Online Marketplaces

Business model and fraud surface

A marketplace is a payment intermediary with a storefront on top. In most managed models the platform (or its payment facilitator) is merchant of record: it authorizes the buyer's card, wallet or bank payment, carries chargeback liability, and owes the seller a payout. The money held between collection and payout is both the platform's float and its fraud exposure.

Each side is both a customer and a risk:

• Buyers bring payment risk (stolen cards, chargebacks) and claim risk (false item-not-received and not-as-described claims).
• Sellers bring fulfillment risk (non-delivery, counterfeits, triangulation) and payout risk (new or hijacked seller accounts that cash out and vanish).
• The platform guarantees both sides, so it absorbs whatever it can't recover. When a seller who has already been paid out disappears, the platform refunds the buyer from its own pocket.

Most of a marketplace's fraud exposure sits in the payout gap. Card disputes can arrive weeks or months after a transaction. Marketplace claims windows run for weeks. Instant seller payouts settle in seconds. Every day a seller can withdraw before the buyer's recourse period closes is unsecured exposure. Reserves, rolling holds and payout velocity limits are how you price it (Seller Onboarding and Reserves, Withdrawal and Payout Controls).

Classifieds and local marketplaces flip the problem. Payment often happens off-platform via P2P apps, cash or checks, so the platform carries no direct loss but bears the reputational and regulatory exposure for scams that start on its listings. The FTC's 2025 data shows how big the lure surface is. More than 40% of people who lost money to a scam that started on social media said it began with an ad to buy something, and about half of fake rental listings reported to the FTC were on one social platform.

Decision points: seller onboarding and verification, listing publication, checkout authorization, order release to the seller, claim adjudication, payout scheduling, payout destination changes, and seller offboarding.

What fraudsters want here

Fraud across the customer lifecycle

Top mechanisms, ranked

1. Seller Non-Delivery and Fake Listings: new, farmed or hijacked seller accounts that take payments and never ship, timed to cash out before claims arrive. Non-payment/non-delivery drew 56,478 IC3 complaints and about $503M in reported losses in 2025, across all channels.
2. Buyer Protection Claim Abuse (INR and SNAD): false "never arrived" or "not as described" claims. Appriss Retail estimated about $21B in claims and appeasement fraud and abuse across US retail in 2024. This is where first-party fraud and policy design collide.
3. Account Takeover (ATO): hijacked high-reputation seller accounts are worth far more than new ones, because reputation buys payout speed and buyer trust. Buyer ATO targets stored balances and saved cards.
4. Card-Not-Present Fraud: stolen cards buying resalable goods, with the platform as merchant of record carrying the chargeback and the network monitoring-program exposure.
5. Seller-Targeted Scams (Fake Payment and Overpayment): fake payment confirmations and overpayment/refund-the-difference schemes, mostly on classifieds and local pickup. The Fed's compliance guidance describes the counterfeit-cashier's-check overpayment variant and why availability rules make victims think the check has cleared.
6. Triangulation Fraud: a seller fulfills real orders with goods bought elsewhere using stolen cards. The marketplace sees happy buyers, and the loss lands on another merchant until the scheme is traced back.
7. Refund and Return Fraud: empty boxes, item swaps and wardrobing through the marketplace's return flow, plus refund-as-a-service operators who social-engineer support. Amazon's 2025 default judgment against a refund-service operator involved warehouse insiders who approved fake returns.
8. Fraud Rings and Collusion: buyer–seller collusion (fake orders to manufacture reputation or launder stolen-card money), wash trading and coordinated claim abuse.
9. Payout Redirection: changing a seller's payout bank or card after ATO, often the only step the attacker needs.
10. Promo Code Abuse and Referral Abuse: new-buyer credits and seller-acquisition incentives farmed through Multi-Accounting.

Regulatory environment

For more detail, see Card Network Dispute Rules, US Regulatory Overview and BSA-AML and SAR Filing.

Key metrics

General definitions: Fraud Metrics and KPIs.

How fraud teams are typically organized here

Marketplaces almost always split into buyer risk and seller risk, often under a trust and safety umbrella that also covers content and listing policy:

• Seller risk: onboarding verification, INFORM compliance, reserves and payout policy, seller investigations.
• Buyer/payments risk: checkout fraud, chargebacks, claims abuse and promo abuse.
• Claims and disputes operations: adjudication queues, appeals and representment.
• Trust and safety: listing policy, counterfeit and prohibited items, off-platform scam messaging. This overlaps with fraud on scams and fake listings.
• Investigations: rings, collusion and law-enforcement liaison.

The classic failure is the seam between them. Buyer risk approves a claim and seller risk debits the seller, but by then the seller has been paid out. Or trust and safety removes a fake listing while nobody checks the seller's other listings and payouts. A shared entity graph across buyer and seller sides, and a single owner for net loss, fix most of it. See Fraud Operating Model, Cross-Functional Partnerships, Investigation Standards.

Industry-specific signals and controls

Signals

• Customer Tenure and History for sellers: sales history, fulfillment record, payout history. Sudden category or price-point shifts on aged accounts, a common sign of ATO or a sold account.
• Account Change Events: payout destination, email or phone changes on sellers just before high-volume listings.
• Transaction Pattern Anomalies: a new seller's GMV ramping faster than peers, listing prices well under market, a sudden burst of high-ticket listings.
• Entity Link Analysis and Device Reputation and Linkage: buyer–seller shared devices or payment instruments (collusion), clusters of sellers sharing payout banks.
• Dispute and Return History: buyer claim history across orders and sellers.
• Address Risk Signals: reshippers and freight forwarders on high-risk categories (triangulation and CNP resale).
• Customer Contact Signals and message content: requests to pay off-platform, shared phone numbers in messages, fake payment-confirmation patterns.

Controls

• Seller Onboarding and Reserves: tiered verification (INFORM as the floor), rolling reserves and payout delays that relax as tenure and fulfillment history build.

• Withdrawal and Payout Controls: cooling-off after payout-destination change, instant-payout eligibility gated on tenure, payout velocity caps.

• Claims and Returns Policy Controls: evidence requirements scaled to claim value and history, signature or PIN-at-handover for high-value delivery, return-receipt inspection.

• Tracking and delivery validation: carrier-scan confirmation, detecting fake or reused tracking numbers.

• Real-Time Transaction Risk Scoring at checkout, with seller-level context.

• In-product Customer Education and Scam Warnings when messages contain off-platform payment lures.

• Graph Analytics to find rings across buyer and seller accounts.

• Can a seller under 30 days old be paid out before your median claim arrives?

• Does a payout-destination change pause payouts?

• Can you see a buyer's claim history across every seller they've bought from?

• Do you recover claim refunds from seller balances, and how often is the balance already gone?

Members: Playbook - Seller Fraud Members, Playbook - Refund and Claims Abuse Members, Playbook - Chargeback Management Members, Playbook - Scam Intervention Members, Playbook - Fraud Ring Investigation Members, Playbook - Payout and Withdrawal Risk Members.

Notable public cases

• Amazon v. refund-service operator (2025): a federal court entered a default judgment totaling more than $2.4M ($2M against the operator of a refund-fraud service, the rest against four former warehouse employees it recruited, who approved over $400K in fake returns). It shows insiders and social engineering at scale. See Refund and Return Fraud and Insider Fraud.
• FTC v. Temu (INFORM Act, 2025): a $2M civil penalty over seller-information disclosure and reporting mechanisms. It is the first prominent INFORM enforcement.
• FTC and GOAT (2024–2026): redress over an allegedly unhonored "Buyer Protection" program and shipping-time violations. It shows that buyer protection is a legal promise as well as a fraud surface.
• Case Study - Pinduoduo Coupon Exploit (2019): marketplace promo logic exploited at scale overnight.
• Case Study - TD Bank AML Failures (2024): not a marketplace case, but a picture of the downstream laundering and mule networks that receive marketplace payouts.

Sources and further reading

• FTC: Informing businesses about the INFORM Consumers Act: thresholds, 10-day collection and verification, suspension, disclosure, penalties
• FTC: Temu to pay $2 million penalty for alleged INFORM Act violations (Sept 2025): enforcement example
• FTC: Redress to consumers impacted by GOAT's shipping and refund policies (Oct 2026): buyer-protection promises and the Mail Order Rule
• FTC Data Spotlight: social media scam losses (Apr 2026): shopping-ad scams, fake rental listings
• FBI IC3 2025 Internet Crime Report: non-payment/non-delivery complaints and losses
• Courthouse News: Amazon refund-fraud ringleader and ex-workers ordered to pay $2.4M (Feb 2025): refund-service and insider case
• Chain Store Age: losses from return fraud and abuse exceed $100 billion: claims and appeasement fraud estimate
• MRC: 2026 Global eCommerce Payments and Fraud Report: first-party misuse and refund abuse trends, real-time payment fraud expectations
• MRC: Refund/policy abuse remains the top fraud threat (Mar 2025): 2025 ranking
• Fed Consumer Compliance Outlook: counterfeit instrument scams and mail-related check fraud (2025): overpayment scams on marketplaces and Reg CC availability
• Chargeflow: VAMP explained: VAMP ratio, thresholds and dates (processor summary)
• Adyen: Visa Compelling Evidence 3.0 FAQ: evidence requirements for 10.4 disputes