Marketplace Seller and Platform Fraud Guide

A two-sided marketplace carries fraud risk from both sides at once: fake or hijacked sellers defraud buyers, fraudulent buyers defraud sellers, and colluding accounts use the platform itself to launder stolen money. This guide is written for the people who run marketplaces: trust and safety leads, fraud and risk teams, payments and compliance owners, and the engineers who build onboarding and payout flows. It covers seller verification and the US INFORM Consumers Act, the EU Digital Services Act trader traceability duty, triangulation fraud, listing and review fraud, buyer and seller collusion, seller account takeover and payout controls. Shoppers and casual sellers should read the Online Marketplace Buying and Selling Safely Guide instead, which covers the consumer side.

Key takeaways

Payouts are the control point that matters most. Almost every marketplace fraud type ends with the platform paying money out to a criminal, so payout timing, reserves and payout account changes deserve the strongest controls.
Seller verification is now a legal duty, not only good practice. In the US the INFORM Consumers Act requires marketplaces to collect and verify bank, tax and contact details from high-volume sellers within 10 days, and in the EU the Digital Services Act requires trader traceability.
Verification at onboarding is not enough. Fraudsters buy aged, verified seller accounts or take them over, so re-verify on risk events such as a payout account change, a category switch or a sudden volume spike.
Triangulation fraud hides behind happy customers. The buyer receives genuine goods, so complaints arrive late and from a third party, the cardholder whose stolen card paid the retailer.
Look at networks, not single accounts. Collusion, review fraud and mule payouts only show up when you link sellers, buyers, devices, addresses and bank accounts into one graph.

The marketplace fraud landscape

Marketplace operators sit between strangers and usually hold the money for some period. That gives them both the visibility to spot fraud and the liability when they miss it. The table sets out the main fraud types by who commits them and who loses.

Fraud type	Who commits it	Who usually loses	Strongest signals
Fake seller (non-delivery)	New seller account built to take payment and vanish	Buyers, then the platform through refunds and guarantees	New account, high-demand items below market price, pressure to pay off-platform
Triangulation fraud	Seller who fulfils orders with goods bought using stolen cards	Cardholders and the retailers who accepted the stolen cards; the platform faces disputes and reputational harm	Prices below wholesale, retailer-branded packaging, ship-to addresses that never match the seller
Seller account takeover	Attacker who logs in to an established seller account	The genuine seller, buyers of fake listings, the platform	New device or country, password reset then payout account change, listings switched to new categories
Listing and counterfeit fraud	Seller listing goods that are counterfeit, stolen or not as described	Buyers and rights holders	Copied images, brand terms in listings from unrelated sellers, high return rates
Review and reputation fraud	Seller rings, paid review brokers, competitors	Buyers misled by ratings; honest sellers	Bursts of five-star reviews, reviewers sharing devices or payment instruments
Buyer and seller collusion	Linked accounts trading with each other	The platform, card issuers, promotions budgets	Repeat trades between the same small group, shared devices, refunds that loop back
Buyer-side fraud	Buyers using stolen cards, false not-received claims or returns fraud	Sellers and the platform	Mismatched billing and shipping, claim history across accounts

Buyer-side abuse such as false claims and returns fraud is covered in the Refund and Returns Fraud Guide and the First-Party Fraud Guide. This guide concentrates on the seller side and on fraud that uses the platform's own money flows.

Seller verification and the INFORM Consumers Act

The US Integrity, Notification, and Fairness in Online Retail Marketplaces for Consumers Act (INFORM Consumers Act) took effect on 27 June 2023 and is enforced by the Federal Trade Commission (FTC) and state attorneys general. It applies to online marketplaces that host third-party sellers of new or unused consumer products. According to the FTC's business guidance, the key obligations are these.

Requirement	What the FTC guidance says	Operational implication
Who is a high-volume third-party seller	200 or more separate sales of new or unused consumer products and $5,000 or more in gross revenue in any continuous 12-month period within the past 24 months, counting only sales where the marketplace processed the payment	Run the threshold check daily on a rolling window, not monthly
Information to collect	Bank account details (or payee name if none), a tax ID, and contact details: name, working email and phone for individuals; for entities also a government ID for the representative or a government record or tax document showing business name and address	Collect at the moment a seller crosses the threshold, or at onboarding to avoid a later gap
Timing	Collect within 10 days of a seller qualifying; verify within 10 days of receiving the information	Automate the clock and the escalation
Verification standard	A method that reliably shows the information is valid, belongs to the seller, and is not misappropriated or falsified; a valid government tax document is presumed verified as of its date	Name match on the bank account and a document check are the minimum
Annual certification	Sellers must electronically certify at least once a year that the information is unchanged, or update it	Treat any update as a risk event that triggers re-verification
Disclosure to buyers	Sellers with $20,000 or more in annual gross revenue must have their name, physical address and contact details shown on the listing or in order confirmations; home-based sellers may show country and state plus an electronic contact method	Build the disclosure into listing templates
Suspension	Notice of non-compliance, then suspension of future sales activity if the seller does not comply within 10 days	Suspend new sales, and decide separately whether to hold pending payouts
Reporting route	Each high-volume seller's listing must show a phone number and an electronic way to report suspicious activity	Route these reports into the fraud case queue, not general customer service
Data use	Reasonable security is required, and data collected only for INFORM compliance may not be used for other purposes unless the law requires it	Separate compliance data from marketing systems and log access

A violation is treated as a violation of an FTC rule. The FTC page states civil penalties of $53,088 per violation; that figure is adjusted for inflation, so check the current amount before quoting it.

The EU Digital Services Act

Marketplaces that let EU consumers contract with traders must make those traders traceable under Article 30 of the Digital Services Act (Regulation (EU) 2022/2065). The recitals explain the intent: platforms should obtain trader information, make best efforts to assess whether it is reliable without excessive or costly fact-finding, and store it securely for the length of the contractual relationship and six months after it ends. That six-month retention period matters for investigations, because many fraud reports arrive after a seller has closed its account.

How much verification is enough

Legal minimum: the INFORM data set for high-volume sellers in the US and the DSA trader data in the EU.
Risk-based uplift: borrow the identity assurance language of NIST SP 800-63A-4. IAL1 validates that the claimed identity exists; IAL2 adds stronger evidence and checks that the applicant genuinely owns it, and can be done remotely without a human agent. High-value categories (electronics, gift cards, luxury goods, tickets) justify IAL2-style checks with a document and selfie match before the first payout.
Business sellers: verify the company and its beneficial owners, not only the person who signed up. See the KYB Guide.
Bank account ownership: confirm the payout account name matches the verified seller. A mismatch is one of the strongest single mule indicators.

Deepfake documents and face swaps now target remote proofing. See the Deepfake-Resistant Identity Verification Guide and, for automated sign-up at scale, the Fake Account Creation and Sign-up Fraud Guide.

Triangulation fraud

In triangulation fraud a fraudulent seller lists popular goods at attractive prices. When a genuine buyer pays, the fraudster buys the same item from a legitimate retailer using a stolen card and has it shipped straight to the buyer. The buyer is happy, the fraudster keeps the buyer's payment, and the loss lands weeks later on the cardholder and the retailer when the stolen card is disputed. Because the marketplace's own buyer receives the goods, the usual signals of non-delivery never appear.

Price signals: new sellers listing in-demand items consistently below the price the item can be bought for wholesale.
Fulfilment signals: tracking numbers issued by a large retailer rather than the seller, retailer-branded packaging or invoices reaching the buyer, ship-from locations that change with every order.
Retailer contact: retailers and card issuers investigating chargebacks will contact the marketplace with order addresses. Give them a documented law enforcement and partner request route.
Response: hold payouts on suspected accounts, contact recent buyers only through the platform, and preserve order and tracking data for the investigating retailer.

Stolen card testing often precedes triangulation and buyer-side fraud. The OWASP Automated Threats project names this pattern as OAT-001 Carding and OAT-010 Card Cracking, and the conversion of stolen value into money as OAT-012 Cashing Out.

Listing, review and reputation fraud

Reputation is a marketplace's core asset, which makes it a target. Fake reviews let new fraud sellers look established and let counterfeit listings outrank genuine ones.

The US rule: the FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) bans fake and AI-generated reviews, buying reviews of a particular sentiment, undisclosed insider reviews, company-controlled review sites posing as independent, review suppression through threats, and buying or selling fake social media indicators. Marketplaces should expect sellers to try all of these.
Detection: look for review bursts after a quiet period, reviewers who buy only from one seller, reviews from accounts sharing devices or payment cards with the seller, and verified-purchase reviews on orders with near-zero value.
Listing integrity: hash and compare product images across sellers, flag brand names in listings from sellers with no brand authorisation, and monitor listing edits after approval, a common way to swap a reviewed product for a different one.
Automation: OWASP lists OAT-011 Scraping and OAT-017 Spamming, which match listing copying and mass fake listings. See the Bot Farms and Fake Engagement Guide.

Buyer and seller collusion

Collusion uses the marketplace as a payment rail. The buyer and seller accounts are controlled by the same person or ring, so neither will complain.

Pattern	How it works	Detection approach
Stolen card cash-out	Ring "buys" from its own seller account with stolen cards; the platform pays the seller before chargebacks arrive	Payment instruments shared across buyers, buyers who only buy from one seller, first-sale-to-payout speed
Promotion abuse	Linked accounts buy from each other to harvest new-buyer coupons, referral credits or seller incentives	Device and address clustering, coupon redemption by account age
Reputation farming	Cheap or fake orders between linked accounts to build ratings before a fraud spree	Order value distribution, reciprocal ratings, shipping labels with no carrier scans
Money laundering	Overpriced items bought with criminal proceeds so the seller receives a clean payout	Prices far above market, repeat trades in low-scrutiny categories, payouts to accounts linked to other sellers

Collusion is a network problem. Build an entity graph that links accounts by device fingerprint, IP range, email and phone, shipping and return addresses, payment instruments and payout bank accounts. Most rings reuse at least one of these. See the Fraud Data Sharing and Consortium Intelligence Guide for sharing signals with other platforms, and the AML programme and transaction monitoring guide where the platform itself has money transmission obligations.

Seller account takeover

An established seller account with good ratings and an open payout schedule is worth more to a fraudster than a new one. Attackers take them over with credential stuffing (ATT&CK T1110.004), phishing that imitates the marketplace's seller portal, or by buying compromised accounts (T1586 Compromise Accounts), then operate them as valid accounts (T1078).

Strong authentication for sellers: require multi-factor authentication for every seller, and phishing-resistant authentication (passkeys or security keys) for high-volume sellers and anyone who can change payout details.
Step-up on sensitive actions: payout account changes, adding a new user to a seller account, generating API keys and bulk listing edits should each require fresh authentication and send an alert to the seller's existing contact details.
Cooling-off periods: delay the first payout to a newly added bank account, so the real seller has time to react to the alert.
Seller API keys: large sellers integrate through APIs. Treat those keys as credentials: scope them, show their last use, and let sellers rotate them. A stolen seller API key can change prices or payout data without a login.

See the Account Takeover Prevention Guide and the Password Spraying and Credential Stuffing Defence Guide.

Payout controls and mule detection

Every seller-side scheme has to end in a payout. The FBI describes money mules as people who move illegally obtained money for others, often recruited through fake job offers or romance scams and sometimes unaware of what they are doing. Fraud sellers frequently pay out to mule accounts rather than their own.

Control	What it does	Trade-off
Payout delay for new sellers	Holds funds until delivery is confirmed or a set period passes	Slows cash flow for honest new sellers; explain it up front
Rolling reserve	Keeps a percentage of sales back for a period to cover disputes	Size it by category risk and seller history
Bank account name match	Confirms the payout account belongs to the verified seller	Joint and business accounts need manual review
Payout account change cooling-off	Delays payouts after a bank account change and alerts the seller	Annoys sellers who change banks legitimately
Shared payout account detection	Flags one bank account receiving payouts for several unrelated sellers	Agencies and fulfilment partners create false positives
Velocity limits	Caps payout size until the seller has history	Needs a fast review route for genuine high-volume sellers

See the Money Mule Detection Guide for mule typologies and account signals.

Implementing a seller risk programme

Map the money and the data: document when the platform takes funds, when it pays out, who can change payout details and where seller identity data lives. List your INFORM and DSA obligations by market.
Fix the legal baseline first: automate the INFORM threshold check, the 10-day collection and verification clocks, annual certification and suspension. Confirm DSA trader data and six-month retention for EU traders.
Add payout controls: introduce new-seller payout delays, bank account name match and cooling-off on payout changes. These cut losses fastest.
Build the entity graph: link accounts by device, address, payment instrument and bank account. Start with rules on shared payout accounts and shared cards.
Run new rules in shadow mode: score and log decisions for two to four weeks without acting, measure precision against confirmed fraud, then switch on enforcement in one category before expanding.
Design appeals and rollback: every hold or suspension needs a reason code, a seller-facing appeal route and a way to release funds quickly. Keep the previous rule version deployable so a bad rule can be rolled back within hours.
Close the loop: feed confirmed fraud, chargebacks and retailer reports back into rules and models, and share indicators with partners where the law allows.

Small and large platforms

Small or niche marketplaces: rely on your payment provider's verification and payout tools, use payout delays generously, and review every new seller in high-risk categories by hand.
Large marketplaces: need an in-house risk engine, graph analytics, a dedicated investigations team, a documented route for law enforcement and retailer requests, and regular reporting to compliance on INFORM and DSA performance.

Detection and measurement

Log seller onboarding decisions, verification results, logins and authentication events, payout account changes, listing edits, review events and every hold, release and suspension with its reason code. Feed them into the same case system that receives buyer reports and the INFORM suspicious activity reports.

Fraud loss rate: confirmed seller-side fraud losses as a share of gross merchandise value, by category.
Time to payout block: median time from first fraud signal to payout hold. Shorter beats more accurate when funds are about to leave.
INFORM compliance rate: share of newly qualifying high-volume sellers collected and verified within the 10-day windows.
Hold precision and appeal overturn rate: share of holds confirmed as fraud, and share overturned on appeal. A high overturn rate means good sellers are paying for your rules.
Repeat offender rate: share of banned sellers who return under linked identities, a direct measure of graph quality.
Takeover-driven payout changes: payout account changes later confirmed as account takeover.

The Fraud Metrics and KPIs Guide covers how to set baselines and targets.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	Threat references
Seller identity proofing	PR.AA-02	IA-12 Identity Proofing	OAT-019 Account Creation
Seller account lifecycle and suspension	PR.AA-02	AC-2 Account Management	ATT&CK T1078 Valid Accounts
Account takeover defence	ID.RA-03	SI-4 System Monitoring	ATT&CK T1110.004, T1586; OAT-008
Fraud analytics and case review	DE.AE-02	AU-6 Audit Record Review, Analysis, and Reporting	OAT-001, OAT-010, OAT-012
Coordination with retailers, issuers and police	RS.MA-01	SI-4 System Monitoring	Not applicable

Common failure patterns

Verifying once and trusting forever: an account verified two years ago and sold on a forum still passes. Re-verify on payout changes, ownership changes and dormant accounts that suddenly reactivate.
Paying out before the risk is known: instant payouts to new sellers give fraud rings a window before chargebacks and buyer complaints arrive.
Treating INFORM reports as customer service: suspicious activity reports sent from listing pages land in a general queue and are never linked to the seller's risk score.
Looking at accounts one by one: each fake seller looks small, but the ring shares a bank account, device or warehouse address. Without a graph the same ring returns every week.
Weak seller authentication: password-only seller logins and no alert on payout changes make account takeover the cheapest route to an established reputation. The 23andMe credential stuffing breach shows how reused passwords alone can open thousands of accounts on a consumer platform.
Holds with no appeal route: blunt suspensions without reason codes push good sellers away and leave staff unable to tell false positives from fraud.

Practitioner checklist

Automate the INFORM Consumers Act threshold, 10-day collection, 10-day verification and annual certification steps, with suspension on non-compliance.
Store EU trader data under the DSA traceability rules and keep it for six months after the relationship ends.
Match payout bank account names to verified seller identities and flag shared payout accounts.
Apply payout delays or reserves to new sellers and high-risk categories, and a cooling-off period after any payout account change.
Require multi-factor authentication for all sellers and step-up authentication for payout, user and API key changes.
Build an entity graph linking accounts by device, address, payment instrument and bank account.
Monitor for triangulation signals: below-wholesale pricing, retailer-issued tracking and retailer packaging.
Detect review fraud with burst, reciprocity and shared-device analysis, in line with 16 CFR Part 465.
Run new rules in shadow mode, give every hold a reason code and an appeal route, and keep rollback ready.
Report fraud loss rate, time to payout block, INFORM compliance and appeal overturn rate monthly.

Marketplace Seller and Platform Fraud Guide: Verify Sellers, Stop Triangulation and Protect Payouts