Before you make your next Amazon purchase, please be aware that not everything you can buy on its site is sold or fulfilled by Amazon directly. The Amazon Marketplace is also populated with third-party sellers that sell and ship their own goods. These are seller accounts that utilize Amazon's platform, customer reach and search tools to peddle their own wares.
While Amazon tries its best to police its third-party sellers from scamming customers or from selling counterfeit goods, there's a troubling ploy that has been spreading in recent weeks.
According to The Wall Street Journal, hackers are taking over third-party Amazon Marketplace seller accounts to post non-existent items and fake deals, stealing tens of thousands of dollars from customers and sellers alike.
The thieves break into accounts via password reuse attacks. With this technique, a hacker will use credentials and passwords stolen from other massive data breaches and sold on the Dark Web, such as the Yahoo or LinkedIn hacks from last year.
Active and dormant seller accounts are both being targeted and the scammers exploit the positive feedback and ratings garnered by the account's history.
Once a seller account is taken over, the perpetrator then changes the banking information and starts posting thousands of fake item listings to con shoppers. If someone bites, the hacker quickly cashes out but the bought item never gets delivered.
Since a number of the hacked accounts are dormant, it takes longer for the questionable transactions to be noticed. If a customer complains about an unshipped item and demands a refund, Amazon charges the original seller account holder who never received the payment in the first place.
Amazon Marketplace third-party sellers are increasingly becoming attractive targets for scammers because there are millions of accounts that can be victimized with tons of cash to steal. Although the exact scope of the scam is still unclear, some sellers are saying that this has shaken their confidence in Amazon's security measures for Marketplace sellers.
In response, an Amazon spokesperson reiterated that customers are always protected by Amazon's A-to-z Guarantee that covers all purchases made on Amazon.com, either from Amazon itself or from third-party sellers.
"We want customers to buy with confidence anytime they make a purchase on Amazon.com. With the A-to-z Guarantee, customers are always protected whether they make a purchase from Amazon or a third-party seller. If ever the product doesn’t arrive or isn’t as advertised, customers can contact customer support for a full refund of their order."
The statement continued with how Amazon deals with fraud:
"Amazon has zero tolerance for fraud. We withhold payment to sellers until we are confident that our customers have received the products and services they ordered. In the event that sellers do not comply with the terms and conditions they’ve agreed to, we work quickly to take action on behalf of customers. There have always been bad actors in the world; however, as fraudsters get smarter so do we. Amazon is constantly innovating on behalf of customers and sellers to ensure their information is secure and that they can buy and sell with confidence on Amazon.com."
As a shopper, to protect yourself from Amazon Marketplace scams (and online shopping scams, in general), avoid items and deals that seem too good to be true. If a seller is offering deep discounts on a popular item, it's most likely bogus. For added security on Amazon.com, only buy items that are sold or fulfilled by Amazon (typically labeled with the "Prime" logo).
For sellers, protect your accounts by updating your passwords regularly and by never using the same password across multiple services. It is recommended that you use two-factor authentication to further prevent unauthorized logins. Additionally, don't allow your seller account to be dormant and monitor its activity frequently.
If you have been a victim of an Amazon Marketplace scam, you can file an Amazon A-to-z guarantee claim.