How a marketplace decides a seller is a shell account

Every major marketplace, from Amazon to eBay to Etsy to smaller vertical platforms, runs a quiet background process on every seller account: is this a real, independent business, or is it one operator wearing a hundred different masks. The stakes are high. Shell accounts get used to farm fake reviews, dodge suspensions, exploit new-seller promotions, or launder stolen inventory through a clean-looking storefront. So trust and safety teams have built entire detection stacks just to answer one question: does this account belong to who it says it belongs to.

This isn’t one check. It’s a layered system that starts the moment someone opens the signup page and keeps running for as long as the account exists.

What counts as a shell account

A shell account isn’t necessarily a fake person. Often it’s a real person, or a real LLC, that exists only to create the appearance of an independent seller while actually being controlled by someone who already has an account in poor standing, or who wants to run dozens of storefronts to get around per-account limits on listings, payouts, or promotional slots. The giveaway isn’t the paperwork. Registration documents can be legitimate. The giveaway is that the account behaves like it’s connected to others it claims no relationship with.

Platforms care about this because their entire trust model depends on sellers being independent, accountable entities. A review system only means something if one seller can’t quietly control fifty accounts leaving each other five-star ratings. A “new seller” discount only makes sense if new sellers are actually new.

Signals that start at signup

The first layer of detection happens before a seller lists a single item. When someone fills out a registration form, the marketplace is already fingerprinting the device and the network path the request came in on: browser and OS version strings, screen resolution, installed fonts, canvas and WebGL rendering quirks, timezone versus locale mismatches, and dozens of smaller attributes that together form something close to a unique identifier. None of these alone is damning. A thousand real people share the same screen resolution. What matters is the combination, and whether that combination has shown up under a different identity before.

IP reputation runs in parallel. Marketplaces maintain databases, often licensed from third-party fraud vendors, that classify IP addresses as residential, mobile, datacenter, or known-proxy. An application coming from a data center IP range is an immediate red flag for a supposed individual seller, since real home internet connections don’t originate from AWS or a commercial VPN’s exit node. Residential proxy traffic is harder to flag on IP type alone, which is exactly why it exists, but it creates its own tell: a residential IP that was, three minutes earlier, used to log into an account on the other side of the country doesn’t behave like a home connection.

Contact information adds another layer. Phone numbers get checked against carrier type (VOIP numbers score differently than mobile carrier numbers), email domains get checked for age and prior abuse history, and government ID uploads get run through document verification services that check for tampering, font consistency, and whether the same document image has been submitted under a different name elsewhere in the system.

Behavioral drift after the account is live

A shell account that survives onboarding checks doesn’t get a free pass. Trust and safety systems keep scoring behavior over time, because fraud patterns show up more clearly in what an account does than in what it claimed at signup.

Listing behavior is one of the biggest tells. A legitimate small business tends to add inventory at a human pace, tied to actual stock and seasonal demand. A shell account created to farm listing slots or resell someone else’s catalog often uploads dozens of items in one burst, frequently copy-pasted from other listings with only minor edits, sometimes literally scraped with the original seller’s photos and description structure intact. Marketplaces run duplicate-content detection specifically to catch this kind of listing clone.

Order and review velocity is another. A real store’s first sales tend to trickle in slowly and organically. An account that racks up dozens of five-star reviews in its first week, especially from buyer accounts with thin purchase histories of their own, gets flagged for review manipulation. Platforms build graphs connecting buyers to sellers by shared attributes and watch for clusters that only ever transact with each other.

Login and session patterns matter too. Genuine sellers log in from a device or two, at hours that roughly match a human schedule, from a location that stays reasonably consistent. An account accessed from twelve different countries in a week, or one that logs in at the exact same second every day like a script, reads as automated rather than personally operated.

Building the network graph

The most powerful tool in a marketplace’s detection stack isn’t any single signal. It’s the graph that links accounts together. Fraud and trust teams build entity graphs where nodes are accounts, devices, IPs, payment instruments, and shipping addresses, and edges are the connections between them: this account logged in from this device, this device also logged into that account, this bank account funds three different storefronts, this shipping address has shipped returns for five sellers that all opened within the same month.

Any single shared attribute might be a coincidence. A payment processor’s underlying bank routing number gets reused across thousands of unrelated merchants by design. But when a cluster of accounts shares multiple attributes at once, a device fingerprint plus a payout account plus a shipping origin, the graph lights up as a single controlling entity regardless of how different the storefront names and product categories look on the surface.

This is why operators who run multiple accounts intentionally reach for device farms and anti-detect browser profiles, tools built to make each account look like it’s coming from a distinct, isolated environment with its own fingerprint, its own IP, its own cookie jar. It’s also why marketplaces don’t stop at any one signal. A well-isolated browser profile can spoof canvas fingerprints and rotate through residential IPs, but it’s much harder to fully decouple the financial trail, the shipping trail, and the long-run behavioral rhythm of the human actually running the show. Detection systems are built assuming determined operators will beat individual checks, so they lean on the intersection of many weak signals rather than any single strong one.

Where the system gets it wrong

None of this is exact. Fingerprinting produces false positives constantly, since real households share networks and real small businesses sometimes operate from shared office space or coworking hubs that look, from an IP perspective, like a cluster of unrelated sellers. Family members who run separate legitimate stores from the same home Wi-Fi can trip the same signals as an operator running fifty accounts on purpose. Reputable fraud vendors publish that their models produce error rates, not certainty, and most marketplaces route ambiguous cases to a human reviewer or a manual document request rather than an automatic ban, precisely because the signals are probabilistic rather than definitive.

That uncertainty is also the reason no detection method should ever be described as airtight. Marketplaces adjust their models constantly, in response to both false positives from real sellers and new evasion patterns from professional account farms. The two sides adapt to each other in a loop that has no finish line: a new fingerprinting technique gets deployed, evasion tooling adapts to spoof it, the marketplace layers on a new signal that’s harder to fake, and the cycle continues.

Understanding this machinery isn’t about beating it. It’s about seeing why marketplaces increasingly resemble intelligence agencies more than storefronts, running graph analysis, device forensics, and behavioral modeling just to answer a question that used to be settled by a business license and a handshake.

Want more of this kind of teardown, on bot detection, fingerprinting, and the infrastructure both sides of the platform-trust arms race actually run on? Head back to the Hidden Internet homepage for the rest of the series.

Get new guides and videos first — join the Telegram channel.