Attackers use marketplace fraud to steal goods, funds, or identities by abusing seller and buyer trust on peer-to-peer platforms. Common tactics include fake listings, non-delivery, payment diversion, and account takeover. Defenders should check for new-account velocity, off-platform payment requests, repeated dispute activity, and profile details reused across multiple accounts.
How attackers operationalize marketplace fraud
marketplace fraud works because peer-to-peer platforms combine weak identity assurance, fast-moving transactions, and limited prior trust. Attackers exploit that environment with fake storefronts, non-delivery scams, payment diversion, and account takeover. The practical question is not just “is the listing fake?”, but whether the platform can still verify who controls the account, who receives the payment, and whether the same actor is behind multiple seller or buyer profiles.
Fraud campaigns often scale by industrialising the parts that are easiest to automate: account creation, profile recycling, listing insertion, and dispute handling. A useful way to think about this is to separate the fraud act itself from the enabling control failures, because the same attacker playbook can produce stolen goods, stolen funds, or stolen identities depending on where the trust boundary breaks. NHIMG’s Fraud Prevention Guide for Digital Businesses is helpful here because it frames fraud as an operational system, not a single event.
Marketplace fraud also overlaps with broader credential and takeover abuse when the attacker uses a compromised account to look legitimate. Once a seller profile is hijacked, the fraudster inherits reputation, prior feedback, and message history, which makes the scam harder to spot than a brand-new fake account. For that reason, repeated account linkage, reused profile details, and abnormal dispute patterns are often more useful indicators than the listing text alone. NHIMG’s The State of NHI & AI Agent Breach Report 2026 is relevant as a broader reminder that stolen credentials and compromised accounts frequently become the starting point for downstream abuse.
How the main fraud patterns work
Fake listings are usually designed to create urgency, scarcity, or a price advantage that pushes the buyer to act before they validate the seller. Non-delivery scams rely on the reverse problem: the buyer pays, the seller disappears, and the platform is left with a dispute rather than a clean transaction record. Payment diversion is more subtle, because the listing may be real while the payment destination, checkout flow, or follow-up message stream is redirected to the attacker.
Account takeover changes the entire fraud profile because the attacker no longer needs to persuade the victim from scratch. They can message from an established account, inherit trust signals, and shift the conversation off-platform where there is less visibility and fewer recovery options. That is why off-platform payment requests are such a strong warning sign, especially when they are paired with time pressure, shipping excuses, or a request to bypass platform protections.
Marketplace fraud also includes synthetic trust building, where the attacker accumulates small legitimate-looking interactions before attempting a larger theft. That can mean repeated low-value sales, staged disputes, or profile history that appears normal until the attack matures. The fraud may look like isolated bad behaviour at first, but the operational pattern often reveals a coordinated campaign across many accounts.
What defenders should watch first
New-account velocity matters because high rates of sign-up, listing creation, or payment method changes often precede fraud bursts. Repeated dispute activity is another strong signal, especially when the same device, payment instrument, address, or contact pattern appears across different accounts. Reused profile details can expose fraud rings that are trying to create the appearance of separate buyers or sellers while actually operating from the same operator set.
Good detection is usually correlation-heavy rather than single-signal based. A suspicious listing by itself may be noise, but a suspicious listing plus an off-platform payment request plus a new account with recycled profile details is much harder to dismiss. Defenders should also treat unusual shipping patterns, last-minute address changes, and repeated refund or chargeback behaviour as part of the same attack surface, not as separate isolated problems.
Risk and Threat Considerations
Marketplace fraud is dangerous because it exploits trust at transaction speed, where manual review is often too slow to prevent loss. The same playbook can be used for direct theft, laundering of stolen goods, or laundering of fraudulent reputation through compromised accounts and repeated disputes.
Failure mechanism: Fraud succeeds when the platform cannot reliably connect an account, a payment instrument, and a real-world fulfilment path to the same trusted actor. Attackers then use urgency, account takeover, or profile reuse to bypass normal suspicion thresholds.
Impact: The result can be direct financial loss, chargebacks, counterfeit or stolen inventory entering the marketplace, account lockouts for legitimate users, and harder recovery because the fraud trail is distributed across many small interactions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Marketplace fraud often depends on account creation, reuse, and takeover across seller and buyer profiles. |
| Recommendation — Enforce account lifecycle controls and remove stale or duplicated marketplace accounts quickly. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management is used to manage access to physical and logical assets | Fraud abuse here relies on weak account trust and poor access assurance. |
| Recommendation — Apply strong access assurance to accounts that can list, pay, or withdraw funds. | ||
| MITRE ATT&CK | T1586 — Compromise Accounts | Account takeover is a core enabler of marketplace fraud campaigns. |
| Recommendation — Hunt for compromised marketplace accounts that are being used to impersonate legitimate users. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Abandoned or unrevoked marketplace accounts can be reused for fraud and impersonation. |
| Recommendation — Revoke dormant marketplace accounts and their linked access paths promptly. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Fraud platforms with weak login or session controls are easier to abuse at scale. |
| Recommendation — Harden authentication on seller, buyer, and payout workflows. | ||
Practitioner Guidance
What to prioritise: Start with controls that break the fraud chain early, before shipment or payout. Velocity checks, payment path validation, and cross-account linkage analysis usually provide more value than post-loss dispute handling.
What to verify: Confirm that your review process can detect account reuse, device reuse, address reuse, and repeated dispute behaviour across otherwise separate profiles. If those signals are not joined, a fraudster can look “new” on every transaction.
Decision rule: If a transaction combines a new or recently changed account, an off-platform payment request, and reused profile details, treat it as elevated risk even if the listing content appears plausible.
Practitioner takeaway: Marketplace fraud is best stopped by proving continuity of actor, payment, and fulfilment, because attackers win when they can make those three things look unrelated.