Why Bots Hit Marketplaces and Resellers First

A marketplace account is a wallet with a storefront attached. One working seller login gives an attacker a payout destination to edit, a reputation score to spend on listings that never ship, and, on many platforms, a gift card balance to drain. That stack of cash-out routes in one account is the whole explanation for why bots hit marketplaces and resellers first.

Scarce inventory makes automation pay

A human refreshing a product page buys one unit at human speed. A bot holding a queue position with rotating residential proxies can hold dozens of units across dozens of accounts, then release the ones that do not resell. HUMAN Security describes this hold and release pattern as inventory hoarding, and it only pays where supply is limited and resale margins are real: limited sneakers, tickets, consoles, and collectible drops.

Resellers feel the second order effect. When bots take the drop, honest resellers cannot stock the item at retail, so the secondary price rises, which raises the margin that funds the next round of bots. The marketplace sees higher gross merchandise value and reads it as demand. Splitting bot driven sellouts from human demand in your own reporting is the first honest step.

Payout accounts are the fastest cash-out in ecommerce

Credential stuffing works because people reuse passwords, and Cloudflare has reported that a large share of successful logins across its network involve passwords already exposed in breaches. On a marketplace, a stuffed login is not just a privacy problem. The attacker edits the payout account, lists a popular item below market, collects payment, and is gone before the first buyer complains.

That is why the controls that matter sit at payout edits and listing creation, not only at login. A leaked credential check at login, a step up challenge when bank details change, and a short hold on payout changes after a password reset each attack a different step of the same cash-out. A control that only watches the front door misses the step where the money actually moves.

Gift cards and stored value draw a quieter crowd

Marketplaces that sell or accept gift cards add a third target. Balance checking bots test stolen card numbers at a few cents of cost per check, looking for cards with value that can be drained or resold. The FBI has warned about gift card draining schemes where card numbers and PINs are harvested and balances emptied before the buyer uses the card. On a platform, the tell is a burst of balance inquiries with no purchase attached, spread across many accounts.

Rate limiting balance checks by account and by card, and requiring a signed in session with history before showing a full balance, raises the cost of that testing sharply. It will not stop a determined crew. It changes their arithmetic, which is what most bot defence actually does when it works.

What to watch on your own platform this week

Three numbers, split by hour, tell you more than a monthly bot percentage. Login success rate from new devices, payout detail edits per thousand active sellers, and balance inquiries with no checkout. A stuffing or draining run moves at least one of them outside its normal band before a single seller files a report.

Start with the payout edit. It is the rarest legitimate event and the most valuable attacker event, so a challenge there costs real sellers almost nothing and costs an attacker the whole account. Marketplaces keep hardening the login page because it is visible. The money leaves through a settings screen.

Keep reading: Leaked credential checks at marketplace login: the free layer most sellers skip, Reading bot scores on a login page without drowning in false alarms.