Marketplaces & apps
The attacker has a valid account. Most of your defenses were built on the assumption that they would not.
On a two-sided platform, the interesting abuse is not somebody breaking in. It is somebody signing up, or taking over a seller who signed up two years ago and has reviews, history and payout details attached.
Blocking by IP stopped working years ago. Rate limiting per account does nothing when the abuse is spread across four hundred accounts doing one thing each. And the account that matters most — an established seller — is the one your risk rules are least likely to touch, because its history looks excellent right up until the hour it does not.
The three shapes we see
Credential stuffing at low volume. Deliberately slow, deliberately distributed, tuned to sit under whatever threshold you set. The tell is rarely volume; it is the shape of the failures.
Seller-account takeover. Quiet for days, then payout details change, then listings change. The window between the first and the second is the only useful place to intervene.
API abuse at scale. Scraping, inventory sniping, and card testing run through your own documented endpoints by clients that authenticate correctly every time. Card testing looks like a good day on most dashboards.
What applies here
Account Defense, primarily. Built for the case where the credential is valid and the behaviour is not — takeover detection on seller and buyer accounts, and abuse detection on authenticated API traffic.
Checkout Monitor, if you take payment on your own pages. If payment is fully delegated to a processor's hosted page, the script surface is theirs and you largely do not need this. If you render your own checkout — most marketplaces do — you have the same third-party script problem a retailer has.
What we do not do
We do not make the block-or-allow decision for you, on either product. We surface what happened and what it looked like, and your systems act. The reasoning is the same as on the checkout side: a product that acts automatically will eventually act wrongly during your busiest hour, and you will not be able to tell quickly whether it was right.