Trade Me customers are the victims of the latest online scam by fraudsters operating out of Russia.
At least three variations of "phishing" emails have been circulating over the past month, asking recipients to provide personal details to renew their Trade Me memberships.
One such email, titled "Important account information", purports to be an official notification from Trade Me that the customer's online trading account has expired.
It asks people to renew their account by completing a form with their details, login, password and credit card details.
"If not, your online will be limited and deleted," it says.
Lesley Wheatley, 55, an accountant from Stillwater, north of Auckland, said the letter raised her suspicions immediately, but the attachment was a convincing imitation of the Trade Me login page.
"It was an amazing copy, really," she said.
"I had the real one open in another window and about the only difference was the login panel."
Wheatley swiftly went online to forums she shares to warn others about the scam. Phishing - also called "carding" or "brand spoofin" - is fishing for ID or credit card details through email, the internet and sometimes telephone.
Trade Me trust and safety manager Chris Budge said he did not know how many had been duped and that people who had entered their information needed to contact their bank.
- Have you been phished?