I posted and ad on Kijiji for an aluminum framed window. Almost immediately I had 2 replies in my inbox.
Problem is they didn’t go through Kijiji messenger/chat. The came directly to my personal email address. I responded to both and had a reply from one asking the condition of the aluminum frame. I responded and ten minutes later I get another email saying sale confirmed, click on the link to arrange delivery.
That’s not happening. This morning I posted an ad for a Xbox console cooler/charger in free stuff. Immediately got a reply to my personal email address asking what condition it was in. I replied and a few minutes later I get another email saying sale confirmed for $44.00 and to click on the link.
I can’t report my own ad and I can’t report the emails because they didn’t come through Kijiji. How are these people getting my personal email address?
And I now know that this ad is actually listed because I just got a response on the Xbox cooler that came through the Kijiji messenger/chat system
Thank you for reaching out to us about this. I completely understand how concerning and unsettling it can be to receive a direct email or text message about your listings when your contact details are supposed to be safely anonymized. Your privacy and peace of mind are incredibly important to us, and I am more than happy to help clarify what might be happening here. While Kijiji works hard to keep your contact information hidden, receiving a direct message outside of our secure system usually points to one of two external scenarios: Scenario 1: Account Compromise via External Data Breaches Scammers may gain access to a user's email or account credentials from a historical, third-party data breach. Rather than using the hijacked account maliciously right away, they will quietly look through active ads and profile details, copy the direct contact details, and reach out directly pretending to be an interested buyer to lure you off-platform. Scenario 2: Public User Name Matching (No Account Hack Required) Alternatively, scammers do not even need to compromise your account. If your public Kijiji User Name/Profile Name is set to your real name, an email handle, or a name you use on other platforms, scammers can:
View your active ad and copy your public profile name.
Cross-reference your name with publicly leaked third-party databases to find your corresponding email address.
Send a scam email directly to you referencing the specific item you are selling.
How to Secure Your Information Right Away To protect yourself against both of these tactics, we highly recommend taking the following steps immediately: 1. Change Your Public Kijiji User Name
Go to your profile settings and change your display User Name to something generic (e.g., a nickname or just your first name) that cannot be easily linked back to your personal email address, social media, or other online accounts.
2. Check for External Data Breaches
We suggest visiting Have I Been Pwned and entering your email address. This is a secure, widely trusted public resource that will show you if your email address has ever been compromised in a third-party data breach.
3. Update Your Passwords Immediately
If your email has been flagged in a breach—or even if you just want to be extra safe—please update your passwords right away.
Keep them unique: We strongly advise that your Kijiji account and your personal email address do not share the same password.
Please rest assured that we are constantly updating our security measures to keep our community safe. If you suspect your Kijiji account has been accessed by someone else, please don't hesitate to reach out to our support team directly so we can help you secure it. Thank you for staying vigilant, and please let us know if there is anything else we can do to support you!