Wallapop

Is Wallapop safe?

Mostly, as long as the money moves inside the app. Wallapop, a Barcelona second-hand app with more than 21 million users across Spain, Italy and Portugal, holds a buyer's money until a shipped item arrives and refunds items that are not as described. It now also lets people pay in the app when they meet in person. The risks sit around that system: fake "Wallapop" payment links sent to sellers, cash deals with no cover, and an app that tracks location and identifiers for advertising. We score it 50/100, close to Vinted and Kleinanzeigen.

How Protección Wallapop works

When a buyer chooses shipping, Wallapop charges a fee and the money stays with Wallapop's payment provider until the buyer confirms the item is right. The buyer has 48 hours after delivery to check it. If it does not match the description or is faulty, Wallapop refunds the purchase and the return is free; if the parcel is lost or damaged, the buyer gets the money back. Payments run through Mangopay, a payment company based in Luxembourg, and can be made by card, Apple Pay, Google Pay, PayPal, Klarna, Bizum or wallet balance.

Wallapop also recommends paying in the app at a meetup, so the seller only gets the money when the buyer confirms. Its own safety page is clear that a meetup arranged through the app's geolocation "no se beneficia de la Protección Wallapop": it is not covered. Cash, a direct Bizum transfer or a bank transfer outside the app leaves you on your own.

The scam to watch for: the fake link

Wallapop's list of warning signs describes the most common trick. A "buyer" asks for your phone number or email first, then sends a link, by chat or WhatsApp, that imitates a Wallapop purchase or shipment and asks for card details "to receive the money". Wallapop says a real buyer or seller never needs your personal data, card details or a link to finish a deal. When a genuine sale happens, a third voice from Wallapop appears in the chat in a blue bubble, not in ordinary chat text.

Other signs on the same page: someone who says they ship or pay outside Wallapop, anyone who poses as a Wallapop agent, and requests to enter your card on a page that is not Wallapop's. Wallapop says its customer service never contacts users through the Wallapop chat or WhatsApp.

What the app tracks

On the Spanish App Store, Wallapop's label lists location, contact info, identifiers and usage data as "used to track you" across other companies' apps and websites. Google Play says the app shares device IDs and photos for advertising, along with personal and payment details for analytics and fraud checks.

The privacy policy, revised on 20 October 2026, says data goes to ad partners, including Meta, Google and LiveRamp, only with your consent through the cookie banner. That consent did not always work. In November 2024 a user complained to Spain's data protection authority, the AEPD, that es.wallapop.com still stored third-party cookies after they had rejected cookies. The AEPD opened a sanction case in May 2025 for breaching the cookie rule in Spain's e-commerce law (file PS/00160/2025) and proposed a €5,000 fine. Wallapop paid early and admitted liability, which cut the fine by 20% twice, to €3,000, on 3 July 2025, and that closed the case. The decision does not say which cookies or partners were involved. It is a small fine, but it goes to the heart of whether "no" means no.

The policy is otherwise detailed: it names Wallapop, S.L.U. in Barcelona as controller, gives a DPO address, and sets retention periods, such as five years for fraud analysis and up to ten for EU tax reporting on sellers.

Account security

Wallapop's help centre says it can ask for a second step at login, when you add or change bank details and before you receive a payment, by an approval email or an SMS code. Verifying your phone adds a badge to your profile. In November 2019 Wallapop logged everyone out and disabled their passwords after detecting what it called "un acceso indebido" (improper access) to its platform; it said it had no evidence the data had been misused. The AEPD looked into the incident and closed the file in December 2020 without a sanction (E/10375/2019). We found no paid bug bounty.

Since January 2026 Wallapop has belonged entirely to Naver, the South Korean internet group, which raised its stake from about 29.5% to 100%. Spain's competition authority cleared the deal, and Wallapop says it keeps running independently from Barcelona.

How to use Wallapop safely

1. Use "Comprar" with shipping for anything you cannot see in person, and check the item within 48 hours of delivery.
2. At meetups, pay or get paid through the app rather than in cash or by a direct Bizum transfer.
3. Never open a payment or shipping link sent in chat, by WhatsApp or by email. Real deal messages appear in the blue Wallapop bubble.
4. Never give card details to receive money.
5. Turn on phone verification, and use a password you use nowhere else.
6. In the app's consent settings, turn off ad partners you did not mean to accept.

How we scored it

The regulatory record (80) reflects one small AEPD cookie fine. Privacy (40) is Wallapop's weakest factor, because the app tracks four kinds of data for ads and its cookie refusal did not work. Scams and harmful content (45) credits the escrow on shipped orders but counts the unprotected meetups and fake links, and the 13+ store rating for an adults-only service. For a comparable app with escrow on every order, see Vinted.