Originally Posted by
machinist42
Seller was, let's say, a bit quirky in our text exchange, responding "I will not enter any codes" to my request to buy the bike.
I think this is in reference to CL account takeover. CL does (or used to?) allow you to use a 'forgot password' feature on accounts.
If you haven't seen it yet, scammers will ask you to "prove you are who you say you are" on your advertisement. Usually goes to the tune of, "I'm going to have CL send a text to you with a code to prove who you are, so I know you're not a scammer". Then they'll submit for 'lost password' and 'receive code by text'. If you fall for this and give them the code CL sends to your device and/or email, they'll login to your account and hijack it.
I first hear about this back in 2017. A friend posted a "lost dog" ad after July 4th. Someone contacted them with "I found your dog, but I need to know you're actually the owner". She was desperate to get the dog and followed their instructions. They received the text, gave them the code, then spent the next several days trying to regain access to their account again.
PS - I never linked my phone to my CL account and won't. Likewise, I never use my ph# on CL ads. Better to remain anonymous-ish by using their remailer service.