TL;DR: Bots and generative AI are industrialising marketplace abuse by creating synthetic identities, mimicking human behaviour, and adapting in real time, with Prove Identity citing a 300% rise in deepfake identity attacks and 85% of identity fraud involving GenAI. Point-in-time verification is no longer enough when trust is being attacked across the entire user lifecycle.
At a glance
What this is: This is Prove Identity's analysis of how AI-powered bots and synthetic identities are turning marketplace fraud into persistent, adaptive abuse that outpaces static checks.
Why it matters: It matters because marketplace IAM and fraud teams now need continuous identity signals across onboarding, login, and transaction flows, not one-time verification alone.
Context
Digital marketplaces are built on the assumption that participants are real, accountable entities. When bots can create, recycle, and manage identities at scale, that assumption breaks and trust becomes a moving target rather than a fixed checkpoint.
The governance gap is not simply better fraud detection at onboarding. It is the mismatch between static verification models and attackers that adapt across the full user lifecycle, combining automation, synthetic identity creation, and behavioural mimicry to bypass controls designed for a pre-AI environment.
Key questions
Q: What breaks when marketplace identity checks stop at onboarding?
A: Point-in-time verification breaks because attackers do not stay still after signup. They can pass an initial check, then reuse or replace identities, manipulate transactions, and adapt behaviour across later sessions. The control failure is assuming trust is established once instead of continuously maintained across the user lifecycle.
Q: Why do synthetic identities make traditional fraud controls less effective?
A: Synthetic identities reduce the value of controls that rely on spotting obviously fake profiles at signup. AI can create convincing identities quickly, so the stronger control is whether the downstream behaviour remains plausible, consistent, and bounded across sessions, devices, and payment activity.
Q: How can security teams tell whether marketplace trust controls are failing?
A: Watch for rapid account replacement after enforcement, repeated abuse from seemingly separate identities, and rising friction without a matching drop in fraud. Those signals indicate that the same actor is likely recycling identities and that verification is catching snapshots, not sustained abuse patterns.
Q: Should marketplaces prioritise friction reduction or stronger identity assurance?
A: They need both, but not as a trade-off that ignores risk. If friction is reduced without stronger identity assurance, attackers gain easier entry; if assurance is added blindly, legitimate users leave. The practical goal is risk-based trust that changes with context rather than fixed verification for every step.
Technical breakdown
Why point-in-time verification fails in marketplace identity flows
Point-in-time controls assume the riskiest moment is entry, then treat the rest of the session as lower risk unless a rule triggers. That model breaks when a fraud actor can create accounts, change behaviour, and re-enter the workflow repeatedly with new identities. In marketplaces, the same account can be used for credential stuffing, fake reviews, promotional abuse, or transaction manipulation. Static checks see a snapshot, not a pattern, so they miss the attacker’s ability to distribute risk across many sessions and many identities.
Practical implication: identity controls need lifecycle visibility, not just onboarding verification.
How synthetic identities evade behavioural and document checks
Synthetic identity fraud combines fabricated documents with realistic behavioural signals. Generative AI can produce plausible names, profiles, document artefacts, typing cadence, mouse movement, and session timing, which means a single signal rarely proves legitimacy. The problem is compounded when verification logic relies on one channel in isolation. In a marketplace context, the attacker can look different enough to avoid rule-based detection while still behaving consistently enough to pass baseline behavioural analysis. That is why cross-signal validation matters more than any single check.
Practical implication: blend document, device, behavioural, and network signals before granting trust.
Why marketplace scale amplifies bot-driven abuse
Marketplaces increase their own attack surface every time they add a user, listing, or transaction. That growth creates more opportunities for automation to test credentials, manipulate incentives, and exploit low-friction flows. Bots exploit the fact that legitimate platforms are designed for speed and conversion, not adversarial resilience. Once abuse becomes persistent rather than episodic, the issue shifts from isolated fraud events to structural trust erosion across the platform. The result is not only direct loss but degraded confidence in the marketplace itself.
Practical implication: rate limits and transaction controls must be tuned to platform-wide abuse patterns, not isolated events.
Threat narrative
Attacker objective: The objective is to create scalable, repeatable marketplace abuse while avoiding detection and preserving access to fraudulent transactions and incentives.
- Entry occurs through automated account creation, credential stuffing, or other low-friction marketplace interactions that let bots blend into normal traffic.
- Credential and identity signals are then amplified through synthetic profiles, fake documentation, and behavioural mimicry that help the actor pass basic verification.
- The actor escalates by reusing disposable identities across reviews, promotions, and transactions, making enforcement temporary and replacement nearly immediate.
- Impact emerges as trust erosion, transaction abuse, and degraded marketplace confidence that weakens participation and platform integrity.
Breaches seen in the wild
- JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static verification is the wrong control plane for marketplace trust: The article shows that onboarding checks and login-time authentication do not match the way bot-driven fraud actually operates. Attackers now distribute abuse across identity creation, session behaviour, and transaction manipulation, so the decisive control point shifts from a single verification event to continuous trust evaluation. For practitioners, that means fraud and IAM cannot remain separate disciplines.
Identity has become disposable in adversarial marketplace environments: When one actor can control thousands of accounts and replace flagged identities almost immediately, the governance assumption of stable identity ownership breaks down. The article exposes a specific failure mode: lifecycle controls designed for persistent users are being applied to identities that are intentionally temporary and interchangeable. The implication is that accountability must be enforced through linkage and signal continuity, not account permanence.
Behavioural mimicry now has enough fidelity to defeat single-signal defence: Bot operators can imitate mouse movement, typing cadence, and session timing while synthetic identities can satisfy basic document checks. That combination invalidates the old assumption that a clean document or plausible session pattern equals a legitimate participant. Practitioners should treat cross-signal correlation as a baseline requirement, not an enhancement.
Trust infrastructure is the right named concept for this problem: Marketplaces need a continuous system that evaluates identity, device, behaviour, and transaction context together across the full user lifecycle. This is not fraud prevention at one checkpoint; it is governed trust maintenance across every interaction. The field should stop describing this as a point solution gap and start treating it as an architectural shift in how trust is established and maintained.
Marketplace abuse is now a platform-integrity problem, not just a fraud-loss problem: The article is right to emphasise erosion of confidence, because fake accounts and synthetic sellers damage participation even before losses become visible. That moves the issue into core governance, where trust signals, user friction, and abuse tolerance must be managed as one operating model. Practitioners should align fraud response with product and identity governance, not leave it as a narrow loss-prevention function.
From our research library:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
What this signals
Trust infrastructure is becoming the operating model for marketplaces that face AI-driven abuse. Teams should stop thinking about fraud controls as isolated checks and start thinking about how identity, device, behaviour, and transaction context are governed together.
The practical shift is away from static verification and toward continuous scoring across the user lifecycle. That matters because disposable identities and behavioural mimicry make account-level trust a temporary condition unless it is continuously revalidated.
For practitioners
- Map trust checks across the full user lifecycle Identify where your marketplace verifies identity at onboarding, authentication, checkout, and post-registration activity, then look for gaps between those steps where abuse can hide.
- Correlate identity, device, and behaviour signals Require cross-signal validation before accepting a user as legitimate, especially when document checks or basic behavioural biometrics are the only current gates.
- Treat disposable accounts as a governance problem Track account reuse, rapid replacement after enforcement, and clustered activity patterns so you can detect when one actor is operating many identities at once.
- Tune fraud controls to marketplace abuse patterns Review rate limits, promo abuse rules, review integrity controls, and transaction monitoring together so controls reflect platform-wide abuse rather than one-off events.
Key takeaways
- AI-powered bots and synthetic identities are turning marketplace fraud into a persistent trust problem that static checks cannot contain on their own.
- The article shows that attackers now combine scale, realism, and rapid identity recycling, which makes one-time verification increasingly unreliable.
- Marketplace teams need continuous identity signals and cross-signal validation so trust is governed across onboarding, login, and transactions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | Marketplace abuse here depends on bypassing authentication and trust checks at scale. |
| API6 — Unrestricted Access to Sensitive Business Flows | Bots exploit business flows like signup, review, promo, and checkout to abuse platform logic. | |
| Recommendation — Harden authentication flows against automated account creation and replay across marketplace entry points. Restrict high-value marketplace flows with contextual controls and abuse-aware throttling. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Synthetic and automated identities succeed when authentication relies on weak, static assurance. |
| Recommendation — Treat automated and synthetic account enrolment as an identity assurance problem, not just a fraud rule problem. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Marketplaces need governed access decisions across user lifecycle and transaction activity. |
| Recommendation — Apply access permission governance to limit what newly created or suspicious identities can do. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The pattern includes credential stuffing, account reuse, and movement across many marketplace identities. |
| Recommendation — Map repeated account abuse to credential access and lateral movement patterns in detection logic. | ||
Key terms
- Bot-Driven Fraud: Fraud activity amplified by automation that allows attackers to repeat attempts, vary inputs, and scale abuse across many accounts. The identity risk is not only volume but adaptability, because bots can keep probing until they find a path past controls designed for individual users.
- Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
- Continuous Trust: Continuous trust is an assurance model where identity and access are re-evaluated as conditions change, not just at login or issuance. It matters when credentials, devices or ownership can change during an interaction, because static validation leaves stale access in place.
- Marketplace Trust Erosion: Marketplace trust erosion is the gradual decline in user confidence when fake accounts, synthetic participants, or abusive transactions become visible enough to undermine credibility. It is a governance and product risk because it affects participation, conversion, and platform integrity, not just fraud losses.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org