Carding via payment aggregators and marketplaces (Etsy, eBay, Amazon Handmade)

[Good Carder]

Card fraud in the classic sense (creating a fake store and accepting payments through a gateway) has long been thwarted by KYC and scoring systems. However, marketplaces have created a new, far more dangerous ecosystem: carders don't accept payments directly — they convince the platform to do it for them, becoming a "verified seller." In this article, I'll examine the payment acceptance architecture on Etsy, eBay, and Amazon Handmade, methods for bypassing strict seller verification, classic "triangular fraud" schemes, and refunds through support. I'll also show why marketplaces often leave sellers alone to face the consequences of fraudulent activity.

Part 1. Escrow, holds, and split payments: how payments work on marketplaces​

Unlike a standalone online store, where the seller receives funds in their bank account with minimal delay, a marketplace acts as a guarantor (escrow) of the transaction. The buyer pays the platform, the money is deposited into an escrow account or temporarily held, and only after confirmation of receipt and quality of the goods are the funds transferred to the seller.

1.1. Aggregator vs. Escrow: Technical Model​

A payment aggregator is a technical provider that facilitates payment acceptance from buyers to sellers. It receives funds and transfers the full payment amount (minus its commission) directly to the platform's (the seller's) bank account. In the case of a marketplace, the aggregator services the platform itself, not each individual seller. This is why the marketplace always monitors cash flows, has the ability to freeze payments if suspicious, and refund funds to the buyer in the event of a dispute.

For sellers, a key feature of the system is holds. Funds are credited to their internal marketplace account but become available for withdrawal only after the platform verifies the transaction's reliability.

1.2. Comparison table of payment models on marketplaces​

Platform	Calculation model	The role of the platform	Seller Payment Deadlines (Standard)
Etsy	Etsy Payments — an internal wallet with holds	Full control of payments and escrow	3-7 days after delivery confirmation or waiting period expires
eBay	Managed Payments (с 2021 года)	Direct payments to sellers' bank accounts after verification	2-4 days after delivery confirmation, including a 2-day hold for new sellers
Amazon Handmade	Amazon Pay + A-to-Z Guarantee	Escrow with hold until delivery confirmation	7-14 days, but can be frozen at any time

1.3. Holds and escrow: how platforms retain funds​

• Standard hold for new sellers — first payments may be delayed up to 14 days.
• Escrow hold until delivery confirmation — funds are frozen in the marketplace's internal account until the buyer confirms receipt or the specified period expires.
• Additional holds in case of suspicion — the platform can freeze payments at any time to verify the seller's legitimacy.

1.4. Platform protection mechanisms​

• Etsy processes all payments through its Etsy Payments system, which may delay payments for up to 180 days to cover the risk of chargebacks and fraud if it deems necessary.
• eBay requires all sellers to register for Managed Payments, which includes mandatory identity and bank account verification before selling.
• Amazon Handmade takes up to two weeks to review your seller application, including verifying your products meet the "handcrafted" criteria.

Part 2. Bypassing Seller Verification: How to Open an Account in Someone Else's Name​

The carder's goal is to create a seller account on the marketplace that will pass all platform checks, appear legitimate, and be able to accept payments from buyers. Modern platforms require three key elements for verification: identification, a bank account, and, in the case of eBay, tax information.

2.1. Etsy Verification Requirements (2026)​

Etsy requires sellers to verify their identity and bank account. The account holder must match the name of the Etsy account holder. Etsy's registration form has separate fields for the "legal name" (used for tax verification) and "display name." Carders substitute fake or stolen information for the legal name in hopes of passing verification, but a mismatch between this and the bank account information is the main reason for suspension.

Etsy also requires uploading a valid, unexpired form of identification (passport, driver's license, or state ID), followed by bank account verification. The name on the bank account holder must exactly match the name on the ID.

2.2. eBay Managed Payments и KYC (2026)​

In 2026, eBay tightened its payout and verification rules. The name on the linked bank account must match the name on the eBay account. The verification process includes identity verification, money laundering compliance, payout management, and carding risk assessment.

Sellers in the US are required to provide an SSN or Tax Identification Number (ITIN) for IRS reporting and fraud prevention.

2.3. Amazon Handmade and checking handmade status​

Amazon Handmade requires proof that products are truly handmade: detailed descriptions, product photos, and proof of the manufacturing process. However, carders can skip this step by copying descriptions and photos from other platforms, but a manual product review by Amazon's team may uncover any discrepancies.

2.4. Fake documents and synthetic identities​

Bypassing KYC/KYB requirements on marketplaces has become a real industry, transformed into a "service."

• Industrial production of fake IDs. Fake passports and driver's licenses created with image editors or specialized software are used to verify identity. In 2025, US and Dutch authorities shut down the largest marketplace for fake IDs, VerifTools. This marketplace, which had earned at least €1.3 million, allowed anyone to upload their photo and fake data to obtain a ready-made fake ID to bypass KYC. The VerifTools operators were arrested, but their followers immediately relaunched the service on new domains.
• Deepfake for video verification. In 2025, Facia recorded a rise in "deepfake seller fraud," where AI-generated videos, voices, and faces were used to confirm the seller's identity in order to pass complex video verification (requiring the seller to show their face on camera next to a document).
• Cashing out verified accounts ("Account Farming"). Complete, fully verified accounts are sold on dark web forums. The price of such an eBay or Amazon account ranges from 100 to 500 rubles, depending on its age, rating, and sales history. A carder buys an account that's already "warmed up" and has a positive history and immediately begins using it for carding schemes, without wasting time on independent verification.

Part 3. Fraudulent Schemes on Marketplaces​

With a verified seller account, the carder moves on to the main phase – cashing out money or goods using carding.

3.1 Triangulation Fraud​

The classic "triangular scam" involves three parties: the victim buyer, the fraudulent seller, and a third party (the legitimate seller or cardholder). The scheme allows the carder to use stolen credit cards to pay for legitimate customers' orders, receiving cash in the process. Here's

a step-by-step description:

1. The victim-buyer finds an attractive offer from a fake seller on the marketplace (usually an expensive product at a reduced price) and pays for it.
2. The fraudster accepts payment from the victim through the marketplace.
3. To fulfill an order, the carder uses a stolen credit card, purchases the same product from a real seller (on the same or another marketplace), and specifies the victim's delivery address.
4. The victim receives the goods directly from the legitimate seller and thinks the transaction was successful.
5. The owner of the stolen card discovers the charge and initiates a chargeback.

The key paradox: by the time the fraud is discovered, the victim has already received their order, often leaving a positive review, and the seller on the marketplace has already transferred the money to the fraudster. The chargeback is initiated by the owner of the stolen card, and their bank debits the funds from the account of the real seller, who was unsuspecting.

In February 2025, the Merlin Network (a European carding detection platform) neutralized a highly sophisticated triangular fraud scheme targeting small household appliances. Carders operated through marketplaces, selling goods at reduced prices and paying for them with counterfeit payment instruments, which were then cashed out through a complex chain of intermediaries. Conclusion: by 2025–2026, triangular fraud has evolved from "home-grown" schemes to industrially organized networks that can masquerade as legitimate businesses for several months.

3.2. Refund Abuse Schemes​

After receiving the buyer's money, the carder may attempt to return it while keeping the goods. There are two main approaches:

1. Friendly fraud:
The buyer receives the goods and then contacts their bank with a chargeback request, claiming they did not receive the goods or that they did not match the description. In 2025, 39% of sellers surveyed reported experiencing "first-party misuse" (the same scenario), and 62% said the incidence had increased by at least 5% over the past year.

2. Return manipulation:
The carder receives the goods, requests a refund, but sends back an empty box or a different item, and sometimes even falsifies the tracking number.

3.3. Buyer substitution and account hijacking schemes​

In 2025, a scheme became widespread on classified ads. A fraudster poses as a legitimate buyer, asks the seller to "confirm" something via a link, and then gains full access to the buyer's bank account, emptying it and applying for loans. This scheme doesn't rely directly on stolen cards, but it perfectly illustrates how the psychology of seller manipulation can be used to bypass card systems.

Part 4. Risks for Marketplace Sellers​

If you're a legitimate seller on Etsy, eBay, or Amazon Handmade, carders make you their primary target. The victim loses items, money, commissions, and risks account bans.

4.1. Chargebacks: When a seller pays for someone else's fraud​

If a buyer who paid for a purchase with a stolen card initiates a chargeback through their bank, the marketplace (via a payment aggregator) debits the transaction amount from the seller's account. The seller loses the item, shipping costs, and receives a full refund. Additionally, they pay a chargeback penalty. In some cases, if chargebacks become numerous, the marketplace may permanently block the seller's account and freeze all funds.

4.2. Massive attacks on card verification through fictitious orders​

A carder can place hundreds of small orders with different sellers, using one order per card from the stolen database. If the card is valid, the order goes through; if not, it's rejected. The seller doesn't receive any money, but wastes time processing the order, and their store receives a series of rejections, which looks suspicious to the marketplace's algorithms.

4.3. Triangular Scheme: The Seller Loses Everything​

If the triangular fraud is uncovered, the owner of the stolen card initiates a chargeback. The funds are debited from the account of the real merchant who sent the goods to the unsuspecting victim. The merchant suffers losses and has no way to return the goods.

4.4. Emotional burnout and reputational losses​

Constant disputes, blocked payments, and the need to constantly prove their innocence are the main factors driving seller burnout on marketplaces. Platforms build security systems to minimize their own losses, often forcing sellers to fight for their funds while the carder has already disappeared.

Conclusion: Fraud and carding on marketplaces are a shadow of the legitimate economy.​

Marketplace payment systems are designed for user convenience, and it's precisely this convenience that becomes the primary vector for fraud. Escrow and holds protect the buyer but leave the seller vulnerable. Carding here doesn't require the carder to have their own payment infrastructure — it uses the platform's own infrastructure.

Two key takeaways:

1. Carding on marketplaces is the laundering of stolen cards through physical goods. The carder turns stolen data into cash, forcing sellers and logistics companies to pay for their fraud.
2. Marketplaces protect themselves, not sellers. Their security systems are built to minimize their own losses, not to block all possible schemes.