Fraud scoring for marketplaces

What to score, and why these

Scoring everything is expensive and scoring the signup alone misses most of it. These are the events that carry the loss in marketplaces.

The patterns you will see

Marketplaces are harder than single-sided businesses for a reason that is easy to say and awkward to build around. You have two populations with opposite incentives, and abuse often involves both at once, sometimes run by the same person.

Most fraud tooling assumes one user doing one suspicious thing. Here the suspicious thing is usually a perfectly ordinary transaction between two accounts that should not know each other.

The gap is the exposure#

Money arrives from a buyer and leaves to a seller. Everything you can do sits in that window.

Pay out instantly and you have chosen to have almost no fraud window, so you will absorb the losses. Hold for a week and you catch far more, but you have made your sellers' cash flow worse, which is a real product cost in a competitive market.

That trade-off is a business decision, not a technical one, and it is worth making on purpose rather than inheriting whatever your payments integration did by default.

Risk-based holds are usually the better answer than one blanket delay: most sellers get paid fast, and a scored minority waits.

Collusion is a relationship problem#

The pattern that costs marketplaces most is not a lone bad actor. It is a buyer and a seller who are the same person.

A stolen card buys a nonexistent item from a seller account they control, and your platform quietly turns card fraud into a clean bank transfer.

Nothing about either account looks alarming on its own. The buyer bought something. The seller sold something. The fraud is entirely in the relationship, and you only see the relationship if you link across accounts instead of scoring each one alone.

What surfaces it: shared devices, shared networks, shared payout destinations, and order histories where the money goes round in a very short circle.

Seller accounts are an asset, so they get stolen#

A seller account with two years of history and four hundred reviews is worth far more than a new one, and it takes minutes to steal versus years to build.

The tell is almost never the login. It is the payout destination changing shortly before a withdrawal, or a listing pattern that breaks with everything the account did before.

Score those as their own events, with the login attached, and hold payouts on a destination change until the real owner confirms. That one control catches a whole category of loss that login monitoring alone will miss.

Scoring the payout and the destination change#

Two events carry most of a marketplace's exposure, and neither of them is the signup:

const r = await kaidn.score({
  event: "seller_payout",
  user_id: seller.id,
  ip: req.ip,
  email: seller.email,
  device_id: body.kaidn_device_id,
});

if (r.verdict === "block") return holdPayout(seller.id, r.reason_text);
if (r.verdict === "review") return queueForReview(seller.id, r.event_id);

return releasePayout(seller.id);

// the highest-value control on this page, and most of it is not the score
const r = await kaidn.score({
  event: "payout_destination_change",
  user_id: seller.id,
  ip: req.ip,
  email: seller.email,
  device_id: body.kaidn_device_id,
});

const newDevice = !(await db.accountDevices.exists({
  user_id: seller.id,
  device_id: body.kaidn_device_id,
}));

if (newDevice || r.verdict !== "allow") {
  await holdDestinationChange(seller.id, "24h");
  await notifyPreviousContact(seller, r.event_id);   // the details from BEFORE the change
  return { status: "pending" };
}

Finding collusion in your own order table#

Kaidn scores identities, not orders. The circular-money half is a query you own, and it is short:

SELECT buyer_id, seller_id, count(*) AS orders, sum(total) AS value
FROM orders
WHERE created_at > now() - interval '90 days'
GROUP BY buyer_id, seller_id
HAVING count(*) > 4
   AND count(*) = (SELECT count(*) FROM orders o2 WHERE o2.buyer_id = orders.buyer_id)
ORDER BY value DESC;

A buyer whose entire history is with one seller proves nothing on its own. A buyer whose entire history is with one seller, who also shares a device with them, is a different matter.

Where we sit#

We score events on both sides with the same engine, and the value is in linking them: device, network, email identity, and how fast the same patterns repeat across accounts. Verdicts carry the checks that fired and what each one counted for.

We are not a payments processor and we do not handle disputes. We do not do KYC and we do not classify listings. If your problem is counterfeit goods or regulatory identity checks, those are different products and you should buy them.