Seller Non-Delivery and Fake Listings
Fake or hijacked seller accounts list goods they never ship, collect buyer payments and withdraw proceeds before claims mature, leaving buyers or the platform with the loss.
What it is
Non-delivery fraud is the seller-side mirror of Buyer Protection Claim Abuse (INR and SNAD). It works because marketplace payouts often happen before buyer claims mature. A seller who can attract buyers, collect payments and withdraw within that gap keeps the money. The platform then has to refund buyers out of a balance that's already empty.
The FBI's IC3 tracks this as non-payment/non-delivery. In 2025 it logged 56,478 complaints and about $503 million in reported losses, fifth by complaint volume among all crime types. The FTC's Consumer Sentinel ranked online shopping second among fraud categories in 2024, with 383,000 reports. Both are self-reported undercounts that capture only the losses consumers notice and report.
Three seller archetypes:
| Archetype | How it looks | Defense focus |
|---|---|---|
| Fake seller | New account created to defraud: fake identity, mule payout account | Onboarding verification, payout destination ownership, new-seller limits |
| Hijacked seller | Legitimate, well-rated account taken over; listings and payout changed | Account Takeover (ATO) detection, Account Change Events, payout change cooling-off |
| Bust-out seller | Real seller builds history, then sells far beyond capacity and disappears | Exposure limits relative to fulfillment history; Bust-Out Fraud patterns |
Hijacked accounts are especially valuable for their reputation. A high-rated seller account converts buyers instantly, and aged seller accounts are traded for exactly that reason (Account Farming and Resale).
How it works
Two money paths:
- On-platform payment. The platform holds funds, so its decision points are payout timing and destination. Buyers are usually protected, and the platform absorbs losses it can't recover.
- Off-platform payment lure. The seller persuades the buyer to pay outside the platform (P2P, gift cards, crypto, bank transfer), usually with a discount or an excuse. Platform protection no longer applies. On the payment side this becomes an Authorized Push Payment (APP) Scams problem, and the loss falls on the buyer. IC3's 2025 report lists 4,761 non-payment/non-delivery complaints with a cryptocurrency reference, with about $76 million in losses.
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Seller onboarding | Identity and business verification, device and network, links to banned sellers | Approve? Apply new-seller limits and reserves? |
| Listing | Category (high-demand electronics, tickets, gift cards), price vs. market, listing velocity, copied content | Hold listings for review? Cap listing value? |
| Sales | Order velocity spike vs. history; buyers steered to off-platform contact | Throttle; trigger fulfillment verification |
| Fulfillment | Tracking validity (real carrier, matching destination, scans progressing) | Hold funds until tracking is validated or delivery confirmed |
| Account changes | New payout destination, email or phone changes, login anomalies (hijack pattern) | Cooling-off before payout to a new destination |
| Payout | Withdrawal timing and amount vs. balance and claim exposure | Release, partially release, or hold against reserve |
| Claims | INR claims accumulating across buyers | Freeze payouts; refund buyers; recover from reserve |
Exposure is unshipped or undelivered order value minus reserve. Mature seller-risk programs manage that number for each seller in real time, like a credit limit, instead of reviewing sellers one by one (Velocity and Exposure Limits).
Common variants
| Variant | What's different |
|---|---|
| Fake tracking | Seller uploads a tracking number for an unrelated or undeliverable shipment to trigger payout release |
| Drop-ship mirages | Listings for goods the seller never intends to source |
| Hijacked top-seller | ATO of a reputable seller; payout redirected; prices cut to drive volume (Payout Redirection) |
| Bust-out | Real seller oversells before exit |
| Off-platform lure | Payment moved to irrevocable rails; platform protection voided |
| Ticket, rental and pre-order fraud | Delivery date far in the future gives a long gap before claims |
| Social-commerce fake shops | Storefronts on social platforms; payment through P2P or wallets |
| Triangulation hybrid | Seller does ship, using stolen cards elsewhere (see Triangulation Fraud) |
Where it shows up
- Online Marketplaces: primary exposure via payout timing and seller reserves.
- Payments and P2P: goods-and-services payments, purchase protection, and P2P sends to fake sellers.
- Neobanks and Consumer Fintech: the receiving side. Fake-seller proceeds land in mule accounts at neobanks and get moved out quickly (Money Mules, Fast In Fast Out Patterns).
- Cross-industry pattern: the seller payout is a withdrawal. Everything in Withdrawal and Payout Controls applies. A hijacked seller account getting a new payout bank before a burst of below-market sales looks just like a brokerage ATO that changes the linked bank before liquidating.
Impact
- Buyer loss (unprotected rails) or platform loss (protected rails with unrecoverable sellers).
- Trust damage to the marketplace; reputation harm to hijacked legitimate sellers.
- Mule-network exposure for the banks that receive proceeds (BSA-AML and SAR Filing).
- Scale signals: IC3 2025 non-payment/non-delivery losses of about $503M; FTC online shopping reports in the hundreds of thousands per year.
Red flags
- New seller with high-value, high-demand listings at below-market prices → Transaction Pattern Anomalies
- Seller identity checks that passed with weak, thin or inconsistent results → Identity Verification Outcomes
- Sales velocity far above the seller's fulfillment history → Velocity Signals
- Tracking that doesn't validate, doesn't match the buyer's region, or stalls → fulfillment evidence
- Payout destination added or changed shortly before a sales spike → Account Change Events
- Login from new devices and networks on an established seller → Login Anomalies, Device Reputation and Linkage
- Buyer messages showing pressure to pay off-platform → Customer Contact Signals
- Payout destination shared with other sellers or flagged as a mule → Payee and Counterparty Risk, Entity Link Analysis
- Rising INR claims across many buyers in a short window → Dispute and Return History
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Seller Onboarding and Reserves | Verification, new-seller limits, rolling reserves, payout delays that track delivery |
| Prevent | KYC and Customer Identification Program (CIP), Bank Account Ownership Verification | Seller identity matches payout account owner |
| Prevent | Contact Change Cooling-Off Periods | Delay payouts after credential or payout changes |
| Detect | Velocity and Exposure Limits | Real-time unshipped exposure per seller |
| Detect | Graph Analytics | Links to banned sellers, shared payout destinations, listing content reuse |
| Respond | Withdrawal and Payout Controls | Freeze and claw back; refund buyers from reserves |
| Respond | Customer Education and Scam Warnings | In-chat warnings when off-platform payment is suggested |
Emerging variants and adversary adaptation
- Seller-account ATO as the preferred path. As onboarding verification improves, buying or hijacking established accounts is cheaper than building fake ones. Shift weight to post-onboarding behavior change: account changes, listing mix shifts, pricing shifts (Account Takeover (ATO), Session Hijacking and Infostealers).
- AI-generated listings and storefronts. Generative tools make convincing listings, product photos and fake shop sites cheap and fast. Content-similarity and image-provenance checks help, but the decisive controls are financial: payout timing and exposure (Generative AI and Deepfake Fraud).
- Instant payouts compress the window. Instant seller payouts improve seller experience but remove the buffer that let claims arrive first. Gate instant payout eligibility on tenure and fulfillment record (Real-Time Payment Rail Fraud).
- Off-platform steering. Steering buyers off-platform pushes losses onto consumers and their banks, where liability frameworks are contested. See Case Study - Zelle Scam Liability Disputes (2024-2025).
Related mechanisms
- Triangulation Fraud: the seller ships, using stolen payment elsewhere
- Buyer Protection Claim Abuse (INR and SNAD): the mirror image
- Account Takeover (ATO) and Payout Redirection: hijacked sellers
- Bust-Out Fraud: the real-seller exit pattern
- Money Mules: payout destinations
- Authorized Push Payment (APP) Scams: off-platform payment lures
Real-world examples
- FBI IC3 2025: 56,478 non-payment/non-delivery complaints, about $503M in losses.
- FTC Consumer Sentinel 2024: online shopping ranked second among fraud categories, with 383,000 reports.
Sources and further reading
- FBI IC3 2025 Internet Crime Report (PDF): non-payment/non-delivery definition, complaints, losses, crypto nexus
- FBI Internet Crime Complaint Report 2025 (HIPAA Journal, Apr 2026): category ranking by complaint volume
- FBI IC3 annual cybercrime report (CyberScoop, Apr 2026): 2025 totals and release date
- Fraud, identity theft and other scams regulatory alert (KPMG, 2025): FTC 2024 Consumer Sentinel: online shopping reports and rank
- FTC testifies to Joint Economic Committee on fraud (FTC, Mar 2026): 2025 Consumer Sentinel totals ($15.9B; 3M reports)