Seller account takeover in Online marketplaces

How the attack works

1. The attacker targets the seller sign-in route with stolen credentials, looking for an established account whose listings and trading history already appear credible.
2. Automated attempts arrive through different networks and sessions, spreading the login activity across requests that may be reviewed independently by existing controls.
3. After gaining access, the attacker explores seller settings and attempts to replace payout details or alter information associated with the account.
4. The compromised account may publish fake stock or redirect trading activity while buyers continue to rely on the seller’s existing reputation.
5. The seller discovers an unexpected change or interrupted payout, leaving operations to reconstruct access, account changes and affected transactions across separate records.

Why it gets through

Seller accounts contain more than a password and a profile. They can carry trading history, trusted listings and access to settings that influence where money goes. That existing relationship makes takeover attractive: an attacker can exploit credibility the seller spent time building instead of establishing a new identity that immediately attracts review.

A login safeguard that considers each address separately can miss repeated attempts distributed across networks. A later account change may reach another team or another system, without the earlier access history beside it. The handover between authentication and seller operations becomes important because an apparently successful login does not explain who initiated the subsequent change.

Legitimate sellers also travel, replace laptops and delegate work to colleagues. A new device or changed connection therefore needs context. Linking the surrounding requests helps investigators distinguish an ordinary operational change from a sequence that merits closer review, while avoiding a blanket assumption that every unfamiliar environment means an account has been stolen.

Payout fraud losses arise when an attacker redirects money owed to a seller. Payments teams must establish what moved, what can be recovered and who bears the remaining loss. A blocked transfer may avoid that loss, but it still requires investigation and can delay legitimate access to earnings.

The buyer refund rate can rise when a compromised seller advertises unavailable stock or provides misleading fulfilment information. Each refund represents a purchase that failed after the marketplace appeared to endorse the trading relationship. Review the affected orders together so that the financial impact is not scattered across unrelated customer complaints.

Seller retention is at risk when an established business loses access, misses sales and must prove ownership of an account it already uses. Restoring access does not automatically restore confidence. Follow whether affected sellers resume normal trading and remain active, alongside their feedback about recovery, to understand the longer effect of the compromise.