leboncoin

Is leboncoin safe?

For anything bought online, leboncoin is one of the safer classifieds apps: every online purchase goes through its own escrow, which holds the money until you confirm the item. The risk sits in the deals that leave the app, such as a cash hand-over that goes wrong or a "buyer" who sends a fake payment link. Its other weak point is advertising. Its Google Play disclosures list name, contact details and precise location shared with other companies for ads. We found no fines from the CNIL or the DGCCRF. We score it 51/100.

leboncoin is a French classifieds app with about 1.6 million ratings on the French App Store. It is run by LBC France in Paris and belongs to Adevinta, the group that also owns Kleinanzeigen and Marktplaats. Each app has its own operator, data disclosures and record, so we score them separately.

How Transaction sécurisée works

When you buy online, leboncoin adds a mandatory service fee of 5% of the price plus €0.70, and the payment company Adyen holds the money. Refunds are automatic if the seller does not confirm the item is available within 48 hours, or does not ship within 6 days. Once the seller ships, you have 30 days to report a parcel that never arrived. For an item that arrives damaged or does not match the listing, you have 3 days after receipt to report it to a private seller. A 7-day period for an amicable fix follows, and leboncoin's team steps in if none is found. If you say nothing within those 3 days, the sale completes and the seller is paid.

Sellers who receive money this way must pass Adyen's identity checks (name, address, date of birth, bank details and ID, depending on amounts), which makes throwaway fraud accounts harder to cash out. Transaction sécurisée also works for hand-over deals if both sides use it, but nothing forces them to. leboncoin's own help page says it guarantees nothing done outside its messaging and payment.

The scams to expect

leboncoin's help centre names the tricks it sees most. Fake messages "from leboncoin" ask for passwords or card details, or offer a cheap paid option. Buyers ask to pay by Paylib, Western Union, Transcash, QR code or bank transfer. Fake payment confirmations arrive by email, which is why leboncoin tells sellers not to ship anything unless the payment shows in the app's messaging. It also warns about fake "leboncoin casino" notifications on Xiaomi, Redmi and POCO phones that lead to gambling and phishing sites. For cars, it publishes a separate buying guide.

None of these need a flaw in the app. They work because many deals still start in leboncoin's chat and finish somewhere else.

Account security and the 2024 incident

leboncoin's two-step login is better than many rivals offer. Once switched on under Connexion et Sécurité, it can ask you to approve a notification, use biometrics, or type a code sent by SMS or email. Every account must also have a verified mobile number, which leboncoin uses to confirm sensitive actions such as changing the bank account that receives payouts. Two-step login is off by default, though.

From the evening of 15 March to the morning of 18 March 2024, a bug put some buyers' first and last names, email addresses and phone numbers into the notification emails sent to sellers after a first message. leboncoin said only the seller in each conversation could see the data, fixed the bug and notified the CNIL. Security researchers can report flaws through a disclosure programme on Yogosha, run for Adevinta France, though we found no public bug bounty. leboncoin's Google Play listing also says data is not encrypted in transit, which may be a form error but is what the company declares.

What leboncoin shares with advertisers

leboncoin runs its own ad sales business, and the disclosures show it. Apple's label lists purchases, precise location, photos and other user content, search history, identifiers, ad data and diagnostics as data used to track you. Google Play goes further and says leboncoin shares name, email, address, phone number, precise and approximate location, device IDs, search history and browsing history with other companies for advertising.

The privacy policy explains how this works, with your consent. Ads are personalised with cookies, device IDs and a hashed email. On the website, LiveRamp receives a hashed email and IP address and links your browser to its online and offline marketing databases. Utiq creates marketing IDs with your telecom provider. After a purchase, the ad firm Rokt may show a partner offer. All of it can be refused in leboncoin's consent manager, and the export and deletion tools are better than most: you can download your data once a day, and deleting your account on the website erases it within 30 days.

How to use leboncoin safely

1. Turn on Connexion en 2 étapes and use a password you do not use anywhere else.
2. Buy and sell posted items only through Transaction sécurisée, and check the parcel within 3 days.
3. Ship nothing until the payment appears in leboncoin's messaging, whatever an email says.
4. For hand-overs, meet in a public place and pay only after checking the item, or use Transaction sécurisée in person.
5. Refuse advertising cookies in the consent manager if you do not want LiveRamp or Utiq tracking.

How we scored it

The regulatory record (88) is leboncoin's best factor: we found no fines or orders, though no regulator has examined the app in depth. Privacy (33) is the weakest, because the store disclosures list contact details and precise location shared for ads. Transparency and control (58) scores better than most classifieds apps thanks to self-service export and deletion, and the mandatory escrow on online sales puts scams and harmful content (45) ahead of Kleinanzeigen, which scores 40 on that factor.