The account buyer
Not a separate attack so much as a shortcut that makes several of the others cheap.
- What they want
- Standing they did not earn, whether on a forum, a market, or both.
- How they earn
- By running any of the patient attacks without the patience. The account arrives pre trusted.
- What it costs them
- A payment, and far less than a year of participation. This is the whole appeal.
- How you meet them
- As an established account with a real history, behaving normally until it does not.
- What gives them away
- Sometimes a gap in activity followed by a resumption with a different tone, or a shift in the kind of thing being posted. Weak signals, and the strongest ones are only visible afterwards.
- What stops them
- Weighting recent behaviour far above accumulated totals, and never letting standing substitute for a check.
Where accounts come from
- Sold by the original holder, often somebody stepping away who sees no harm in it.
- Taken over through credential reuse, which is the same failure described in the credential stuffer applied to a valuable target.
- Recovered from an abandoned state, where the original holder stopped paying attention long ago.
- Built for sale, which is a business in itself and produces accounts that look organic because they are.
Why sellers are targetedThis is why vendor accounts are attacked harder than buyer accounts. A compromised buyer account holds a balance. A compromised vendor account holds years of standing and the ability to talk to many people as a trusted party, which is worth considerably more.
What to weight instead
| Signal | Weight |
|---|---|
| Recent completed volume | High. Describes who is running the account now. |
| Dispute rate against volume | High. The one measure the biases do not distort. |
| Written feedback rather than scores | Medium. Text carries hesitations a number cannot. |
| Total lifetime orders | Low. Describes an account, not a person. |
| Registration date | Very low. Ages by itself and transfers intact. |
| Headline rating | Very low. An average hides the shape, and the shape is what you wanted. |
The uncomfortable conclusion
Every history based signal is weaker than it appears, and history is still the best evidence available. The resolution is not to abandon it but to stop treating it as protective. Reputation tells you who to deal with. It cannot limit what happens if you are wrong, which is what escrow and order sizing are for.