Exploiting E-commerce Platforms: How Amazon and eBay Became Vehicles for Money Laundering

E-commerce marketplaces have transformed the movement of goods and money. A seller can create an account, list products, accept payments from customers across multiple jurisdictions and use integrated fulfilment services without operating a conventional retail infrastructure. Buyers see familiar interfaces, recognised payment methods, customer reviews and platform guarantees that create confidence in the transaction.

The same architecture can be exploited by criminal actors. Fictitious sales can provide a commercial explanation for transfers between connected parties. Stolen payment credentials can be converted into goods that are resold for apparently legitimate income. Counterfeit or stolen merchandise can generate revenue that is mixed with lawful marketplace proceeds. Refunds, gift balances, seller accounts, delivery addresses and fulfilment networks can also be manipulated to move or disguise value.

Amazon and eBay are frequently referenced because of their scale and prominence, but the risk is not unique to either company, nor does the presence of criminal activity imply that a marketplace knowingly facilitates it. The financial-crime issue arises from the interaction between high transaction volumes, third-party sellers, remote onboarding, integrated payments and fragmented visibility across platforms, banks, processors and logistics providers.

Listen the podcast

Watch the video

Why e-commerce marketplaces matter now

The legitimate scale of e-commerce provides criminals with cover. Marketplace activity can involve large numbers of low- or medium-value payments, international buyers, changing product inventories and rapid fluctuations in turnover. These characteristics are ordinary for many digital merchants, but they can also make illicit transactions difficult to distinguish from genuine retail activity.

RUSI identifies four broad forms of criminal exploitation within e-commerce: defrauding customers through non-delivery, purchasing goods with stolen card data, using online businesses as fronts for illicit transactions and abusing marketplaces to move criminally obtained funds. The last two are particularly relevant to money laundering because the parties may cooperate in creating a transaction intended to look legitimate.

This distinction is essential. An online shopping scam is generally designed to steal from the buyer. Marketplace laundering is designed to create an apparently credible sale, settlement or refund that conceals the origin or purpose of the value being transferred. A single criminal network may engage in both, but the evidential and control questions are different.

Major marketplaces have invested substantially in identity verification, counterfeit detection, rights-owner programmes and account enforcement. Amazon reports extensive investment in brand protection and collaboration with law enforcement, while eBay operates its Verified Rights Owner programme and authenticity controls for specified product categories. These measures demonstrate active attempts to address abuse, but they also indicate the scale and adaptability of the threat confronting large marketplace ecosystems.

How criminals use fictitious and collusive sales

The most direct laundering pathway is a phantom transaction. A criminal seller lists an ordinary product, digital item or low-cost good at a price agreed with a connected buyer. The buyer uses criminal proceeds to complete the marketplace purchase, and the platform records what appears to be legitimate commercial revenue.

The seller may ship an empty package, an item of negligible value or nothing at all. Tracking information, automated messages and positive feedback can be generated to strengthen the appearance of a completed sale. Platform and payment fees are accepted as the cost of converting funds into revenue associated with an identifiable retail transaction.

This model resembles trade-based money laundering, but the documentation and settlement are generated digitally. Product listings replace invoices, order confirmations support the apparent transaction, and the marketplace payment system creates a record that may appear credible to the seller’s bank.

Mispricing can make the mechanism more difficult to identify. A common consumer product offered at an extreme price may attract attention, but collectibles, artwork, rare books, electronics, digital products and customised goods can have subjective values. Criminals can exploit that uncertainty by deliberately overpricing goods or conducting repeated transactions whose economic value is difficult to establish.

RUSI notes that fake or mispriced marketplace transactions can provide a pretext for moving funds. The institution observing the seller’s account may see regular marketplace settlements without visibility of the item, buyer relationship, shipment or underlying commercial rationale.

Counterfeit and stolen goods as laundering instruments

Marketplace abuse does not always involve a wholly fictitious product. Criminal actors may sell counterfeit, stolen or illegally obtained goods and present the resulting proceeds as legitimate retail income.

Counterfeit trading can perform two functions. It generates criminal profit through the sale of misrepresented goods, and it provides a business through which unlawful proceeds can be combined with revenue from authentic merchandise. The apparent legitimacy of the seller’s wider inventory can make the illegal component harder to isolate.

A US Department of Justice case involving an online sneaker retailer illustrates this convergence. The defendant sold both authentic and counterfeit footwear through businesses and platforms including eBay, then combined the proceeds in financial accounts to conceal the illegal source of part of the income. The case resulted in guilty pleas for counterfeit trafficking and money laundering.

Stolen goods create a related risk. Merchandise obtained through burglary, cargo theft, organised retail crime, account takeover or refund fraud may be resold through established seller accounts. The marketplace proceeds then appear to originate from ordinary customer purchases rather than the underlying theft.

Financial institutions may struggle to identify the criminal source because settlement descriptions are consistent with the customer’s declared business. The relevant anomaly may be found outside the bank statement: repeated sales of new high-value products without credible suppliers, inconsistent purchase invoices, abrupt changes in inventory or links to known stolen-goods networks.

Converting stolen payment credentials into saleable value

E-commerce also allows criminals to transform compromised payment data into physical goods. Stolen card details or hijacked customer accounts can be used to buy electronics, luxury products, gift cards or other items with strong resale markets. The goods are delivered to the criminal, a drop address or a parcel mule, then sold through another marketplace account.

This process converts stolen payment capacity into merchandise and subsequently into seller revenue. It creates separation between the original card fraud, the delivery network and the account receiving resale proceeds.

Europol describes card-not-present fraud as the unauthorised use of payment-card data to purchase goods or services remotely. The compromised data may originate from phishing, malware, data breaches or digital skimming and can be combined with laundering and resale services available through organised cybercrime networks.

A US account-takeover and money-laundering case similarly described stolen credit-card information being used to purchase merchandise from e-commerce retailers for resale or personal use. The resale stage is important because the criminal no longer needs to withdraw funds directly from the compromised account; the marketplace transaction helps convert stolen value into a different and more defensible form.

Refunds, returns and marketplace credits

Refund mechanisms are designed to protect legitimate customers, but they can also be used to extract or redirect value.

One method involves purchasing high-value goods with a stolen payment instrument and requesting a refund to an account or payment method controlled by the criminal. Another involves claiming that an item never arrived, returning a substitute product, sending an empty package or manipulating tracking information while retaining the original merchandise.

Europol specifically identifies a money-laundering risk where a criminal buys a high-value product and requests that the refund be issued to a different payment source. The original purchase may have been made using a stolen card, while the refund is directed towards an account controlled by the offender.

Organised refund services can industrialise the process. US enforcement actions have described groups offering fraudulent refund schemes against online retailers and charging customers a percentage of the value recovered. In one case, a defendant was charged with wire fraud and money laundering in connection with a fraudulent online-shopping refund operation.

Refund abuse does not automatically constitute money laundering. It may be first-party fraud, theft or conspiracy against the retailer. The laundering dimension arises where the refund or subsequent resale disguises the source, ownership or destination of criminal value.

Seller accounts, mule networks and fulfilment infrastructure

Marketplace seller accounts can become financial-crime assets in their own right. Criminal groups may create accounts using synthetic or stolen identities, purchase established accounts with positive histories, recruit genuine individuals to act as nominal sellers or take over dormant businesses.

An aged seller account can provide transaction history, customer reviews, higher payment limits and fewer early-life restrictions. The person named on the account may have little involvement in the operation, while criminal controllers manage listings, communications, payments and withdrawals through shared devices or remote access.

Mule participation can extend beyond receiving money. Parcel mules may accept goods purchased with stolen cards, remove identifying material and forward packages to another jurisdiction. Other participants provide addresses, seller identities, bank accounts or fulfilment facilities.

Europol states that proceeds connected to online-auction and e-commerce fraud frequently move through money mules. These intermediaries create distance between the predicate offence and the criminal organisers, while fragmented roles make the network more difficult to reconstruct.

Integrated fulfilment can create an additional layer. Inventory may be stored and shipped by a platform or third-party logistics provider, meaning the seller does not need to handle every product directly. Criminal actors may exploit this convenience to distribute counterfeit or fraudulently obtained goods while maintaining limited physical exposure.

Why marketplace laundering scales efficiently

The first reason is trust. A transaction conducted through a recognised marketplace appears more credible than an unexplained peer-to-peer transfer. Platform branding, order records, buyer protection and delivery tracking can make a fabricated or criminally funded sale look commercially authentic.

The second reason is volume. A large marketplace processes enormous numbers of legitimate orders, creating an environment where suspicious transactions can be divided across products, buyers, accounts and time periods.

The third reason is cross-border reach. Sellers may be registered in one jurisdiction, hold bank accounts in another, store goods elsewhere and serve buyers globally. Each participant may possess only part of the evidence.

The fourth reason is the interchangeability of criminal models. The same seller infrastructure can support counterfeit sales, stolen-goods resale, fictitious transactions and refund fraud. When one account is suspended, the network may move to another seller identity, marketplace or payment provider.

The fifth reason is the apparent economic explanation created by the platform. Bank statements may show settlements from a recognised marketplace rather than multiple payments from unknown individuals. Unless the bank can connect those settlements with product, buyer, refund and fulfilment data, the activity may appear consistent with normal e-commerce.

What an evidence-led investigation looks like

The first step is to establish the seller’s economic reality. Investigators should understand what products are sold, where inventory originates, expected margins, normal customer geography, fulfilment arrangements and the relationship between marketplace turnover and the wider business.

The second step is to reconstruct transaction networks. Repeated trading between the same buyers and sellers, common payment instruments, shared addresses, connected devices and reciprocal purchases may indicate collusive activity. A pattern of transactions can be suspicious even where each individual order appears ordinary.

The third step is to compare payment and delivery evidence. Analysts should examine whether goods existed, whether the shipment weight and destination were plausible, whether tracking was reused and whether refunds were issued to the original funding source. Repeated deliveries to forwarding addresses or unrelated third parties may require further scrutiny.

The fourth step is to identify the predicate offence. Marketplace activity may represent transaction laundering, counterfeit trading, stolen-goods resale, card fraud, refund abuse, tax evasion or an online scam. Accurate classification shapes the investigation, escalation route and suspicious activity report.

What a resilient control stack looks like

The first layer is risk-sensitive seller verification. Marketplaces and payment providers should verify identity, beneficial ownership, bank accounts, contact information and business activity, then repeat that verification when material changes occur. The US INFORM Consumers Act requires marketplaces to collect and verify specified information from qualifying high-volume third-party sellers and to suspend sellers that fail to provide it.

The second layer is marketplace-specific transaction monitoring. Controls should assess abnormal sales velocity, repeated transactions between linked parties, pricing outside plausible ranges, refund concentration, sudden category changes and settlements inconsistent with the seller’s age or profile.

The third layer is payment-instrument and account-linkage analysis. Shared cards, bank accounts, devices, IP addresses, telephone numbers, addresses and fulfilment locations can reveal seller networks that individual-account monitoring misses.

The fourth layer is refund integrity. Refunds should ordinarily return to the original payment method. Exceptions should receive enhanced review, particularly where the original instrument is compromised, the customer changes identity details or repeated high-value returns occur without credible evidence.

The fifth layer is fulfilment intelligence. Product provenance, inventory records, package characteristics, delivery routes and return patterns can help distinguish genuine trade from circular or fictitious commerce.

Finally, platforms, financial institutions, payment processors, logistics providers, rights owners and law enforcement need lawful mechanisms for exchanging actionable intelligence. RUSI has specifically recommended stronger engagement between law enforcement, payment processors and e-commerce marketplaces because no single participant can see the entire financial and commercial chain.

What this means for financial crime leaders

Marketplace laundering should not be reduced to a simple rule for payments associated with Amazon, eBay or another well-known platform. Recognised settlement descriptions may reduce apparent risk while concealing a complex network of sellers, buyers, payment instruments and delivery addresses.

The strategic objective is to connect the financial transaction with the underlying commercial event. Institutions need to establish whether a real product existed, whether its price was plausible, whether the buyer and seller were independent, whether the payment source was legitimate and whether the goods or refunds followed the recorded transaction.

Leaders should also avoid conflating every form of marketplace abuse with money laundering. Counterfeit trading, card fraud, refund fraud and non-delivery scams are distinct offences. They become laundering concerns when the marketplace is used to conceal criminal proceeds, transform stolen value or provide false legitimacy to a transfer.

E-commerce platforms have made legitimate trade faster and more accessible. Those same capabilities can be industrialised by criminal networks. The institutions best positioned to respond will be those that look beyond the marketplace settlement, connect commercial and financial intelligence, and identify the criminal operating model hidden behind the sale.