Fake listings and buyer-seller collusion rarely show up on the same dashboard, but they erode trust in commerce marketplaces in nearly identical ways. A buyer clicks, trusts what they see, and loses money before anyone flags the transaction, or a seller and buyer who are secretly the same person move stolen funds through a transaction that looks routine. For Trust and Safety professionals, stopping both threats depends on the same discipline: seeing the network behind the listing, not just the listing itself.
Why fake listings and collusion are two sides of the same threat
A fake listing is a storefront built to deceive: an item that does not exist, a counterfeit good passed off as authentic, or a legitimate brand impersonated to earn instant credibility.
Collusion is different. It’s two accounts, sometimes controlled by the same fraudster, working together to move money, launder funds, or manufacture fake reviews and transaction history. Marketplaces are exposed to both because their entire business model depends on letting strangers transact with minimal friction. Self-service seller onboarding, fast account creation, and peer-to-peer payment flows are exactly what buyers want and exactly what fraudsters exploit.
A 2025 CNBC investigation into Walmart Marketplace found at least 43 third-party sellers who had used the identity of another business, including publicly traded companies, to register their accounts. When CNBC purchased and lab-tested 20 items sold by sellers impersonating legitimate businesses, every single one turned out to be counterfeit. That’s not an isolated failure. It’s what happens when vetting cannot keep pace with marketplace growth, and fraudsters know it.
How fake listings slip past marketplace onboarding
Fraud rings can create convincing listings fairly easily and quickly. They grab real product photos, generate additional images and reviews with AI tools, and price items just low enough to feel like a deal rather than a red flag. According to the Global Anti-Scam Alliance, over half of all adults worldwide have reported scam encounters and 23% have reported losing money to them in 2025, with shopping scams affecting a whopping 54%of victims.
What makes fake listings hard to catch when posted is that they often look identical to legitimate ones. The differentiator is not the listing content, but the account and device history behind it. Red flags include seller accounts that are created just minutes prior, tied to a device or payment method already linked to prior takedowns, or a description that reuses assets scraped from a real unaffiliated business.
What buyer-seller collusion looks like in practice
Collusion can take a few different forms:
Third-party fraud is where one person controls both the buyer and seller account, lists an item at an inflated price, then pays with a stolen card or laundered funds and cashes out once the transaction clears. It’s called third-party fraud because the payment method belongs to someone outside the transaction entirely, and the actual cardholder typically has no idea their card was used until they spot the charge.
Review manipulation schemes is when colluding accounts leave glowing reviews for each other to build the trust signals a marketplace uses to reduce friction.
Rental and services fraud is when a fraud ring posts a listing that looks legitimate, collects a deposit from a buyer who trusts what they see, and disappears before delivering anything.
Fake rental listings are a clear example of how much damage a single vector can do. The Federal Trade Commission found that consumers reported nearly 65,000 rental scams since 2020, totaling $65 million in reported losses. About half of the people who reported a rental scam said it started with a fake ad on Facebook, and another 16% pointed to a fake Craigslist listing. Adults ages 18 to 29 were three times more likely than other age groups to report losing money this way, a reminder that collusion and fake listings both prey on trust built through familiar, high-traffic platforms.
The network signals that expose collusion rings
Individually, a colluding buyer and seller account can look clean. Reviewed side by side, in the context of shared devices, overlapping IP ranges, reused payment instruments, or a payout beneficiary that keeps surfacing across supposedly unrelated accounts, the connection becomes obvious.
This is the main reason link analysis and graph-based intelligence outperform rules built around a single transaction or a single account: they detect coordinated abuse as a connected case instead of a pile of unrelated alerts.
Sift assesses thousands of signals across the buyer and seller journey, from account creation through checkout and payout, and aggregates them into a Sift Score from 1 to 100, where 1 indicates a trustworthy user and 100 indicates likely fraud. That score reflects the full pattern of behavior and relationships a Trust and Safety team would otherwise have to piece together manually across dozens of tickets and queues. Sift’s Global Profile intelligence extends this further by resolving identity links across the network in real time, surfacing relevant risk history directly in the Console so analysts can see cross-account connections without piecing them together by hand.
Building layered defense across the listing lifecycle
No single control stops fake listings and collusion on its own, because the two threats surface at different points in the transaction.
Authentication at signup slows down fraudsters trying to reuse stolen identities or synthetic credentials to stand up new seller accounts.
Payment Protection watches the transaction for signs that a payout is heading toward a beneficiary already tied to prior abuse.
Dynamic Friction lets a marketplace apply extra verification only where the risk actually warrants it, rather than slowing down every seller or every buyer equally.
Workflows route the accounts and transactions that need human review into the right Queues, so fraud analysts spend their time on the cases where judgment matters most instead of chasing down every listing manually.
Account Defense addresses the takeover attempts that often precede collusion, since a fraudster who compromises a legitimate seller account instantly inherits that account’s trust history.
What Trust and Safety teams should measure
Fake listings and collusion both punish teams that only measure fraud at the individual transaction level. A ring that spreads losses across a dozen small transactions, or that alternates between a handful of accounts, can stay under detection thresholds tuned for single bad actors.
To avoid this, you must track detection at the ring level, not just the account level. Measure how long it takes to identify a coordinated pattern once the first account in a cluster is flagged, not just the time to catch a single fraudulent listing. Watch chargeback and dispute rates specifically tied to marketplace transactions, since these often lag behind the initial fraud by weeks. And track how much manual review volume a Queue absorbs after a new fake listing pattern appears, since a spike there usually means an automated control just fell behind.
If your team is looking for a tool that can detect fraud at a ring level, Sift might be a good option. Sift uses advanced machine-learning technology to identify fraud activity and stop it before fraudsters can harm your business financially. If this sounds like something that your business would benefit from, consider trying it for yourself. Request a demo today.
Frequently asked questions
What is the difference between fake listings and buyer-seller collusion?
A fake listing is deceptive content, such as a nonexistent item, a counterfeit good, or a listing that impersonates a real brand. Buyer-seller collusion is coordinated activity between two accounts, sometimes controlled by the same person, used to launder money, fabricate reviews, or manufacture fake transaction history. The two often overlap, since a colluding pair may use a fake listing as the vehicle for moving funds.
How do fraud rings create fake listings at scale?
Fraud rings reuse stolen product photos, generate additional images and reviews with artificial intelligence, and often register seller accounts using stolen or synthetic business identities to appear credible immediately. A 2025 CNBC investigation found dozens of Walmart Marketplace sellers using stolen business identities, and every counterfeit item the investigation tested came from an impersonated seller account.
What signals indicate buyer-seller collusion?
Shared devices or IP addresses between accounts that transact with each other, reused payment instruments or payout beneficiaries, review activity concentrated between a small cluster of accounts, and account creation patterns that cluster in time are all common indicators. These signals matter far more in combination than individually, which is why link analysis across the account network outperforms transaction-level rules alone.
Why do marketplaces struggle more with these threats than single-sided e-commerce sites do?
Marketplaces have two populations to vet instead of one, buyers and sellers, and both sides generate trust signals like reviews and ratings that fraudsters can manipulate. Self-service seller onboarding, built to reduce friction and drive marketplace growth, is the same mechanism fraud rings use to stand up fake storefronts quickly.
