Private sales — a sale between two people, on Cardconomy’s rails

A seller builds a listing nobody can find, sends the link to one person, and the money is held until the parcel is scanned as delivered.

Escrow is the product; the link is just how you hand it over. A private link with no money-holding behind it is a payment request with your branding on it — which makes a scammer more convincing, not less.

The buyer buys the postage. So the label sits on Cardconomy’s account and the scans come from the carrier. The seller never types a tracking number, which closes the most common marketplace scam outright.

What has to be built, and what already exists

PieceWhere it comes fromWhat is actually newBuild
Private listingExisting listing model and the sell flowA visibility flag, plus exclusion from every browse and search indexSmall
Share link + codeNothing — newSigned token, short typeable code, expiry clock, view counterSmall
Buyer landing pagePDP layout, seller identity block, price dataSigned-out route, seller identity block, protection panelMedium
CheckoutExisting checkout, unchangedProtection fee line and courier pickerSmall
Escrow / payout holdWhatever the marketplace already uses to pay sellers outNothing, if payouts are already delayed — confirm this firstNone to small
Label + QRNothing — newCarrier integration: Click & Drop, InPost, Evri, or one aggregatorMedium
Scan-event webhookNothing — newCarrier callbacks drive the state machine and release the moneyMedium
Refund clockNothing — newA scheduled job. The highest trust-per-line-of-code in the featureSmall
Dispute handlingNothing — newNot-as-described claims need a human. This is the real costOngoing
Seller — build, share, wait, post
Buyer — frame 8 is the whole feature, and is live: scroll it.
Desktop — the same two moments at width. Frame 12 is live: pick a courier.

The state machine, and the clocks that make it trustworthy

StateEntered whenWhere the money isClock
DraftSeller is still building itNowhere—
SharedLink generated. Photos lock hereNowhereExpires in 7 days, seller can extend
ViewedBuyer opens the link. Seller sees a count, not an identityNowhereSame 7 days
PaidBuyer completes checkout and picks a courierHeld by CardconomyLabel must be scanned in 3 days
LabelledQR issued to the sellerHeldSame 3 days
In transitFirst carrier scan. Cardconomy hears this directlyHeldDelivery SLA plus 7 days
DeliveredCarrier reports deliveryHeldBuyer has 48h to raise a problem
Settled48h passes with no claimPaid out to seller—
Auto-refundedNo scan inside 3 days — nobody has to argueReturned to buyer in fullAutomatic, no human
DisputedBuyer raises not-as-described inside 48hStays heldHuman review. The expensive path

The decisions worth arguing about

1
Who is selling comes before what is soldThe buyer came from a group chat, not a search. Their first question is not “what is it” but “is this person real”.
2
Real photos, frozen on shareNo stock images, and no swapping them after someone has paid.
3
No opinion on the price, in either directionThese two agreed a number in a chat days ago. A flag underneath it second-guesses a decision already made — and the loss it warns about is one escrow already prevents. The seller still gets a plain sold-for range while pricing.
4
All or nothing on a multi-card saleOne price for the lot. It is how these deals are struck, and it keeps every clock simple.
5
The buyer picks the courierSo the label is bought on our account and the scans come from the carrier. The seller cannot fake evidence they never touch.
6
Labelless QR, no printerMost collectors do not own one. InPost is the strongest of the three — collection is photographed.
7
The refund clock is the trustNo scan in 3 days, full refund, nobody makes a case. One scheduled job beats any reassurance copy.
8
The process is the warningA banner saying “never pay outside Cardconomy” is read by someone already paying inside it. The pull off-platform happens in WhatsApp, so the words belong in the message thread, not on the page that is already safe.
9
A code to type, not just a link to clickOnce /s/<token> is known-good, lookalike domains follow. Six characters cannot be faked.
10
The buyer pays the 2% feeThe seller used your rails, not your audience. A commission on them pushes the deal back to bank transfer.
11
Opens are useful right up until payment“Nobody has opened it yet” tells the seller to chase. After payment the count answers nothing — and a second open reads as hesitation, which is a cue to lean on someone who has already paid.
12
The catalogue must never be the blockerSearch is the fast path, but nothing pre-2003 has a row to match, and vintage is where the money is. Free text is the honest answer: the buyer has already seen the card being described.
13
The cert number is the vintage catalogueA seller-typed name proves nothing. A slab number is checkable by anyone — for an old card it is the only third-party fact on the screen.

Worth stating

Confirm the payment rails firstHolding money is regulated, but you would sit inside Stripe Connect or Mangopay. If payouts are already delayed today, this adds no new regulatory surface.
What this does not solveIn-person deals, careless sellers, and anyone determined to bank transfer. It can only make the safe path the easy one.
The seller needs protecting tooA false non-delivery claim is the mirror scam. The carrier record is their defence — another reason we own the tracking.
Verification is probably already paid forYour payout provider’s KYC is the identity check this page needs.