We're selling a soundbar system on the Facebook marketplace and received an offer with a request to post to London. I checked the postage address and all seemed straightforward enough. We received the emails from what appeared to be from Monzo Bank as proof they had sent us the money. They included links to provide proof of postage (but didn't click them).
When funds didn't show we contacted our bank. The bank said as long as we didn't share pin and password we would be OK. However, the scary thing is they could potentially set up a direct debit using the minimal details I gave them. So bank have placed a stop on any new direct debits and will call us to verify any in the future.
Just be careful - it all looked plausible!