Kavra LabPOST /messagesBlockedBanned seller back, messaging 40 buyers
- Same device as a banned account
- Antidetect browser profile
- Account created 2 hours ago
Risk93
Industry
Marketplace fraud prevention for both sides of the platform
Marketplace fraud is abuse of a two-sided platform by fake or hijacked buyers and sellers: scam listings, spam messages, fake reviews, promo farming, banned users returning under new accounts and bots copying listings. Kavra checks every signup, login, listing and message, links accounts to the actor behind them and tells your backend what to do.
- Who it hits
- Goods, services, rentals and gig platforms
- What it costs
- Buyer trust, refunds, promo budget, moderation
- Tools used
- Antidetect browsers, proxies, scripts, device farms
- Where to stop it
- Signup, login, listing, messaging, payout
What is marketplace fraud?
A marketplace sells trust. Buyers pay strangers because the platform tells them the seller is real, the reviews are honest and the listing exists. Marketplace fraud is any attempt to fake that trust: a seller who does not exist, a buyer who never meant to pay, a review written by the seller's second account, or a scammer who was banned last week and is back today under a new name.
Unlike a single store, a marketplace is attacked from two sides at once. Fake sellers target buyers with listings that do not exist and pull the conversation off the platform. Fake buyers target sellers with overpayment scams and fake shipping labels, and farm the new-buyer promos you pay for. Around both sides, bots copy your listings and prices, and credential stuffing takes over trusted seller accounts to sell through their good reputation.
Threats that hit marketplaces
Each threat strikes at a different point in the journey, and each one costs something different.
| Threat | Where it strikes | Business impact |
|---|---|---|
| Fake account creation for fake sellers and buyers | Signup, seller onboarding | Scam listings, fraud losses, cleanup work |
| Ban evasion through multi-accounting | Signup, first listing | Removed scammers return within hours |
| Spam and scam messaging | Messages, offers, contact reveal | Buyers lured off platform, trust lost |
| Fake reviews and rating rings | Review and rating forms | Rankings bought, honest sellers buried |
| Account takeover of sellers | Login, payout settings | Payouts redirected, scams sold under a trusted name |
| Credential stuffing | Login and password reset | Hijacked accounts, support load, lockouts |
| Bonus and promo abuse on both sides | First order, referral, seller credits | Acquisition budget paid to the same people |
| Listing and price web scraping | Search, listing pages, internal APIs | Inventory cloned by rivals, sellers poached |
| SMS pumping through phone verification | Phone verification, contact reveal codes | Inflated SMS bills from fake traffic |
| Payment fraud and card testing | Checkout, deposits, card vaulting | Chargebacks, processor fees and penalties |
How a scam seller works a marketplace
The pattern repeats on goods, rental and service platforms. Only the bait changes.
- 01
Open many seller accounts
The operator creates a batch of seller profiles, each in its own browser profile or virtual machine behind its own home IP. Stolen photos and copied descriptions, often scraped from your own site, make the listings look real.
- 02
Build fake reputation
A second set of accounts buys cheap items or leaves reviews for the new sellers, so they pass the thresholds for visibility and trust badges.
- 03
Post bait listings
Underpriced electronics, rentals that do not exist or services with urgent availability. Listings are posted in bursts by scripts to cover many categories before moderation catches up.
- 04
Move buyers off platform
Messages push buyers to a chat app, a payment link or a fake checkout page, away from your buyer protection.
- 05
Get banned, come back
When moderation removes an account, the operator opens the next one from the same laptop with a fresh profile and a new IP. Without device and actor linking, each return looks like a new user.
The touchpoints to protect
Checking only at signup misses hijacked accounts. Checking only at checkout misses spam and fake reviews that never touch a payment. Good protection assesses each step where value or trust changes hands, and asks a different question at each.
- Signup and seller onboarding: is this a new person, or an actor who already has accounts, including banned ones?
- Login and password reset: does this login match the account's own devices and networks, or is it a bot testing leaked passwords?
- Payout and bank detail changes: is the person changing where money goes the same one who usually runs the account?
- Listing creation: is a script or headless browser posting in bulk, or a human writing a listing?
- Messages, offers and contact reveal: is one actor sending the same message to many buyers from fresh accounts?
- Reviews and ratings: do the reviewer and the seller share a device, a network or a cluster of accounts?
- Checkout and promo redemption: is a first-order or referral credit going to someone who already claimed it?
- Search and listing pages: is this a shopper, a verified crawler or AI agent, or a scraper cycling through proxies and VPNs?
Signals that give fake sellers and buyers away
One signal rarely proves fraud on a marketplace, where roommates share Wi-Fi and families share laptops. Clusters of signals do.
New account, known actor
A fresh seller profile runs on a device already tied to removed accounts, even though its fingerprint has been rotated.
Spoofed browsers
Profiles from antidetect browsers claim one device and behave like another. Real sellers rarely use them.
Home IPs from proxy pools
Each account appears in the right city, but the addresses come from commercial residential and mobile proxies.
Messaging at machine pace
The same opening line, a link or phone number, sent to dozens of buyers within minutes of account creation.
Reviews from the same cluster
Five-star reviews arrive from accounts that share devices or networks with the seller, or with each other.
Phones in racks
Mobile app traffic from device farms and emulators: many handsets, one operator, identical setup.
Why moderation and verification alone fall short
Most marketplaces already run content moderation and some form of verification. Each covers one layer.
| Defense | What it catches | What slips through |
|---|---|---|
| Content moderation | Banned words, known scam text, bad images | Clean listings from a banned actor, scams moved to chat |
| Email and phone checks | Obviously fake contacts | Disposable inboxes and virtual numbers |
| IP bans | Repeat offenders on a fixed address | Rotating home IPs from proxy networks |
| Seller ID verification | Anonymous sellers | Borrowed or stolen documents, hijacked verified accounts |
| CAPTCHA on forms | Crude bots | Solving services and human operators, plus friction for real users |
| Rate limits | One noisy client | Scrapers and spammers spread across thousands of IPs |
Business and regulatory context
Marketplaces carry more responsibility for what third parties sell than they used to. In the European Union, the Digital Services Act asks online marketplaces to collect information about traders and make best efforts to check it before they can sell, and to act on illegal content. In the United States, the INFORM Consumers Act requires online marketplaces to collect and verify details from high-volume third-party sellers. Rules like these reward platforms that know who is behind each seller account and can show how they decide.
The commercial pressure is just as direct. Every scam a buyer meets on your platform is a reason to shop elsewhere, and every honest seller buried under fake reviews is a reason to list elsewhere. Promo budgets meant to grow the buyer side get spent on the same people many times. Protection has to act on the fraud without adding steps for the honest majority, because friction on a marketplace hits both sides at once.
What good marketplace protection looks like
The strongest setups treat the actor, not the account, as the unit of trust, and act before value moves.
- Assess every signup, login, listing and message, not a sample.
- Link new accounts to banned ones through device, network and behavior, so ban evasion fails at the first listing.
- Compare every seller login and payout change with that account's own trusted devices and history.
- Tell scrapers apart from shoppers and from verified search crawlers, and decide per path what each may see.
- Hold, verify or throttle instead of hard blocking when evidence is mixed, so a real seller on a new phone is not locked out.
- Give moderators the evidence behind each decision and the linked cluster, so they review rings, not single accounts.
- Start in observe-only mode to measure what you would catch before changing any user's experience.
Sources
How Kavra helps
How Kavra protects marketplaces
One script and one server call give every signup, login, listing and message an explained assessment, so your trust and safety team acts on evidence, not guesses.
Ban evasion caught at the door
Returning devices are recognized across accounts, and fingerprint rotation is tracked as one actor, so a banned seller's new profile links back to the old one.
Spoofed devices exposed
Antidetect profiles, emulators and device farms are caught by contradictions between what they claim and how they behave.
Seller accounts guarded
Each login and payout change is compared with the account's trusted devices, networks and history, including impossible travel.
Proxy intelligence
Kavra measures real exit IPs of commercial residential and mobile proxy networks, on top of 30+ public reputation feeds.
Scrapers told from crawlers
Verified search crawlers and AI agents are recognized by signature and published ranges. Impostors and scrapers are flagged.
Your rules, explained verdicts
Allow, verify or block per touchpoint, with a plain-language reason your moderators can read. Start in observe-only mode.
FAQ
Frequently asked questions
Something else? Talk to our team.
How do scammers get back onto a marketplace after being banned?
They open a new account from the same computer or phone, using a fresh browser profile, a new email and a different home IP from a proxy network. To the platform it looks like a new user. Stopping it means recognizing the device and behavior behind the account, even when the fingerprint changes, and linking the new profile to the banned one before its first listing goes live.
How can a marketplace detect fake reviews?
Look at who wrote them, not only what they say. Fake reviews usually come from accounts linked to the seller or to each other: shared devices, shared networks, accounts created in the same burst, or purchases made only to earn the right to review. Linking reviewers to seller clusters catches rings that text analysis misses because the wording is varied.
How do you stop spam messages between buyers and sellers?
Assess the sender at the moment of sending. Spam comes from new or hijacked accounts that message many strangers quickly, often with links or phone numbers, from spoofed browsers and proxy IPs. Scoring the actor lets you hold or delay suspicious messages while normal conversations flow, instead of filtering on keywords that scammers change daily.
Is it legal for competitors to scrape my marketplace listings?
The law varies by country and depends on what is scraped and how, so ask your counsel. In practice, many marketplaces forbid scraping in their terms and protect listings technically. Blocking scrapers while letting verified search crawlers through keeps your listings indexed without handing your inventory and seller contacts to rivals.
Should marketplaces verify every seller's identity?
Rules such as the EU Digital Services Act and the US INFORM Consumers Act set duties for trader and high-volume seller information, so check what applies to you. ID checks alone are not enough, because stolen documents and hijacked verified accounts still pass. Pair them with device and behavior signals that show whether the same actor is behind many sellers.
What is triangulation fraud on marketplaces?
A fraudster lists goods they do not own, collects the buyer's payment, then buys the item from a real retailer with a stolen card and ships it to the buyer. The buyer is happy until the card owner files a chargeback. Warning signs include new sellers with underpriced stock, spoofed devices and payment details that do not match the account's history.
See who is really on your site.
Run Kavra on your own traffic in observe-only mode. No risk to your customers, and a clear report of the fraud it finds.