How do bots harvest seller phone numbers from marketplace listings?

The number was for customers, and the bot read it first

A seller puts a phone number on a listing so a buyer with a question can call. That is the entire reason the number is public. The bot that reads the listing does not care about the reason. It collects the number, the store name, the product category, and the location, and adds the row to a list. The list is the product, and the seller is the inventory.

The harvesting runs at the same scale as price scraping. A bot can read thousands of listings an hour, and a phone number in a listing is structured data, which means a simple pattern match finds it. Numbers hidden in images survive longer, because the bot has to read the image. Numbers in plain text are collected on the first pass.

The lists get sold, and the buyers are not other sellers. They are the operators of smishing campaigns, fake buyer scams, and account takeover attempts. A list of sellers in one category is worth more than a list of random numbers, because the message can be written for the category: a fake buyer asking about a bulk order, a fake marketplace notice about a payment hold, a fake delivery text for a parcel that does not exist.

What the messages look like when they arrive

The fake buyer message is the most common. A buyer wants to place a large order, or asks about a custom request, and the conversation moves off the marketplace fast: WhatsApp, Telegram, email. The payment is a wire, a gift card, or crypto. The seller who follows loses the goods and the money.

The fake marketplace notice is the second version. A text claims the seller's account has a payment held, a listing at risk, or a verification step missed, and links to a login page that looks like the real one. Amazon's guidance is the check: the company never asks for a password, card number, or bank details by email, text, or phone call, and anything real about your account also appears in Seller Central under Performance Notifications.

The fake delivery text is the third version. A parcel is waiting, a fee is due, a link will fix it. The link installs malware or harvests a login. The seller who ships parcels all day clicks before thinking, because a delivery problem is a normal day, not an exception.

Why the marketplace cannot hide the number for you

Some marketplaces mask the number and route messages through their own system. Some do not. A seller who lists on a marketplace that shows the number in plain text has already published it, and the bot has already read it. The choice is the seller's, and it is made at the listing step, not after the first smishing text arrives.

The platform's own messaging system is the defence that works, because it keeps the conversation inside the marketplace where the platform can see it. A buyer who insists on moving to WhatsApp before the first question is answered is not a buyer with a question. They are a bot, or a person working from a script.

The three changes that cut the harvesting off

Take the number out of the listing text and use the marketplace messaging system instead. If a buyer genuinely needs to call, the marketplace will give them a way to reach you without publishing the number to every bot on the internet.

Never act on a message from inside the message. Open a new tab, go to the marketplace, and check Performance Notifications or the account health page. If the issue is real, it is listed there. If it is not listed, the message is fake.

Report the spoof. Amazon's address is stop-spoofing@amazon.com, and eBay's is spoof@ebay.com. The report is how the platform's filters learn the new wording, and the same script hits hundreds of sellers in the same week.

Keep reading: How do bots use marketplace messages to phish sellers out of their accounts?, Seller payout diversion: the account takeover that changes one bank detail, and Reseller account takeover: how one login drains a marketplace payout cover the nearby cases in this series.

Frequently asked questions