TL;DR: Marketplace fraud on two-sided platforms spans seller fraud, buyer fraud, account takeover, multi-accounting, and policy abuse, with coordinated rings using shared devices, overlapping IPs, and behavioral similarities to evade controls, according to Sift. The governance challenge is not isolated transaction review but continuous lifecycle risk management across identity, behavior, and payment signals.
At a glance
What this is: This is an analysis of why marketplace fraud is structurally different from single-sided e-commerce, with the key finding that fraudsters exploit both buyer and seller trust paths as well as platform-level manipulation.
Why it matters: It matters because trust and safety, fraud, IAM and identity verification teams need controls that follow account behaviour across the full lifecycle, not only payment events or onboarding checks.
Context
Marketplace fraud is a lifecycle governance problem because the platform does not control both parties to a transaction in the way a single-sided merchant does. That changes the attack surface from one payment event to a broader trust model covering registration, login, listing, checkout, dispute and re-registration.
The identity connection is genuine here: fake buyers, fraudulent sellers and account takeover all depend on account trust, behavioural consistency and credential abuse. For marketplace operators, the question is not whether a transaction looks risky in isolation, but whether the identity behind it has earned that trust over time.
Key questions
Q: What breaks when marketplace fraud controls only review transactions at checkout?
A: Checkout-only controls miss the fact that many marketplace attacks begin long before payment and continue after it. Fraudulent sellers can build trust, account takeover can inherit reputation, and coordinated rings can manipulate ratings or policies outside the payment event. Effective protection has to follow the account lifecycle, because transaction review alone is too late to stop many marketplace abuse patterns.
Q: Why do shared devices and overlapping IPs matter in marketplace fraud detection?
A: They matter because coordinated fraud networks often operate multiple buyer and seller accounts through the same infrastructure. Those shared signals reveal relationships that single-account scoring cannot see. When the same device, IP range or behavioural pattern appears across accounts, it suggests organised abuse rather than isolated bad behaviour, which is much more actionable for fraud operations.
Q: What are the signs that a marketplace account has moved from legitimate to risky?
A: Common signs include a sudden change in device, login geography, listing pattern, payment behaviour or dispute behaviour, especially when the account previously had a stable history. Re-registration after enforcement, unusually cheap high-demand listings and abrupt shifts in transaction rhythm are also strong indicators that trust has drifted or been inherited by an attacker.
Q: Who is accountable for marketplace fraud when buyers and sellers are independent users?
A: The marketplace operator is accountable for the trust environment it creates, even when it does not control the underlying buyer or seller organisation. That means the operator must manage onboarding, reputation, enforcement and transaction monitoring as one governance model. Liability may vary by terms of service, but operational responsibility for abuse prevention does not disappear.
Technical breakdown
Why two-sided marketplaces create a different trust model
A marketplace separates platform control from participant control. The operator can govern the platform, but it does not directly control buyer intent or seller fulfilment, which means fraud can enter through either side of the relationship. That makes traditional e-commerce assumptions weak: a clean checkout signal does not prove a legitimate seller, and a trusted seller profile does not guarantee honest fulfilment. In practice, the security problem is lifecycle trust, where the same account can look legitimate at signup and become malicious later. The platform therefore needs to model identity, behaviour and payment risk together, not as isolated checks.
Practical implication: design controls that evaluate trust across onboarding, login, listing, fulfilment and dispute rather than treating checkout as the only decision point.
How coordinated fraud rings hide inside account graphs
Fraud rings rarely depend on one account at a time. They create linked clusters of fake buyers and sellers, then use shared devices, overlapping IP infrastructure, repeated behavioural patterns and linked payment methods to make separate accounts look unrelated. Graph analysis matters because it turns weak per-account signals into stronger network evidence. The important technical point is that relationship data often exposes coordination more reliably than rule thresholds on a single session or transaction. This is especially important for marketplaces because the same ring may be manipulating ratings, wash trading and policy abuse at the same time.
Practical implication: use cross-account relationship analysis to surface shared infrastructure and behavioural overlap before coordinated fraud scales.
Why account takeover is especially damaging on marketplaces
Account takeover on a marketplace is not just an access event. A fraudster who compromises an established seller inherits transaction history, positive feedback and platform trust that would take time to build from scratch. That changes the economics of abuse because the attacker can immediately post fraudulent listings under a credible identity. Re-registration after enforcement also shows that blocking one account rarely ends the campaign. The underlying control gap is weak identity continuity across the lifecycle: the platform may see the same actor return under new credentials, new identity data or a new account.
Practical implication: bind enforcement to identity continuity signals so that re-registration and seller takeover cannot reset trust cheaply.
Threat narrative
Attacker objective: The attacker wants to monetise marketplace trust by moving fraudulent transactions through a credible identity or account path before detection catches up.
- Entry begins when a fraudster creates fake buyer or seller accounts, takes over an established account, or re-registers after enforcement using new identity data.
- Credential or trust abuse follows when the attacker uses stolen payment methods, inherited seller reputation or linked accounts to pass platform checks and move transactions.
- Escalation occurs as coordinated rings use shared devices, overlapping IPs, review manipulation and wash trading to distort trust signals across the marketplace.
- Impact is fraudulent fulfilment, buyer and seller losses, chargeback exposure, rating manipulation and platform trust erosion at scale.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Marketplace fraud is a lifecycle trust problem, not a payment problem. The article correctly shows that the platform's real exposure runs from account creation through disputes and re-registration, not just through checkout. That means fraud governance must treat identity, behaviour and payment as one risk surface. Practitioners should design controls around trust continuity across the whole user lifecycle.
Account takeover is the marketplace equivalent of inherited reputation abuse. Once an attacker compromises a trusted seller account, they acquire not just credentials but the credibility built by the legitimate seller. That makes reputation itself a security asset that can be stolen and redeployed. Practitioners should protect seller continuity as carefully as they protect payment authentication.
Graph-level fraud detection is now a governance requirement, not an optimisation. Shared devices, overlapping IPs and behavioural similarity are not edge cases when coordinated rings operate at scale. The named concept here is lifecycle trust drift: the gap between the point at which an account looked legitimate and the point at which it became harmful. Practitioners should use relationship analysis to close that gap.
Marketplace operators are really managing distributed identity assurance across buyers and sellers. The article shows that neither participant class is fully controlled by the platform, which makes identity verification and ongoing behaviour monitoring central to trust and safety. That intersection matters for IAM and identity verification teams because marketplace fraud is often identity fraud with a commercial wrapper. Practitioners should align fraud controls with identity governance rather than leaving them as separate disciplines.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
Lifecycle trust drift: marketplace fraud becomes harder when the point of first trust and the point of abuse are separated by days, weeks or months. Security teams should therefore assume that registration controls alone will not protect the platform once accounts begin to accumulate reputation and behavioural history.
For marketplace operators, fraud and identity governance are now converging. The practical lesson is to treat account continuity, re-registration and reputation inheritance as governance issues, not just fraud-team tuning problems.
For practitioners
- Implement lifecycle-based fraud monitoring Track risk from registration through login, listing, transaction, dispute and re-registration so that trusted accounts can still be challenged when behaviour changes.
- Deploy graph analysis for linked fraud activity Correlate shared devices, overlapping IP infrastructure, payment methods and behavioural similarities across accounts to surface coordinated rings that single-account rules miss.
- Treat account takeover as trust inheritance Flag established seller accounts for stronger step-up review when credentials change, new devices appear or listing behaviour diverges from historical patterns.
- Separate fraud controls by marketplace role Model buyer, seller and platform-specific abuse paths independently so chargeback fraud, non-delivery scams and policy abuse do not collapse into one generic rule set.
Key takeaways
- Marketplace fraud is a multi-path trust problem that spans seller abuse, buyer abuse, account takeover and policy exploitation.
- The article shows that coordinated rings often hide in shared infrastructure and overlapping behaviour, which makes network analysis more useful than isolated account review.
- The strongest control response is lifecycle monitoring that links identity, behaviour and payment signals from onboarding through dispute resolution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Marketplace abuse targets transaction flows, dispute handling and policy mechanisms that resemble protected business flows. |
| Recommendation — Map marketplace abuse paths to API6-style business-flow protection and constrain high-risk transaction journeys. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Marketplace trust depends on controlling what accounts can do as their risk changes over time. |
| Recommendation — Continuously review entitlements for marketplace accounts and tighten access when behaviour diverges from baseline. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on account lifecycle abuse, re-registration and takeover across buyer and seller roles. |
| Recommendation — Enforce account management controls that detect takeover, re-registration and stale privileged marketplace accounts. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The fraud patterns rely on credential misuse, account takeover and movement across linked accounts. |
| Recommendation — Track credential misuse and lateral movement across related marketplace accounts to uncover coordinated abuse. | ||
Key terms
- Marketplace Fraud Friction: The operational cost created when security controls slow down legitimate marketplace participation. It includes drop-off, support burden, and reduced conversion. Strong programmes reduce fraud while keeping the trust path light enough that honest users can still complete the journey.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Cross-Account Relationship Analysis: A detection method that links accounts through shared devices, IP infrastructure, payment methods, and behavioural patterns. Rather than judging each account in isolation, it looks for network-level relationships that reveal coordinated fraud rings or repeated abuse across multiple identities.
- Lifecycle Trust Decision: An approval that is valid only for the current stage of an account’s journey, such as onboarding, listing, or payout. The point is to stop treating trust as permanent once admission is granted. In marketplaces, each later stage should be able to challenge or revoke the earlier decision.
Deepen your knowledge
The NHI Foundation Level course covers NHI governance, human identity, and secrets management in a way that helps security and fraud teams connect identity controls to real operational risk. It is designed for practitioners who need to govern trust across accounts, credentials and lifecycle events.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org