Shpock

Is Shpock safe?

Shpock is a reasonable place to buy and sell second-hand, as long as you pay inside the app or pay cash after you have seen the item. The company behind it has no fines or orders from privacy or consumer regulators that we could find, and its Buyer Protection refunds buyers when a posted item never arrives. The weak points are the ones every classifieds app shares: deals that leave the app have no cover, and the app shares location and usage data with ad networks. We also found no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. We score it 50/100.

Shpock started in Austria in 2012 and is now strongest in the UK, Austria and Germany. It was owned by Schibsted and then Adevinta until June 2021, when Russmedia Equity Partners, the investment arm of an Austrian publisher, bought it. The operator is finderly GmbH & Co KG in Vienna.

When Buyer Protection covers you, and when it does not

Buyer Protection is Shpock's main safety feature, and it only exists for payments made through its integrated checkout, run by the payment company Adyen. The buyer pays the item price, postage and a protection fee up front. The seller must ship within 10 days or the deal is cancelled and refunded. Once the seller shares proof of postage, the buyer has 7 days to report that the item has not arrived or is damaged or substantially different from its description. If the buyer says nothing, Shpock marks the item as delivered and pays the seller. With Parcel2Go tracking, the window shrinks to 24 hours after the parcel shows as delivered.

There are limits worth knowing before you click buy. A buyer who wins a claim usually has to send the item back at their own cost. Shpock assesses each claim itself, asking for photos and proof. And none of it applies to the other ways people pay on Shpock: PayPal Friends and Family, bank transfers, or cash on collection. Shpock's own fraud page says plainly that if you pay any other way, it cannot refund you.

The scams to expect

Most Shpock fraud starts with someone trying to move the deal out of the app. In one case Which? published in July 2021, a "buyer" claiming to be in the US offered £110 for a Chromebook, asked to continue on WhatsApp, and then sent a form that looked like it came from Bank of America, asking for a Royal Mail tracking number before the money could be "released". The sort code on the form belonged to a different bank. In another, a buyer sent a fake PayPal confirmation and then asked the seller to pay a £100 "collection fee" in cryptocurrency for a courier. The first seller told Which? that Shpock did not respond to his report, and Which? said Shpock did not answer its own questions either.

These are the same tricks found on Kleinanzeigen and Facebook Marketplace: fake payment confirmations, overseas buyers with couriers, and requests to pay a fee to receive money. Shpock's own advice matches what police give: keep the chat inside Shpock, never pay a deposit for something you will collect, and be wary of prices that look too good.

What the app shares with advertisers

Shpock is free and makes money from item promotions, memberships and advertising, and the privacy disclosures reflect that. Apple's label says location, search history, identifiers and usage data are used to track you across other companies' apps and websites. Linked to your identity are purchases, financial info, location, contact info, your listings and messages, search history and diagnostics.

The Google Play data safety section goes further and says Shpock shares your approximate location, device IDs, user IDs and the list of installed apps with other companies for advertising or analytics. The privacy policy names Google, Facebook and AppNexus as ad network partners that can receive your birthday and gender (if you gave them), approximate location, language, internet provider and interest categories, with consent where the law requires it. Consent can be withdrawn in the user settings. On the website, the ad company Freestar collects data too.

One privacy detail is better than average: listings show a shifted location, not your exact address, and other users see only your first name and the first letter of your surname.

Account security

Shpock lets you sign up with Facebook, Google, Apple or email and a password. We found no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login option in its help centre, so an email-and-password account is only as safe as the password. Shpock has no public bug bounty that we could find, and its website serves no security.txt contact for researchers. We found no reported breach. If you sign in through Google or Apple, you get those accounts' two-step protection.

How to use Shpock safely

1. For anything posted, pay through Shpock's checkout so Buyer Protection applies, and do not confirm delivery until you have checked the item.
2. Report a missing or faulty item within 7 days of proof of postage. Set a reminder if you are away.
3. For collections, meet somewhere public, see the item working and pay only then. Never pay a deposit.
4. Ignore any "buyer" who wants to move to WhatsApp or email, sends a payment form, or asks you to pay a courier or release fee.
5. Sign in with Google or Apple and turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary there, or use a unique password.
6. Withdraw ad consent in the privacy settings if you do not want your data shared with ad networks.

How we scored it

The regulatory record (86) is Shpock's best factor: no fines or orders, though no privacy regulator has examined the app, so it stays below 90. Privacy (40) is the weakest, because the store disclosures list location and usage data shared for advertising, similar to Kleinanzeigen. Security (52) loses points for the missing two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. For a platform with escrow on every posted sale, compare Vinted.