Hide Seller Email & Phone: Secure Contact for Classifieds That Actually Stops Scams

If you run a classifieds site (a car club forum, a niche marketplace, a directory) there's a good chance your listings look something like this:

1969 Mustang, 351 Cleveland, runs good, $18k OBO. Call Jim at (555) 123-4567 or email jimsmith[at]gmail.com.

It feels harmless. It's how classifieds have worked since the newspaper era. And in 2026, it's the exact reason your members are getting bombarded with scam texts and your sellers are getting harvested by bots. Let's fix it properly.

Why public contact info is a bigger problem than you think

There are two forces converging on the humble “posted phone number,” and both have gotten worse recently.

1. Scrapers are industrial now. Phone numbers and emails posted in plain text on a public page are harvested by bots that sell them to spam lists, phishing operations, and lead-brokers. A seller who lists once can be getting SMS spam for years.

2. Scammers specifically target exposed contacts. Classic-car online scams are at record levels: the Better Business Bureau reports roughly $45 million a year in losses to fake classic-vehicle scams, median loss about $12,600. The playbook starts with a scammer harvesting a buyer or seller's phone number and running the “I'm working on an oil rig, wire the deposit to eBay's escrow”play. It works because the contact happens off-platform, where the club can't see it or warn anyone. Exposed contact info is how the scammers reach their victims.

The three approaches to hiding seller contact info

Option 1: Obfuscation (weak, don't bother)

Writing emails as jimsmith[at]gmail.com, or using JavaScript to “encode” a mailto:link so it doesn't appear in the raw HTML.

• Stops: The dumbest, oldest scrapers.
• Doesn't stop: Modern bots (which render JS and parse [at]/[dot] patterns trivially), and, crucially, any human scammer who can read.
• Verdict: Security theater. It makes you feel better and buys you maybe a few hours. Skip it except as a minor layer on top of a real solution.

Option 2: A contact form per listing (better, the common default)

Instead of showing Jim's email, show a “Contact seller” form. The buyer fills it in, the platform emails Jim, and Jim's address is never exposed publicly.

• Stops:Email harvesting entirely. The seller's address stays hidden behind the form.
• Doesn't stop: Phone-number exposure (you still have to show somethingor the form has to handle both), spam-bots submitting the form itself, and the core scam problem, because once Jim replies from his real email, the scammer has it and the conversation moves off-platform where you can't protect anyone.
• Verdict:A solid step most WordPress directory plugins (Connections, Directorist, HivePress) and many hosted builders support. But it's one-way, ephemeral, and it doesn't retain the conversation, so it leaks the moment the seller replies directly.

Option 3: A full messaging relay (the one that actually works)

Buyers and sellers talk through in-platform message threads scoped to each listing. Neither party's email or phone is visible until one of them explicitly chooses to reveal it. The conversation is retained on your domain.

• Stops: Harvesting (nothing public to scrape), form-spam (no form, and the thread is rate-limited and logged), and the off-platform scam, because the contact lives inside your platform where you can detect abuse, warn users, and keep a record.
• Doesn't stop:A determined scammer who convinces a seller to reveal a phone number inside the thread. But now it's a social-engineering problem you can see and intervene in, not a structural hole you've handed them.
• Verdict:The only approach that defeats the scrape-and-scam playbook at the architecture level. This is what OLX and Carousell do, and it's the standard for any serious classifieds.

The spam-protection layer every approach needs

Whichever approach you pick, a contact channel open to the public will be abused. Any real implementation needs rate limiting, a CAPTCHA on first contact, spam filtering on message content, and a report-and-block system so sellers can flag abusive contacts. Without this layer, even a relay turns into a spam funnel. With it, a relay is the cleanest contact experience available.

What off-the-shelf tools actually offer (honestly)

• WordPress directory plugins (Connections, Directorist, HivePress, ListingPro): Contact-form-per-listing is common; full messaging relay is rare and usually a paid add-on. The classic request on the WordPress.org support forums, “a workaround to allow popping up a contact form so the email is hidden,”is still being asked because it's not standard.
• Classifieds scripts (Osclass, Flynax): Built-in messaging exists, closer to a relay than a form, but the contact-protection framing is rarely first-class and the UX is dated.
• Custom build: Full control, but you implement and maintain the whole spam-protection stack yourself.

The architecture that wins

Contact should be a first-class, retained, private messaging layer, never an exposed field, never a one-way form. Sellers control when their email or phone is revealed. Threads live on your domain. The spam-protection stack sits in front of it. That's the structural defense against both the bots and the “oil rig” scammers.

I build classifieds software (Yclas). It's cloud-hosted, nothing to install. Run it alongside your existing forum or site — the classifieds live on a separate subdomain or your own domain. Buyer-to-seller messaging is a private relay by default: buyers start a conversation through a form on the listing page, which opens a retained on-site message thread, not a forwarded email. Neither party's contact info is exposed until someone chooses to share it. The free tier has no listing or member caps, with a small Yclas Neo badge in your footer. Your own domain and badge removal is $29/month.

For the broader picture across every tool on the market, see the classifieds breakdown.

— Oliver Servín · oliver@yclas-neo.com