Marketplace Seller Fraud: Schemes and Controls

Last updated: September 2026

Marketplace seller fraud is fraud committed through a seller account on an online marketplace, rather than by a buyer. The seller is fake, taken over, never ships, or routes payouts to an account it controls. Because the platform pays its sellers, the checks that matter sit at two moments: when a seller is onboarded, and when money leaves the platform.

TL;DR

• Marketplace seller fraud runs through the seller account: fake or synthetic sellers, taken-over sellers, sellers who never ship, triangulation, collusion with buyers, and payouts to accounts the seller controls.

• Attackers target sellers because the platform pays sellers out. The payout is where the loss happens.

• In the US, the INFORM Consumers Act requires online marketplaces to collect and verify information from high-volume third-party sellers. In the EU, Article 30 of the Digital Services Act requires trader information before a trader uses the service.

• Those laws set a floor for what to collect. They do not say what to do when a seller's payout account changes, which is where takeovers show up.

• Verify at onboarding, verify again before payout, link sellers who share identity, device or payout details, and record the reason for every hold or suspension.

The short answer: what marketplace seller fraud is

Marketplace seller fraud is fraud in which the seller account is the instrument: a fake or synthetic seller, a legitimate seller taken over by an attacker, a seller who takes orders and never ships, or a seller whose payouts go to accounts it controls. Online marketplaces stop it at two points: seller onboarding and the payout.

A risk and platform enablement lead at a food delivery platform explained why sellers draw attackers: "we're paying out to these merchants, the bad actors know that that's an area that they can gain revenue." Seller fraud differs from buyer fraud in one way that shapes every control: the platform is sending money out, not only taking it in.

The term needs care. On its own, "marketplace fraud" usually refers to the US health-insurance Marketplace. This guide covers fraud by sellers on online commercial marketplaces, and the payment facilitators and acquirers that onboard and pay those sellers.

The schemes: fake sellers, takeovers, non-delivery, triangulation and collusion

Each seller fraud scheme ends with the platform paying money to someone who should not receive it. The table below sets out the common schemes, what the seller does, where the scheme first shows up, and the check most likely to catch it.

The table shows why onboarding checks alone are not enough. Takeover, non-delivery and triangulation all begin after a seller has already passed onboarding.

A fake seller can pass a clean check. An onboarding and compliance lead at a fintech, reviewing a business application that the existing document and KYB flow had already approved, concluded that it was a shell company and would be rejected. A registry match and a set of documents show that a business exists on paper, not that it trades.

Seller account takeover ends with a payout redirect. The same lead at the food delivery platform described the pattern: "they're impersonating our customers and then just trying to funnel the funds to themselves." On a seller account, funneling the funds usually means changing the bank account that receives payouts.

Collusion puts the seller on both sides of the sale. On the same discovery call with the food delivery platform, the pattern described was a merchant running stolen card data through its own storefront to trigger a quick payout. The buyer account and the card belong to the scheme, and the seller account collects the proceeds.

What the law already requires: INFORM and DSA Article 30

US and EU law already require online marketplaces to collect and verify information about their sellers. The two regimes differ in who they cover and when verification happens, but both treat seller verification as the platform's duty.

The INFORM Consumers Act (United States)

The INFORM Consumers Act, codified at 15 U.S.C. 45f, took effect on 27 June 2023. According to the FTC's business guidance, a high-volume third-party seller is one that "has had on that platform 200 or more separate sales or transactions of new or unused consumer products, and $5,000 or more in gross revenues" in any continuous 12-month period during the past 24 months.

For those sellers, the FTC states that "Online marketplaces must collect bank account information, contact information, and a Tax ID number from high-volume third party sellers." The FTC also states that "online marketplaces have 10 days to verify the information." If a seller does not provide the information within 10 days, the marketplace must "suspend any future sales activity" of that seller.

INFORM is not a one-time check. At least once a year, the marketplace must require each high-volume seller to certify that the information is current. The statute says a marketplace must "periodically, but not less than annually," notify these sellers of the requirement to keep the information current.

Digital Services Act Article 30 (European Union)

Article 30 of the EU Digital Services Act, Regulation (EU) 2022/2065, governs the traceability of traders and applies from 17 February 2024. An online platform that lets consumers conclude distance contracts with traders must obtain the trader's details before the trader uses the service. Those details include "the name, address, telephone number and email address of the trader;" and "a copy of the identification document of the trader or any other electronic identification", along with payment account details, trade register details where the trader is registered, and a self-certification of compliance with Union law.

The platform must then "make best efforts to assess whether the information referred to in paragraph 1, points (a) to (e), is reliable and complete." Where a trader does not correct inaccurate information on request, the platform "shall swiftly suspend the provision of its service to that trader in relation to the offering of products or services to consumers located in the Union until the request has been fully complied with." The platform keeps the information for six months after the relationship with the trader ends. Micro and small platforms are excluded from these duties under Article 29.

What neither law covers

INFORM and Article 30 set a floor. Both laws fix what a marketplace must collect and when. Neither says what a trust team should do when a verified seller changes its payout bank account at midnight from a device it has never used, and that change is where a seller account takeover becomes a loss.

Verifying a seller at onboarding

Seller verification at onboarding confirms that the seller is a real person or business and that the payout account belongs to that seller. For most online marketplaces, most sellers are individuals, so the work is mostly identity verification plus a bank account check.

A group risk and compliance director at a merchant acquirer described the same mix: "Really, the majority of our merchants are sole proprietors or sole traders." In practice, seller verification is KYC for individual sellers and KYB for business sellers, and the checks for each should follow the seller in front of the team rather than a single fixed flow. Choosing a KYB provider for business sellers is a separate decision with its own criteria.

A checklist for seller onboarding:

1. Verify the person. Confirm the identity of the individual seller, or of the people who own and control a business seller.

2. Verify the payout account. Confirm that the bank account receiving payouts belongs to the verified seller. INFORM already requires bank account information from high-volume sellers, and Article 30 requires payment account details from traders.

3. Add business checks for business sellers. Registry details and ownership apply where the seller is a registered business. Article 30 requires trade register details where the trader is registered.

4. Match the checks to the risk. Category, expected volume and country should change which checks run. A technical product manager leading a KYB redesign at a payments company put the requirement plainly: "We need verification flow to be dynamic."

5. Treat a passed document check as one input. Documents can be forged. An SVP of financial crimes strategy at a large regional bank asked on a call whether any tool could look at submitted articles of incorporation and "go, this was mocked up?" A passed document check lowers risk; it does not remove it.

6. Check the new seller against existing and suspended sellers. A new seller that shares an identity, device, phone number or bank account with a suspended seller is the same risk under a new name.

Verifying again before payout

The payout is the control point for marketplace seller fraud because it is the last moment the platform can stop money from leaving. A seller who passed onboarding months ago can still be taken over, change its payout account, or start running fake orders. Passing onboarding is not the same as being low risk.

A senior director of fraud risk management at a payments company said that, in a past role, the team kept KYC and KYB vendor results out of its fraud models because too many fraudsters passed those checks. Onboarding verification answers who the seller was on the day it signed up. The payout check answers whether the same seller is being paid now.

Steps for re-verifying a seller before payout:

1. Re-verify on any payout-detail change. A new bank account, a new payout method or a new account holder name should hold the next payout until the change is confirmed through a channel the attacker does not control.

2. Treat a change that follows a new-device login as a takeover signal. A login from an unfamiliar device or location followed by a payout-account change is the classic seller account takeover sequence. The same risky-action logic used in account takeover prevention applies to the seller's payout settings.

3. Check the first payout. A new seller's first payout is the first time a fake seller can collect. Confirm that orders were fulfilled and that the payout account matches the verified seller.

4. Watch for a jump in volume. A sudden rise in orders or payout value, especially from new buyer accounts, is how collusion and non-delivery schemes cash out.

5. Weight new-on-new pairs. A fraud team lead at a global cross-border payments platform put it this way: "We've seen in the past that newer paying entities are riskier especially when paired or combined with newer receiving entities." For sellers, the equivalent is a new seller paid out to a new bank account.

6. Check where the money lands. When payouts reach accounts the seller controls or has recruited, the seller has become part of a mule problem. Detecting those receiving accounts is covered in mule account detection.

Where payout controls usually fail

• Verification stops at onboarding. A seller verified once is trusted for life, so a takeover goes unnoticed until buyers complain.

• Payout-detail changes are treated as account admin. A bank account change is routed as a settings update, not as a risk event.

• Holds carry no reason. A reviewer sees that a payout is held but not why, and releases it to clear the queue.

• Each seller is reviewed alone. A seller that looks clean on its own can share a bank account or device with a seller suspended last month.

Linking sellers who share identity, devices or payout details

Linking sellers means connecting seller accounts that share an identity, a device, a phone number, an address or a payout account, so a trust team can see a ring rather than a single bad seller. The links have to exist before a review starts, because nobody can afford to run a full ring investigation on every seller.

A director of risk and trust and safety at a merchant payments platform described why: a full fraud-ring investigation is not run on every case, because querying every IP address and payment takes too long, so it is triggered only when an initial review suggests linked activity. If the links are not already visible, the initial review misses them and the ring is never investigated.

The same director said timing mattered as much as coverage: "There's definitely been cases in the past where we've found them late and those have been more costly." A seller ring found at onboarding costs the platform a review. The same ring found after a month of payouts has already been paid.

Links are most useful when onboarding and payout decisions read the same customer profile. A device or bank account flagged at one seller's onboarding should be visible when a different seller tries to add that bank account for payouts. The same multi-account pattern appears as iGaming bonus abuse on the player side, where one person runs several accounts to claim offers meant for new players.

What to record about each seller decision

Every hold, suspension and approval should leave a record that a reviewer, an auditor or a regulator can follow. The record serves two purposes: it is the compliance evidence INFORM and Article 30 expect, and it is the case history the next reviewer needs.

A checklist for the seller decision record:

1. What was collected, and when. Record each item of seller information and the date it arrived. INFORM's 10-day verification window runs from collection.

2. How each item was verified. Record the check, its result and its date. Article 30 requires best efforts to assess whether trader information is reliable and complete, and the record is how a platform shows those efforts.

3. How long to keep it. Article 30 requires a platform to keep trader information for six months after the relationship with the trader ends. Set retention by jurisdiction, not by a single default.

4. Why a payout was held or a seller suspended. The reason for each hold or suspension should reach the analyst who reviews it, in plain terms, not as an unexplained score.

5. Whether the policy was applied consistently. A VP of risk transformation at a merchant acquirer named the problem with manual review: "The humans are inconsistent in the application of the policy, right?" A written decision record makes inconsistency visible and correctable.

One caveat for trust teams using INFORM data in fraud decisions. Under 15 U.S.C. 45f(a)(3), information collected solely to comply with INFORM may not be used for any other purpose unless another law requires it. Before feeding that data into fraud models, confirm with counsel that there is a separate basis for using it. This is a point to check, not legal advice.

How Oscilar approaches seller onboarding and payout risk

Oscilar runs onboarding, credit, fraud and AML decisions on one platform, so a signal found when a seller is onboarded is still visible when that seller asks to be paid. Oscilar's merchant onboarding orchestrates KYC checks and enhanced identity checks for each applicant, triggers step-up verifications when they are needed, and reads device and behavioral signals. Each onboarding case comes with a natural language explanation of why it was created, and teams can backtest and A/B test a rule change before it goes live.

For payouts, Oscilar's account takeover detection looks for risky actions using historical patterns in IP addresses, locations and devices; on a seller account, a payout-account change after an unfamiliar login is that kind of action. The platform can also "analyze cross-account linkages to uncover fraud rings".

Governance is built in: a full audit trail per decision with stored reasoning, and human-in-the-loop by design. Models are monitored automatically for data, feature and concept drift, with outcome KPIs measured by segment, and the platform is specified for decisions in under 100 milliseconds.

Frequently asked questions

Who counts as a high-volume third-party seller under the INFORM Consumers Act?

A high-volume third-party seller is one that, in any continuous 12-month period during the past 24 months, has had 200 or more separate sales or transactions of new or unused consumer products and $5,000 or more in gross revenues on the platform. Those are the FTC's thresholds. For these sellers, an online marketplace must collect bank account, contact and tax ID information and verify it within 10 days.

Does the EU Digital Services Act require marketplaces to verify sellers?

Yes. Article 30 of the Digital Services Act, which applies from 17 February 2024, requires an online platform that lets consumers buy from traders to obtain each trader's identity, contact, payment account and registration details before the trader uses the service. The platform must make best efforts to assess whether that information is reliable and complete, and must suspend a trader who does not correct it on request.

Is seller verification the same as KYB?

Seller verification overlaps with KYB but is not the same thing. Many marketplace sellers are individuals or sole traders, so verifying them is identity verification of a person plus a check on the payout account. KYB applies to business sellers, where registry and ownership checks are added.

What is triangulation fraud?

Triangulation fraud is a scheme in which a seller lists goods it does not have, takes a buyer's order and payment, then buys the item from a legitimate retailer with stolen card details and ships it to the buyer. The buyer receives the goods and has no complaint. The real cardholder later disputes the charge at the retailer, and the seller keeps the buyer's payment.

Why check a seller again before paying out?

A seller account can change hands or change its payout details after onboarding, and the payout is the moment the loss happens. Checking again before payout catches a takeover, a new bank account or a sudden jump in volume while the money can still be held. Onboarding checks confirm who the seller was at sign-up, not who is being paid now.