They matter because coordinated fraud networks often operate multiple buyer and seller accounts through the same infrastructure. Those shared signals reveal relationships that single-account scoring cannot see. When the same device, IP range or behavioural pattern appears across accounts, it suggests organised abuse rather than isolated bad behaviour, which is much more actionable for fraud operations.
Why shared signals matter in marketplace fraud detection
Shared devices and overlapping IPs matter because fraud in marketplaces is often networked, not isolated. A single bad account may look ordinary, but a device, browser profile or IP range reused across many buyer and seller profiles can expose coordination, account farming, mule activity or synthetic identity behaviour. That makes cross-account linkage more actionable than scoring each account alone.
These signals are most useful when they are treated as relationship evidence, not as a standalone verdict. One shared IP can be incidental, especially in homes, offices or mobile networks, but repeated overlap across new accounts, payment patterns and session behaviour is a strong indicator that the accounts are operating as a cluster.
For fraud operations, the value is that shared infrastructure helps collapse what appears to be many low-risk events into one higher-confidence abuse pattern. That improves prioritisation, reduces alert fatigue and gives investigators a better starting point for network-level review, rather than forcing them to prove intent account by account.
How shared infrastructure changes the investigation
When analysts can see that multiple accounts use the same device fingerprint, IP range or behavioural signature, they can pivot from entity-level review to relationship-level analysis. That often reveals hidden structure such as one operator controlling many accounts, a group sharing access, or an upstream enablement layer like proxies, emulators or scripted automation. NHIMG’s Identity Fraud Prevention Guide covers the linked-device and linked-behaviour patterns that make this kind of clustering effective.
This is especially important in marketplaces because sellers and buyers can both be abused. The same infrastructure may support fake storefronts, promo abuse, review fraud, card testing or laundering through mule accounts. A useful fraud model therefore scores the account, but also asks whether the surrounding network looks like a coordinated operation rather than a single user with an unusual login.
Investigation quality improves when teams separate stable relationship signals from noisy location signals. Overlapping IPs from a shared office or carrier NAT are weaker on their own, while persistent device reuse, repeated session similarity and reuse across newly created accounts are much stronger. NHIMG’s Device and IoT Identity Guide is useful background on why strong device identity and lifecycle trust matter when devices themselves become durable signals.
What strong fraud teams look for in practice
Strong fraud detection uses shared signals to build a graph, not just a rule. The question is not whether two accounts ever touched the same IP, but whether the same infrastructure is repeatedly present across account creation, login, payout, device, and transaction events. That is what turns a weak coincidence into a defendable abuse hypothesis.
Commonly, the strongest patterns combine several clues at once: same device plus repeated IP overlap, rapid account creation plus repeated behavioural similarity, or one infrastructure cluster attached to many accounts with different names, emails or shipping details. Those combinations help distinguish organised abuse from legitimate household, workplace or travel behaviour. MITRE D3FEND provides a useful defensive lens for thinking about detection and countermeasure mapping in this kind of adversary-linked analysis: MITRE D3FEND.
Operationally, the best outcome is not just better blocking. It is better triage. Shared signals let analysts group events into cases, reduce duplicate review, identify root infrastructure, and decide whether to step up verification, hold payouts, or freeze linked accounts pending deeper review. That is much more effective than reacting only after each individual account crosses a loss threshold.
Risk and Threat Considerations
Shared infrastructure creates both false-positive and false-negative risk. If teams overreact to a single overlapping IP, they can suppress legitimate users behind shared networks; if they ignore repeated device or network reuse, they can miss organised fraud rings that are deliberately distributing activity across many accounts.
Failure mechanism: Fraud actors reuse devices, proxies, browser fingerprints and IP ranges to make multiple accounts look independent, while defenders who only score accounts individually fail to see the cluster. Shared infrastructure can also be intentionally noisy, so weak signals are used to hide stronger coordinated abuse.
Impact: The result can be missed account farming, fake listings, payment abuse, refund abuse, review manipulation or mule activity, plus wasted analyst time on isolated alerts that should have been grouped into one case.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Fraud rings often reuse infrastructure across accounts and sessions. |
| T1078 — Valid Accounts | Marketplace fraud often abuses many accounts that share access paths. | |
| Recommendation — Map repeated device and IP reuse to infrastructure acquisition patterns and hunt for coordinated abuse clusters. Correlate shared infrastructure with account use to spot coordinated valid-account abuse. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Shared IP patterns require detection and correlation across network telemetry. |
| CIS-8 — Audit Log Management | Cross-account linkage depends on retaining session, login and device evidence. | |
| Recommendation — Centralise network telemetry and correlate repeated source patterns across accounts and sessions. Retain login, session and device logs long enough to correlate fraud clusters. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Marketplace abuse often manifests as repeated flow abuse across linked accounts. |
| Recommendation — Watch for repeated access to high-value marketplace flows from the same infrastructure cluster. | ||
Practitioner Guidance
What to prioritise: Treat shared device and IP evidence as linkage signals first, and as enforcement triggers only when they repeat across account lifecycle stages. A single shared IP may be weak; repeated reuse across signup, login and payout is far more actionable.
What to verify: Confirm that the signal is not explained by household sharing, corporate NAT, mobile carrier addressing, VPN concentration or test traffic. The strongest cases usually show persistence, cross-account repetition and alignment with other abuse markers such as velocity, payment reuse or behavioural similarity.
What good looks like: Analysts can pivot from one suspicious account to a linked cluster, see the shared infrastructure behind it, and decide on one containment action for the whole group rather than chasing accounts one by one.
Practitioner takeaway: The main value of shared devices and overlapping IPs is not that they prove fraud by themselves, but that they expose the relationships that organised fraud depends on.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org