Tori.fi payment system exploited by sellers to scam buyers

Finnish classifieds platform Tori.fi has promoted its Toridiili payment service as a secure way to buy and sell goods, but a loophole allows sellers to receive payment even when no item is shipped, according to a report by Yle.

Joonas Houni of Tampere lost €720 after purchasing a camera stabilizer through Toridiili. The package, sent via Matkahuolto, was marked as collected for delivery but vanished. Tori released the funds to the seller after Matkahuolto confirmed the package was lost, leaving Houni with only a €45 compensation from the carrier.

An investigation revealed that sellers can open a Matkahuolto parcel locker with a code, leave it empty, and close it. The system still registers the package as collected for delivery. When the driver finds the locker empty, responsibility shifts from Tori to Matkahuolto, enabling the scam.

Kati Nevalainen, head of Matkahuolto’s parcel services, acknowledged that while the system logs locker access, drivers are supposed to report empty lockers. She confirmed this vulnerability exists across all carriers’ parcel lockers.

Tori’s rules state that if a carrier confirms a package is lost, the sale amount is released to the seller. Houni argued this contradicts Toridiili’s advertised protection, which promises buyers 24 hours to inspect goods before payment is released.