Craigslist

Is Craigslist safe?

As an app, yes. As a place to hand money to strangers, less so. Craigslist is the rare marketplace that runs no advertising beyond the classifieds themselves, does not sell your data and declares no tracking on Apple's privacy label. But it also does almost nothing to stand between you and the other person: there are no verified profiles, no ratings, no payments through the site and no buyer protection. It also has no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login that we could find. We score it 61/100, the highest privacy score among the marketplace apps we rate and one of the lowest for scams.

The privacy is real

Craigslist's privacy policy, last updated on 29 May 2024, is about a page long and unusually blunt. It says Craigslist does not run ads other than users' classifieds, does not share data with third parties for marketing, does not use tracking for marketing and does not sell data. It lists every data type it collected in the previous 12 months, from name and email to latitude and longitude, and who received it. Most entries say "No one". Payment processors get card details when you pay for a post, and anti-fraud providers see IP addresses.

Apple's label for the app matches. There is no "Data Used to Track You" section at all. Search history and identifiers are linked to you for analytics, and location, contact info and search history for personalisation. Google Play lists only crash logs and diagnostics as shared. Compare that with OfferUp, whose label lists five kinds of data used to track you, or Facebook Marketplace, which runs inside one of the most data-hungry apps there is.

Replies to your ads go through an email relay, so a buyer does not see your real address unless you reply from it directly. You can browse and post without an account at all.

The weak spot is the deal

Craigslist's own safety advice fits in one line: "Deal locally, face-to-face". Its scam page lists the patterns it sees most: requests to wire money, pay with gift cards or deposit a cashier's check are scams; escrow services "can be a scam"; and any request for a "code" or "verification" is "always a scam". It also tells users never to give bank details, Cash App logins, Social Security numbers or job references.

Those warnings exist because the platform gives scammers room. Anyone can post without an account, nobody has a public rating, and nothing on the listing shows whether the poster is real. Rentals are a well-known risk. The FTC's advice on rental listing scams, updated in June 2026, describes fraudsters who copy photos and descriptions from real listings, add their own contact details and ask for a deposit or first month's rent by wire transfer, gift card or crypto. It does not name any one site, but classifieds where anyone can post are the obvious setting. Across all categories the FTC received 3 million fraud reports in 2025, with $15.9 billion in reported losses.

Sellers are targets too. That is why Craigslist lists cashier's checks among its scam signs: in the overpayment trick, a "buyer" sends a check for more than the price and asks for the difference back before the check bounces. Another is the code trick, where a buyer asks you to read out a six-digit number "to prove you are real", which is really the verification code for a phone number or account being set up in your name.

There is no buyer protection to fall back on. Craigslist does not process payments for items, so it has nothing to refund. The app is rated 18+ on the US App Store, which lists infrequent mature and sexual content, and the terms ask only that users be "of sufficient age".

Accounts are easy to get into

Craigslist accounts sign in with a password or a one-time login link sent by email. We found no two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in its help pages, so the security of your Craigslist account is the security of your email. Craigslist does publish a security.txt file with a PGP key and a page thanking security researchers, but we found no paid bug bounty. We found no reported breach in the last ten years.

How to use Craigslist safely

1. Meet in person in a busy public place, and check the item before money changes hands. Some police stations offer marked exchange spots.
2. Never pay a deposit for a rental, car or pet you have not seen. Search the address with the owner's name first.
3. Refuse wire transfers, gift cards, crypto and cashier's checks, whichever side of the deal you are on.
4. Never read out or forward a code sent to your phone.
5. Keep replies inside the Craigslist relay until you have met, and do not post your phone number in an ad.
6. Use a strong, unique password on the email account linked to Craigslist, since that is what protects your login.

How we scored it

The regulatory record (88) is Craigslist's best factor, with no fine or order in the last ten years, and privacy (75) is the highest of any marketplace we score, because it runs no ads, declares no tracking and shares almost nothing. Scams and harmful content (30) is the weakest: anonymous posters, no ratings, no payments on the site and no buyer protection leave every check to you. Security (50) is held back by the lack of two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. For a local marketplace that verifies IDs but tracks far more, compare OfferUp.