How do bots use marketplace messages to phish sellers out of their accounts?
Why the message works: it arrives where trust already lives
A seller's inbox on a marketplace is a work queue. Order questions, shipping problems, return requests, and the occasional message from the platform itself. The phishing message fits that queue. It uses the marketplace's name, its phrasing, and a problem that sounds urgent: a listing at risk, a payment held, a verification step missed. The seller clicks because the message arrived where official messages arrive.
Amazon's own guidance is blunt about the line. Amazon never asks for a password, card number, or bank details by email, text, or phone call. Legitimate mail comes from amazon.com, selling.amazon.com, or payments.amazon.com, and anything real about your account also appears in Seller Central under Performance Notifications. A message that exists only in your inbox, and nowhere in Seller Central, is not from Amazon.
The four scripts, and what each one steals
The overpayment script targets sellers directly. A buyer offers more than the asking price, sends a fake check or a payment screenshot, and asks for the difference back by wire or gift card before the payment clears. The original payment never existed. The seller's refund is the theft.
The fake label script targets the shipping step. The buyer sends a shipping label or a QR code and asks the seller to use it instead of the marketplace label. The parcel goes to an address the operator controls, or the label carries a tracking number that shows delivery to the wrong place. Either way the seller loses the item and the marketplace record shows a completed delivery.
The off-platform script is the most common. The buyer has a reason the deal must leave the marketplace: a bulk order, a custom request, a payment method the marketplace does not support. The payment is Zelle, wire, crypto, or gift cards, none of which the marketplace can reverse or insure. Once the money moves, the buyer disappears and the seller has no order record to appeal with.
The verification script targets the account itself. The message claims the account needs re-verification and links to a login page that looks identical to the real one. The seller types their password, and the operator has the account within the minute. Some versions ask for a one-time code as well, which hands over the session, not just the password.
A hijacked account is worth more than a password
A hijacked seller account is a storefront with history. It has reviews, sales volume, and buyer trust that a new account cannot buy. The operator changes the bank details first, then lists high-demand items at attractive prices, collects the payments, and ships nothing or ships counterfeits. By the time buyers complain, the payouts have moved.
The operator also builds the account's feedback before the theft. Hijacked accounts often start as low-dollar traders that accumulate positive feedback through small legitimate sales, then get sold or taken over once the feedback score looks trustworthy. A buyer checking feedback sees a real history. The history is real. The person holding the account is not.
The check that takes two minutes
Never act on a marketplace message from inside the message. Open a new tab, go to the marketplace yourself, and check Performance Notifications or the equivalent account health page. If the issue is real, it is listed there. If it is not listed, the message is fake, whatever it says.
Report the spoof to the platform: Amazon's stop-spoofing@amazon.com, eBay's spoof@ebay.com. The report does not just protect you. Spoof reports are how the platform's filters learn the new wording, and the same script hits hundreds of sellers in the same week.
Turn on two-factor authentication with an authenticator app, not SMS, and check your payout bank details monthly. The single most expensive minute in a seller's year is the minute after the password is typed into the wrong page, because the operator changes the bank details first and asks questions never.
Keep reading: Seller payout diversion: the account takeover that changes one bank detail, Leaked credential checks at marketplace login: the free layer most sellers skip, and Reseller account takeover: how one login drains a marketplace payout cover the nearby cases in this series.
Frequently asked questions
How do I know if a marketplace message is really from the marketplace?
Check your account health or performance notifications inside the marketplace itself, in a fresh browser tab. Real account issues appear there. A message that exists only in your inbox is not from the platform.
What should I do if I clicked a link in a suspicious seller message?
Change your password immediately from the real site, turn on two-factor authentication, and check your payout bank details and active listings. Then report the message to the platform's spoof address so the script gets flagged.
Why do scammers push deals off the marketplace?
Off-platform payments like wire transfers, crypto, and gift cards cannot be reversed or covered by marketplace buyer protection. Once the deal leaves the platform, the seller loses the order record, the payment protection, and any way to appeal.
Can a hijacked seller account be recovered?
Sometimes, but recovery is slow and the damage is fast. The operator changes bank details and lists fake items within hours, while account recovery can take days. Prevention, two-factor authentication and a monthly check of payout details, is worth far more than recovery.