Seller payout diversion: the account takeover that changes one bank detail
Why the payout page is the prize
Changing listings is noisy. Customers complain, brands report, and the platform looks. Changing a bank detail is a single settings event that generates no customer contact at all. On marketplaces that pay out on a fixed cycle, an attacker who times the change just before disbursement day collects the whole cycle's sales in one transfer.
Credential stuffing is the usual door. Seller passwords get reused from breached consumer sites, and the login page cannot tell a stuffed credential from the owner if no second factor stands in the way. SIVT and GIVT distinctions do not matter here. This is not ad fraud taxonomy. It is a person, or a bot working for one, signing in as the seller.
The signals are in settings, not sales
Alert on the settings events themselves: bank detail change, email change, password reset, and a new device or a new country on the account, in any combination inside a short window. A bank change alone can be a seller switching accounts. A bank change an hour after a password reset from an address range the seller has never used is a payout about to be diverted.
Watch the session that made the change. Sellers do ordinary things in an account: check orders, print labels, answer messages. A session that signs in, goes straight to payout settings, changes one field, and leaves has done nothing a seller does. Behaviour that narrow deserves a hold and a call, not a log line nobody reads.
The hold is the control that works
Put a disbursement hold on any payout account change: 24 to 72 hours where the platform's terms allow it, with an out of band notice to the email and phone on file before the change. The hold costs a legitimate seller a short delay they were told about. It costs the attacker the whole scheme, because the notice reaches the real owner while the money is still there.
Require MFA for seller accounts and require step up authentication again at the payout settings page itself. A stolen session cookie should not be enough to move money. The recheck is a small friction placed exactly where the value is, which is where friction belongs.
Freeze further disbursements first, then preserve the login and settings logs with timestamps and IP data before routine retention deletes them. Banks can sometimes recall a transfer inside a short window, and speed is the whole game. File the platform report and a police report the same day. Each one makes the other more credible.
Recovery after a diverted payout
Then rotate everything: password, MFA seeds, API keys, and any staff sub accounts. Attackers who divert one payout often keep a second access route, a connected app or an old API key, to come back for the next cycle. Closing the front door while a key still works is a pause, not a fix.
Frequently asked questions
What is credential stuffing in plain terms?
Attackers take email and password pairs leaked from other sites and test them in bulk against a login page. Because people reuse passwords, a share of the pairs work. Seller accounts are tested because a working seller login can be turned into a payout.
What is credential stuffing in plain terms?
Many do log it, but a log is not an alert. Unless a change triggers a hold and an out of band notice, the first human to notice is the seller, days later, when money is missing.
What is credential stuffing in plain terms?
It stops the common credential stuffing route. Attackers can still phish a one time code in real time, which is why the payout hold and the settings recheck matter as a second layer rather than relying on MFA alone.
What is credential stuffing in plain terms?
On a well run marketplace, yes. A short hold after a payout detail change, with notice to your existing contact details, is the control working as designed. Contact support through the account, not through any email that announced the change.