Hide Seller Email & Phone: Secure Contact for Classifieds That Actually Stops Scams

If you run a classifieds site (a car club forum, a niche marketplace, a directory) there's a good chance your listings look something like this:

1969 Mustang, 351 Cleveland, runs good, $18k OBO. Call Jim at (555) 123-4567 or email jimsmith[at]gmail.com.

It feels harmless. It's how classifieds have worked since the newspaper era. And in 2026, it's the exact reason your members are getting bombarded with scam texts and your sellers are getting harvested by bots. Let's fix it properly.

Why public contact info is a bigger problem than you think

There are three forces converging on the humble “posted phone number,” and all three have gotten worse recently.

1. Scrapers are industrial now. Phone numbers and emails posted in plain text on a public page are harvested within hours by bots that sell them to spam lists, phishing operations, and lead-brokers. A seller who lists once can be getting SMS spam for years.

2. Scammers specifically target exposed contacts. Classic-car online scams are at record levels: the Better Business Bureau reports roughly $45 million a year in losses to fake classic-vehicle scams, median loss about $12,600, with some victims out upwards of $36,000. The playbook starts with a scammer harvesting a buyer or seller's phone number and running the “I'm working on an oil rig, wire the deposit to eBay's escrow”play. It works because the contact happens off-platform, where the club can't see it or warn anyone. The FBI's Internet Crime Complaint Center has recorded roughly 27,000 complaints of online vehicle-sale fraud since 2014, totaling more than $54 million in losses, and the scams keep climbing. Exposed contact info is how the scammers reach their victims.

3. It's increasingly a legal liability.Under GDPR and CCPA, a club or platform publicly posting members' personal contact details without clear consent and a lawful basis is a genuine compliance risk. Volunteer-run communities that never had legal review are now sitting on a quiet exposure.

The good news: this is one of the few marketplace security problems with a clean architectural fix. You have three options, and only one actually solves it.

The three approaches to hiding seller contact info

Option 1: Obfuscation (weak, don't bother)

Writing emails as jimsmith[at]gmail.com, or using JavaScript to “encode” a mailto:link so it doesn't appear in the raw HTML.

• Stops: The dumbest, oldest scrapers.
• Doesn't stop: Modern bots (which render JS and parse [at]/[dot] patterns trivially), and, crucially, any human scammer who can read.
• Verdict: Security theater. It makes you feel better and buys you maybe a few hours. Skip it except as a minor layer on top of a real solution.

Option 2: A contact form per listing (better, the common default)

Instead of showing Jim's email, show a “Contact seller” form. The buyer fills it in, the platform emails Jim, and Jim's address is never exposed publicly.

• Stops:Email harvesting entirely. The seller's address stays hidden behind the form.
• Doesn't stop: Phone-number exposure (you still have to show somethingor the form has to handle both), spam-bots submitting the form itself, and the core scam problem, because once Jim replies from his real email, the scammer has it and the conversation moves off-platform where you can't protect anyone.
• Verdict:A solid step most WordPress directory plugins (Connections, Directorist, HivePress) and many hosted builders support. But it's one-way, ephemeral, and it doesn't retain the conversation, so it leaks the moment the seller replies directly.

Option 3: A full messaging relay (the one that actually works)

Buyers and sellers talk through in-platform message threads scoped to each listing. Neither party's email or phone is visible until one of them explicitly chooses to reveal it. The conversation is retained on your domain.

• Stops: Harvesting (nothing public to scrape), form-spam (no form, and the thread is rate-limited and logged), and the off-platform scam, because the contact lives inside your platform where you can detect abuse, warn users, and keep a record.
• Doesn't stop:A determined scammer who convinces a seller to reveal a phone number inside the thread. But now it's a social-engineering problem you can see and intervene in, not a structural hole you've handed them.
• Verdict:The only approach that defeats the scrape-and-scam playbook at the architecture level. This is what Craigslist, OLX, and Carousell do, and it's the standard for any serious classifieds.

The spam-protection layer every approach needs

Whichever you pick, a contact channel that's open to the public will be abused. Any real implementation needs:

• Honeypot field, a hidden input humans never fill but bots do; silently reject those submissions.
• Rate limiting, cap messages per IP and per account per hour.
• CAPTCHA on first contact, Google reCAPTCHA or a privacy-friendly alternative (hCaptcha, Turnstile) on the initial message, not every reply.
• Spam filtering, Akismet or equivalent on message content.
• Country/IP filtering, optional but effective if your community is region-specific (a UK car club has no reason to accept first-contact from certain regions).
• Report + block, let sellers flag and block abusive contacts; surface repeat offenders to moderators.

Without this layer, even a relay turns into a spam funnel. With it, a relay is the cleanest contact experience available.

What off-the-shelf tools actually offer (honestly)

• WordPress directory plugins (Connections, Directorist, HivePress, ListingPro): Contact-form-per-listing is common; full messaging relay is rare and usually a paid add-on. The classic request on the WordPress.org support forums, “a workaround to allow popping up a contact form so the email is hidden,”is still being asked because it's not standard.
• Classifieds scripts (Yclas, Osclass, Flynax): Built-in messaging exists, closer to a relay than a form, but the contact-protection framing is rarely first-class and the UX is dated.
• Transactional marketplace builders (Sharetribe, Prometora, Arcadier):Messaging exists, but it's transaction-bound, designed around an order or booking, not standalone buyer-seller contact. And as I noted in the Sharetribe pricing breakdown, a conversation thread even counts as a metered “transaction,” so the contact you want is what you get charged for.
• Custom build: Full control, but you implement and maintain the whole spam-protection stack yourself.

The architecture that wins

If you're building or choosing a classifieds, the rule is simple: contact should be a first-class, retained, private messaging layer, never an exposed field, never a one-way form.Sellers control when their email or phone is revealed. Threads live on your domain. The spam-protection stack sits in front of it. That's the structural defense against both the bots and the “oil rig” scammers, and it's the one feature most off-the-shelf tools underdeliver.

And here's the sharper point: routing that contact off Facebook matters more than ever. Per the Better Business Bureau, Facebook accounts for 57% of scams by platform (Instagram 22%, WhatsApp 8%), and the Global Anti-Scam Alliance found that 81% of US scam attempts occur on platforms with a direct-message function(Consumer Federation of America, 2026). The platform where most of your buyers live is also the platform where most fraud originates. A private relay on your own domain doesn't just hide phone numbers, it pulls the buyer-seller conversation off the exact channel where 57% of scams start.

This is core to what I'm building, a no-checkout classifieds platform where buyer-to-seller messaging is a private relay by default, contact info stays hidden until the seller chooses, and the whole trust model doesn't depend on escrow. I wrote up the broader picture, the five pain points listings-and-contact operators hit across every tool on the market, in the secure-contact classifieds breakdown. The scam angle is pain number three, and it's the one most communities underestimate until a member loses money.

— Oliver Servín · oliver@yclas-neo.com