thread noted that Vinted support asked them to weigh the package, which suggests the platform uses this signal in its dispute resolution, but only after a dispute is filed, not as a proactive flag.

The Three-Year Template Problem

The most operationally concerning detail is that this specific scam has been running with the same template for at least three years. The platform’s response has been individual account bans, which are low-friction for the scammer to circumvent by creating new accounts.

The scam works because of a platform mechanic, not because of a specific bad actor. Banning the account does not change the mechanic. The template gets reused by the next account.

Platform-level responses that would actually address the vulnerability include minimum weight thresholds that trigger disputes when a delivered package is dramatically lighter than the listed item, extended auto-release windows for new accounts with no transaction history, and buyer notification at the point of delivery confirmation that reminds them of the dispute window and how to use it. None of those require stopping legitimate shipping. They require the platform to use the carrier data it already receives to flag anomalies.

Our Take

The Same Fraud Works Because Every Platform Has the Same Hole

The Vinted paper scam is not a sophisticated attack. It is a simple exploit of a universal marketplace mechanic that has been running for years because the fix requires a platform-level response rather than individual enforcement. For ecommerce operators, the lesson is not specific to Vinted.

Any platform that uses delivery confirmation to trigger automated payment release has this vulnerability, and any seller on any such platform can be exploited by a buyer using the mirror-image version, shipping back an empty box to trigger an automated refund.

We covered the CCTV malicious returns exposé, the Klarna chargeback piece, the Shopify fake invoice scam, and the friendly fraud crisis earlier this month. All of them are versions of the same problem: automated trust mechanics that cannot verify what is actually in the package.

Until platforms close that gap, through weight verification, extended windows for new accounts, or buyer education at the moment of delivery, the scam template will keep getting reused because it keeps working