How account takeover hits UK marketplaces, from credential stuffing to payout changes, and the signals and controls that catch it early.
Most marketplace fraud conversations focus on fake sellers. Account takeover is the quieter problem, and in some ways the worse one. The account is real. It has history, reviews and buyer trust built up over months. When someone else gets control of it, all of that trust works for them.
This post covers how takeover typically happens on a marketplace, what it looks like in your data, and the controls that catch it before money moves.
A brand-new seller account has to earn trust. It has no reviews, no sales history and often lower limits. A taken-over account skips all of that. A fraudster can list high-value items under a name buyers already trust, message past customers, or simply change the payout details and wait for the next settlement.
Buyer accounts get taken over too. Saved payment methods, stored addresses and the ability to message sellers are all useful to a fraudster, and a hijacked buyer account is a cleaner starting point for a scam than a new one.
For the platform, the damage lands in several places at once: refunds, chargebacks, a genuine user who is angry with you rather than with the criminal, and support time untangling who did what.
Reused passwords. People reuse passwords across sites. When one site is breached, the leaked email and password pairs are tried on others in bulk. This is usually called credential stuffing, and it is mostly automated.
Phishing. A message that looks like it comes from your platform, often about a sale, a payout or a policy problem, leads to a fake login page. Sellers are good targets because they expect operational messages from you.
Email account compromise. If someone controls a seller's email, they can reset the marketplace password. This is why the NCSC advises turning on 2-step verification for important accounts, starting with email, and describes 2SV as one of the most effective ways to keep criminals out (NCSC, Activate 2-step verification).
Session theft and device compromise. Malware or a stolen session token can give access without a password at all.
The routes differ, but what happens next is predictable. Look there.
Takeover nearly always involves a change. Someone new is now behind an existing account, and they behave differently. Useful signals include:
TrustVerify's fraud score combines device, bot and IP signals and returns them with an approve, review or block action. Device signals include flags such as new_device and suspicious_device_reuse; bot signals include webdriver, headless_user_agent and automation_markers. Our post on device fingerprinting and bot signals explains each one, and the account takeover page shows how they are used for this case.
Protect the moments that move money. You do not need maximum friction on every login. You need it on payout changes, email and phone changes, and withdrawals. Ask for re-authentication there, and consider a short hold on new payout details before the first settlement goes to them.
Tell the account owner. Send a notification to the existing email and phone when security details or payout details change. A genuine seller who did not make the change will tell you quickly.
Offer and encourage 2-step verification. Particularly for sellers above a certain volume. It does not stop everything, but it makes bulk credential stuffing far less useful.
Rate-limit login attempts. Slow down repeated failures by account and by source, and watch for many accounts failing from one device or network.
Score logins, not only signups. Run device and bot checks at login and before sensitive actions. Use the result to decide whether to allow, ask for more, or hold the action for review.
Step up when the risk is unclear. When a login is unusual but not clearly hostile, ask for more instead of blocking. That might be a one-time code, a re-check of identity, or a confirmation from the original email address. The TrustVerify fraud score returns approve, review or block, so a step-up is a rule you build on top of a review result. Sellers who passed identity verification at onboarding can be asked to repeat it if you have reason to think someone else is now in control.
Some takeovers will get through. How you recover shapes whether a seller stays.
That last point closes the loop. A device that took over one account will often try others.
You cannot manage takeover without numbers. Track:
If you cannot produce these yet, start with the first two. They tell you whether your controls are working at the point that matters.
If takeover is showing up in your refunds or support queue, it is worth scoring logins and payout changes, not only signups. See how TrustVerify approaches account takeover.
KYC, KYB, AML screening and fraud prevention in one place, with published pricing.
Fraud Prevention
Device Fingerprinting and Bot Signals on UK Marketplaces
What device fingerprinting and bot signals can tell a UK marketplace about fake sellers and scripted signups, and how to use them without overreacting.
Fraud Prevention
Email and Phone Risk Signals at Signup
What email and phone checks reveal at signup: disposable domains, missing mail servers, VoIP numbers and how to act without blocking real users.
Fraud Prevention
Designing a Fraud Review Queue That Does Not Become a Backlog
How to design a manual review queue for marketplace fraud and verification: what to route, how to prioritise, what reviewers need and how to keep it small.
