Seller account takeover on marketplaces: the hijack that sells from your good name
How the takeover usually starts
Most takeovers begin away from the marketplace: a phishing page that copies the seller login, a password reused from a breached site, or malware on the computer used for the business. Seller accounts are attractive because one password often guards both the storefront and the money settings, and small sellers rarely use separate devices or password managers.
Once inside, the criminal works quietly first. Bank details are changed, notification settings are softened so alerts go unread, and sometimes a low value test listing checks that the account still sells. The loud phase, heavy discounting of popular goods, comes last and is meant to convert the account's remaining trust into cash as fast as possible.
The signs owners notice too late
The classic first sign is a message from a buyer about a product the seller does not stock. Other signs are login alerts from unfamiliar locations that were dismissed as travel, payout summaries that do not match the bank balance, and listings edited in ways the team does not remember. Each sign looks small alone; together they are the takeover in progress.
Marketplaces notice a different set of signals: a bank change followed quickly by new categories, price drops across popular lines, and a spike in orders from an account whose selling pattern was steady for years. Platforms that connect those events can freeze payouts before the money leaves, which is the moment that decides whether the story ends as a scare or a loss.
Defences that fit a small seller
Two factor authentication on the seller account is the single biggest step, ideally with an authenticator app rather than text messages. A unique password stored in a password manager closes the credential stuffing route. These two controls stop most takeovers outright, and they cost an afternoon, not a budget.
Payout changes deserve a waiting period and an alert to the old contact details as well as the new ones. Sellers cannot set platform policy, but they can set their own routine: a weekly check that listings, bank details, and user permissions in the account are exactly what they should be, done by a named person.
Recovering an account after a hijack
Speed matters more than completeness. Contact the platform through its account recovery route, freeze payouts if that option exists, and change passwords for the email account tied to the seller login as well, because email access is how password resets get intercepted. Keep records of every unauthorised change with timestamps.
Buyers who ordered from the hijacked listings need a clear message once the platform confirms the takeover: what happened, that their orders will not ship, and how refunds will reach them. Sellers who communicate early keep most of their reputation. The hijack spends trust; honest, fast communication is how owners earn it back.
Keep reading: Fake tracking number scams: how sellers fake a shipment that never moves, How triangulation fraud uses real stores to fill fake marketplace orders, and Gift card payment scams on marketplaces, explained for sellers cover the nearby cases in this series.
Frequently asked questions
Why do criminals prefer hijacking an existing seller account?
Because reputation is the hard part of marketplace fraud. An established account has reviews, selling history, and payout trust that a new account lacks, so its listings convert immediately and its discounts look like bargains instead of bait.
What is the first thing to change after regaining a hijacked account?
Secure the email account linked to it, then the seller password, then re-enable two factor authentication and check bank details, users, and notification settings. Email comes first because password resets flow through it.
How do marketplaces spot a takeover in progress?
By connecting events: a payout bank change, new product categories, sharp price cuts, and an order spike on a previously steady account. Any one event can be legitimate; the sequence within days is the warning.
Can two factor authentication really stop most takeovers?
Yes. Phishing and reused passwords are the main entry routes, and a second factor blocks both in most cases. An authenticator app is stronger than text codes, which can be intercepted through SIM swap attacks.