Marketplace fraud is shifting beyond cards as economic pressure builds

At a glance

What this is: Sift’s analysis says marketplace fraud is shifting away from card-only abuse toward identity-driven tactics such as account takeover, alternative payment method abuse, and first-party fraud.

Why it matters: Marketplace risk teams need to move from payment fraud metrics alone to identity-aware controls because the platform, the account, and the payout path are now part of the attack surface.

By the numbers:

• Payment fraud in e-commerce marketplaces dropped to 1.6% in Q1 2025.
• The overall account takeover rate sits at 3.2%, while marketplace ATO is 3.8%.
• Points-based payment methods see the highest fraud block rates at 8.4%.
• Financing tools and crypto follow closely at 5.4%.

Context

Marketplace fraud is not just a payments problem. In this article, Sift argues that economic pressure is changing how abuse shows up across marketplaces, with fraud shifting into account takeover, alternative payment methods, refund abuse, and listing manipulation rather than staying confined to card testing.

For identity and fraud teams, the governance gap is the assumption that payment controls alone are enough. Marketplaces concentrate identity, payment, loyalty, and payout data in one place, so fraud prevention now depends on understanding account trust, user behaviour, and step-up controls across the full transaction path.

Key questions

Q: What should marketplace teams do first when account takeover starts affecting payouts and listings?

A: Start with the highest-value account actions, not the login event itself. Put step-up verification on payout edits, seller profile changes, loyalty redemption, and new-device access. Then tie those actions to risk scoring so trusted accounts with stored value are challenged before the attacker can cash out or manipulate listings.

Q: Why does lower card fraud not always mean lower marketplace fraud?

A: Because attackers move to the easiest monetization path, not necessarily the card rail. When card controls tighten, fraud often shifts to account takeover, loyalty balances, financing tools, refunds, or scam listings. Teams need to measure abuse across the whole marketplace lifecycle, not only payment authorisation outcomes.

Q: What do security teams get wrong about marketplace fraud controls?

A: They often treat fraud prevention as a separate function from identity governance. In practice, verification, behavioural analytics, transaction monitoring, and exception handling all govern the same participant lifecycle. If those signals are disconnected, the platform reacts too late and cannot explain why one account was approved while another was blocked.

Q: How do identity and fraud teams share accountability for delivery-platform abuse?

A: Identity teams own assurance at onboarding, recovery, and merchant access points, while fraud teams own detection and response across the transaction flow. The governance gap appears when those responsibilities are separated, because abuse then moves into the handoff between identity verification and transaction approval.

Technical breakdown

Why account takeover is a marketplace fraud multiplier

Account takeover is effective in marketplaces because the account itself often stores value, trust, and operational context. A compromised marketplace account can expose saved payment methods, loyalty balances, shipping details, listings, and dispute history, which makes the attack more profitable than a simple card test. Attackers can use phishing, credential stuffing, or social engineering to bypass weak identity checks and then blend in with normal activity. Once inside, they can cash out quickly through payouts, purchases, or resale flows. Practical implication: risk engines need account-level signals, not only payment-authentication outcomes.

Practical implication: Prioritise account-level risk scoring and step-up checks before payout, listing changes, or payment method changes.

How alternative payment methods change fraud economics

Alternative payment methods, loyalty balances, financing tools, and crypto can reduce friction for legitimate users, but they also change how fraudsters monetize access. These payment paths often have different verification steps, slower dispute visibility, or weaker scrutiny than cards, which makes them attractive when card controls tighten. Fraudsters adapt by moving to the least governed cash-out route rather than abandoning the platform. That is why lower card fraud does not automatically mean lower fraud overall. Practical implication: teams need separate controls and review logic for each payment rail, not a single fraud rule set.

Practical implication: Map each payment method to its own abuse model, review threshold, and dispute path instead of reusing card controls everywhere.

Why economic pressure increases first-party fraud and abuse

Economic stress tends to increase the volume of disputed transactions, refund manipulation, chargeback abuse, and scam listings because more users rationalize misuse or search for quick monetization. In marketplace environments, that pressure blurs the boundary between opportunistic customer behaviour and deliberate fraud. The control challenge is not simply detection, but classification: teams must distinguish genuine dissatisfaction from organised abuse patterns. Practical implication: fraud operations should correlate account history, transaction intent, and behavioural patterns before deciding whether to escalate or auto-approve a claim.

Practical implication: Correlate behavioural context and claim history before approving refunds, disputes, or seller reversals.

Threat narrative

Attacker objective: The attacker aims to monetize trusted marketplace access by converting account trust, payment paths, or platform reputation into cash, goods, or fraudulent claims.

1. Entry begins with phishing, credential stuffing, or social engineering that gives an attacker access to a marketplace account tied to payment and listing activity.
2. Credential abuse lets the attacker use the trusted account to manipulate payouts, place orders, redeem loyalty value, or create fraudulent listings while appearing legitimate.
3. Escalation occurs when the attacker uses the account’s existing trust relationships to move through payment rails, support workflows, or seller functions with reduced scrutiny.
4. Impact is fraud at scale through stolen funds, abuse of marketplace trust, chargebacks, or monetization through listings, refunds, and alternative payment methods.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Marketplace fraud is becoming an identity governance problem, not just a payments problem. Once an account stores payout rights, loyalty value, seller privileges, and identity history, the control plane has expanded beyond card verification. That means fraud teams must govern who can act, what they can change, and which trust signals justify higher-risk actions. The practitioner conclusion is simple: the marketplace account is now a high-value identity, not just a login.

Economic stress creates a governance blind spot because it pushes abuse into normal customer behaviour. Refund abuse, first-party fraud, and scam listings can look like edge cases until they scale across a marketplace. That makes threshold design, anomaly detection, and claim review policy part of the fraud control architecture. The practitioner conclusion is that teams need stronger behavioural segmentation, not broader manual review alone.

Identity-centric fraud decisioning is the named control gap this article surfaces. Sift’s point is not that fraud disappeared when card fraud fell, but that it reappeared across account, payment, and platform layers. That creates a governance requirement to connect identity risk, transaction risk, and content abuse in one decision path. The practitioner conclusion is to treat trust as a lifecycle control, not a point-in-time check.

Marketplaces should assume fraudsters will move to the least governed cash-out path. If cards become harder to abuse, attackers shift to loyalty balances, financing tools, crypto, or compromised accounts with seller privileges. That is a control selection issue, not just a detection issue, because each rail needs its own evidence threshold and response path. The practitioner conclusion is to align fraud controls to the monetization route, not the payment brand.

Fraud operations and identity teams need shared accountability for marketplace abuse. The article’s core message is that platform risk now spans account security, transaction integrity, and content moderation. Separating those functions creates gaps that attackers can exploit between teams. The practitioner conclusion is to manage marketplace abuse as a cross-functional identity and fraud governance problem.

What this signals

Identity-centric fraud decisioning is becoming the practical baseline for marketplaces because payment controls alone cannot explain how abuse migrates across accounts, listings, and payout paths. Teams that still optimise only for card fraud will miss the shift into trust-based abuse.

For practitioners, the signal is to treat marketplace accounts as high-value identities with changing trust states. That means tighter control of payout changes, seller actions, and alternative payment rails, plus closer alignment between fraud operations and identity governance.

Benchmark drift matters as much as raw fraud volume. A falling payment fraud rate can hide movement into account takeover, refund abuse, or promotion misuse, so programme owners need cross-channel measurement before they assume the threat is easing.

For practitioners

• Strengthen account takeover controls on high-value marketplace accounts Increase step-up verification for payout changes, new device sign-ins, seller profile edits, and loyalty redemptions. Prioritise accounts with stored value, seller permissions, or repeated disputed transactions.
• Separate controls by payment method and fraud rail Create distinct review logic for cards, points, financing, and crypto because each rail has a different abuse pattern and cash-out speed. Do not let one control threshold govern every payment path.
• Correlate refund, listing, and chargeback behaviour Connect dispute outcomes, seller behaviour, account age, and listing activity in one decision view so first-party fraud and promotion abuse are not treated as isolated events.
• Use fraud benchmarks to spot drift early Compare your internal rates for payment fraud, ATO, and chargebacks against market benchmarks so a lower fraud rate does not hide migration into another abuse channel.

Key takeaways

• Marketplace fraud is no longer bounded by card testing because attackers now target accounts, payouts, loyalty balances, and listings as monetization paths.
• The article shows that falling payment fraud can coexist with persistent or shifting abuse, which is why isolated payment metrics are misleading.
• Teams should align identity controls, payment controls, and abuse detection so marketplace trust is governed across the full transaction lifecycle.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• First Party Fraud: Fraud committed by a real, verified customer who abuses legitimate access to obtain refunds, disputes, chargebacks, or reimbursements. The identity is authentic, but the behaviour is deceptive. In practice, the control problem shifts from proving who the user is to proving whether the claim is consistent, credible, and repeatable.
• Identity-Rich Fraud Decisioning: A fraud approach that evaluates account, device, payment, address and behavioural context together instead of relying on one session signal such as click depth or dwell time. In agentic commerce, that broader context is necessary because legitimate AI-assisted sessions can look unusually fast.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.