Your seller account is the product: how marketplace account takeovers work

The account is worth more than the password

Think about what a ten-year-old seller account holds. Thousands of positive reviews, a buy box history, a payout method that has worked for years, and buyers who trust the name without reading it. That is what the attacker is buying when they log in with a stolen password. They are not breaking into your store. They are wearing it.

Account takeover volume grew 21 percent from the first half of 2024 to the first half of 2025, and it is up 141 percent since the first half of 2021, according to Prove's marketplace fraud reporting. Marketplace attack rates rose 90 percent year over year, roughly four times the cross-industry average. The reason is simple: a marketplace account is a storefront, a bank account, and a reputation in one login.

The credentials almost never come from the marketplace itself. They come from breaches somewhere else, and they work because 62 percent of Americans reuse passwords across accounts. Akamai counts more than 26 billion credential stuffing attempts per month across the web. The attacker does not need to guess. They need one reused password and a bot that can try it at scale.

What the attacker does in the first hour

The first move is rarely a listing. It is the payout details. The attacker changes the bank account or payout email, then lists high-demand goods at a price just low enough to sell fast: a console, a phone, a pair of limited sneakers. Orders come in, money goes to the new payout method, and nothing ships. The seller finds out when a buyer complains, or when their own payout does not arrive.

Some attackers are quieter. They keep the listings and the prices, and they change the shipping address on orders, or they add a second user to the account, or they harvest the buyer list for phishing. A compromised seller account is also a mailing list of people who have already paid once. The account keeps selling normally while the attacker works the edges.

The marketplace's own fraud checks often miss it, because the login is technically valid. The credential is the seller's, the device may be new but the session looks ordinary, and the first fraudulent listing is indistinguishable from a seller clearing stock at a sharp price. Nothing about the session looks stolen, because the credential is genuinely the seller's.

The signals that actually give it away

Velocity is the first tell. A seller who lists three items a week does not list forty in an hour. A payout change followed within minutes by a burst of new listings is a pattern, not a coincidence. Platforms that watch the sequence, login from a new device, then payout change, then listing burst, catch takeovers that single-event checks miss.

The second tell is the buyer side. Refund requests cluster on the compromised account, and they cluster fast, because the goods never arrive. A seller whose refund rate jumps tenfold in a day has not suddenly started disappointing customers. Somebody else is running their account.

The third tell is the login itself: a device the seller has never used, a location that does not match their history, a session that starts at 3 a.m. local time. Any one of these is weak evidence. Three together, right before a payout change, is the takeover.

What stops it, in order of what works

Passkeys and hardware-backed login kill the credential replay entirely, because there is no password left to steal. That is the structural fix, and it is the one marketplaces are moving toward. Until it is universal, the practical layer is step-up authentication on the actions that matter: payout changes, new device logins, and bulk listing changes. A password plus a push approval on a payout change stops the most common takeover cold.

Marketplaces should also freeze payouts for a short window after payout details change. The attacker counts on speed: list, sell, withdraw, vanish. A 48-hour hold on the new payout method breaks that sequence, and a legitimate seller barely notices it. The hold is the cheapest control in this whole list, and the one most platforms still do not have.

Sellers can help themselves with one habit: a unique password for the marketplace account and nothing else. Password reuse is the root cause, and it is the one factor the seller controls completely. A password manager makes it boring instead of hard. Boring is the goal.

Keep reading: How do bots harvest seller phone numbers from marketplace listings?, Why do bots scrape your prices and undercut you by a cent?, and How do bots use marketplace messages to phish sellers out of their accounts? cover the nearby cases in this series.