Reseller Account Takeover: How One Login Drains a Marketplace Payout
The payout edit is the attack
A reseller account holds three things an attacker wants in one place: a payout destination, a trusted storefront, and a sales history that makes new listings look legitimate. The login is just the door. The payout edit is the theft, and on most marketplaces it takes one form submission and no second check.
That is why payout takeover is the expensive kind of account takeover. Prove's research on marketplace fraud puts global account takeover volume up 21 percent from the first half of 2024 to the first half of 2025, and marketplace attack rates up 90 percent year over year, roughly four times the cross-industry average. The accounts being taken are not new. They are established sellers whose payout history makes the next disbursement look routine.
The sequence is short, and RealEyes describes it the same way in its seller payout takeover guide: someone gets in, changes where the money goes, and waits. The listings stay up. Orders from older stock may still ship. The loss only begins when the next payout run sends money to a bank account or wallet the platform never confirmed.
How the takeover usually starts
Credential stuffing does most of the work. Attackers cycle username and password pairs harvested from unrelated breaches against marketplace logins, betting that sellers reuse passwords. Prove cites more than 26 billion credential stuffing attempts per month across the web, and 62 percent of Americans reusing passwords across accounts. A reseller who uses the same password on a marketplace and a breached forum is already exposed, whether or not anything about the marketplace itself was breached.
Phishing does the rest, usually dressed as an urgent policy notice or a payout problem. The message creates a deadline, the seller clicks, and the fake login page harvests the credentials plus the session. A shared login inside a small reselling team widens the same hole: one compromised teammate, one password in a chat log, and the account is open.
What makes resellers a better target than ordinary buyers is the payout itself. A buyer account holds a stored card. A seller account holds a destination for money flowing out. The INFORM Consumers Act already requires marketplaces to collect bank account information from high-volume third-party sellers, which means the payout details exist in the system and are editable through the same account the attacker just took.
What actually stops it
Treat the payout edit as its own decision, separate from the login. A valid password does not approve a new destination. Hold the payout that would use the new destination until the enrolled seller confirms it through a channel the attacker does not control, and make the hold the default, not an exception for suspicious cases.
Step-up verification belongs on the payout screen itself, and a password reset does not count as verification. Neither does an SMS code sent to a number saved in the same session the attacker controls. The check has to prove the enrolled seller is present for this specific change: an authenticator app, a fresh liveness check against the onboarding record, or a confirmation to a contact method set long before the attack.
Watch the sequence, not just the login. A new device followed by a new payout destination is the classic takeover pattern, and it is visible in ordinary logs before any money moves. A payout change after a password reset deserves the same hold. Real sellers do switch banks, and the switch can wait a day for confirmation. A patient attacker wins exactly when a platform releases the money after 24 quiet hours and calls that a control.
Keep reading: Gift card draining bots: the balance check that gives the game away, Why Bots Hit Marketplaces and Resellers First.
Frequently asked questions
How is a payout takeover different from a normal account takeover?
In a normal takeover the attacker spends the victim's stored value: orders goods, drains a balance, uses a saved card. In a payout takeover the attacker redirects future income, changing the bank account or wallet that receives the seller's disbursements. The account keeps selling, which is what makes the theft hard to spot until the payout run.
Why don't marketplaces just block logins from new devices?
Because resellers log in from new devices all the time: a new phone, a shared computer at a trade show, a VPN that changes exit points. Blocking every new device would lock out honest sellers constantly. The cheaper control is to let the login through and challenge the rare, high-value action that follows it, the payout edit.
What should a reseller check after getting a password reset email they didn't request?
Check the payout destination first, then the listed items, then the contact email on the account. A reset email means someone tried to take the account, and the payout destination is the first thing an attacker changes. If the destination is wrong, report it before the next payout run, and change the password from a device you trust.
Does two-factor authentication stop payout takeovers?
It stops the easy ones, the credential stuffing attempts that rely on a reused password alone. It does not stop phishing that captures the second factor, session hijacking, or a takeover through a teammate's shared login. Two-factor authentication belongs on the account, but the payout edit still needs its own step-up check.