Seller account takeover: how marketplace accounts get hijacked and how to lock yours down
How the takeover usually starts
The common entry point is credential stuffing: passwords leaked from an unrelated breach are tried automatically against seller logins, and reused passwords open the door. The second route is phishing aimed at sellers, messages that imitate marketplace security alerts or payout notices and lead to a lookalike login page. The page harvests the password and, on weaker setups, the one time code as well.
Once inside, speed matters to the attacker. Payout bank details, account email, and phone numbers are changed first, because those changes lock the owner out of recovery. Listings follow, either fake offers under the trusted account or price cuts on real stock to convert reputation into fast orders. By the time the owner notices, the account has done a weekend of damage.
The controls that break the chain
A unique password for the seller account, stored in a password manager, removes the credential stuffing route entirely. App based two factor authentication is stronger than text codes, because text codes can be intercepted or phished more easily. Where the marketplace offers login alerts and new device challenges, turn them on and treat every alert as real until proven otherwise.
Payout changes deserve special friction. Use any available setting that requires re authentication or a waiting period before new bank details take effect, and keep a separate email address for the seller account that is not used for general mail. Most phishing reaches the inbox that is everywhere. A quiet, dedicated address receives far less of it.
Watch the account like a shop floor
Owners check sales daily and security rarely, which is backwards for takeover risk. Build a short weekly check: recent logins and devices, payout details unchanged, account email and phone unchanged, no unfamiliar listings or price changes, and staff or app permissions still limited to tools actually in use. Old integrations with broad access are a quiet entry point when their own security fails.
Staff access needs the same discipline. Give helpers their own limited logins rather than the owner password, remove access the day someone leaves, and never share two factor codes. A surprising share of takeovers are not strangers at all, but former helpers or contractors whose access was never switched off after the work ended.
If you suspect a takeover, move in order
First, regain control through the marketplace's official recovery path from a clean device, change the password, and reset two factor. Second, freeze the money: check payout details, pending payouts, and recent bank changes, and tell the marketplace in writing that the changes were unauthorised. Third, audit listings, orders, and messages sent in your name, because customers contacted by the attacker need a correction from the real account.
Document everything with timestamps for the marketplace review and, where money left, for your bank and insurer. Act the same day. Marketplaces are far more helpful while the trail is warm, and payout recalls that are possible on Monday can be impossible by Friday. Prevention is cheaper, but a fast, ordered response still saves accounts.
Keep reading: Chargeback evidence packs: what marketplace sellers should save before a dispute starts, Seller account takeover on marketplaces: the hijack that sells from your good name, and Fake tracking number scams: how sellers fake a shipment that never moves cover the nearby cases in this series.
Frequently asked questions
How do attackers get into seller accounts?
Mostly through reused passwords tried automatically from other breaches, and through phishing messages that imitate marketplace security or payout notices and harvest logins on lookalike pages. Weak or shared two factor setups make both routes easier.
What is the first thing an attacker changes?
Usually payout bank details and the account email or phone, because those changes divert money and block the real owner's recovery. Listing changes and fake offers tend to come after the money route is secured.
Which single control helps most?
A unique password in a password manager combined with app based two factor authentication. Together they remove credential stuffing and make phishing far harder, which covers the two routes behind most takeovers.
What should a seller do first after suspecting a takeover?
Recover the account through the official path from a clean device, reset the password and two factor, then check payout details and recent changes and notify the marketplace in writing the same day, before auditing listings and customer messages.