How do credential-stuffing bots take over marketplace seller accounts?

Why seller accounts are the real prize

A buyer account is worth a single transaction. A seller account is worth the entire storefront: pending payouts, established reviews, search ranking, and the trust the marketplace has already extended. Attackers who take over a seller account inherit all of it instantly, which is why seller credentials trade at a premium in credential markets and why stuffing campaigns target seller login endpoints specifically rather than spraying the general login form.

The damage compounds fast. Once inside, the attacker changes the payout destination before the next disbursement cycle, lists high-demand counterfeit or nonexistent goods under the seller's trusted name, and uses the account's messaging to phish the seller's own customers. By the time the real seller regains access, the account may carry policy strikes, chargebacks, and a review profile full of complaints about orders the seller never shipped. The marketplace eats the trust cost on both sides.

How the stuffing operation works

The raw material is combo lists: millions of email and password pairs harvested from breaches of unrelated sites. Sellers are human, and humans reuse passwords, so a meaningful fraction of pairs will match some seller on any large marketplace. The bots do the matching work, cycling through proxies and residential IPs to spread attempts across thousands of addresses so no single IP trips a rate limit.

Sophisticated operations fingerprint the login flow first. They learn the exact sequence of requests, the CSRF handling, the device checks, and the error responses that distinguish a wrong password from a nonexistent account. Then they run low and slow: a few attempts per account per day, timed to blend with normal login traffic, prioritizing high-value seller tiers identified from public storefront data. The operation is patient because the payoff per success is enormous.

The signals of a compromised seller account

Start with the login pattern. A seller who has logged in from two devices in one city for a year and suddenly authenticates from a datacenter IP on another continent is either traveling or compromised, and the safe assumption is compromised. Pair that with velocity: hundreds of login attempts against different seller usernames from the same infrastructure in an hour is a stuffing campaign, not a coincidence. Marketplaces that log the ASN, device fingerprint, and attempt cadence of every login can see these campaigns forming before any account falls.

Inside the account, the takeover has a signature. Payout destinations change, then listing prices drop sharply on high-value items to move inventory before detection, then the messaging templates change to push buyers off-platform. Real sellers change one of these things at a time and rarely all three in an hour. An automated rule that freezes payouts for 24 hours when the payout destination changes on an account with a fresh login from new infrastructure stops most of the theft without touching normal seller operations.

Locking down seller auth without hurting onboarding

The blunt instrument is mandatory two-factor authentication for seller accounts, and for high-payout tiers it is worth the friction. But a marketplace with a long tail of casual sellers cannot afford to lose signups to an auth flow that feels like a bank vault. The workable middle is risk-based: light auth for browsing and listing, stepped-up verification for payout changes, password resets, and bulk listing edits. The attacker needs exactly the sensitive actions, so that is where the friction goes.

Credential hygiene on the marketplace side matters too. Never let the login form confirm whether a username exists, because that turns stuffing into account enumeration. Hash and salt properly so a breach of your own database does not become someone else's combo list. And give sellers a security dashboard that shows their login history in plain language; sellers who can see an unfamiliar login will report the takeover hours before your systems would catch it, and hours are the difference between a frozen payout and a stolen one.