Posted under misc by Sander with tag(s) research

Marktplaats will not tell you how many people get scammed on a daily basis, but me, a bored programmer can. By creating a program that monitors listings, we can track which accounts got banned.

The Python script marktwatch does the following:

  • Visit the nvidia 960/970/980/1060/1070/1080 graphics card listings 3 times a day
  • Store price/description/seller/location/date and more in a database
  • By visiting previously saved user profiles, we can see if they still exist. If they do not, they are probably banned.
  • If they got banned, check what listings they had and for what price
  • Only examine private listings (excluding webshops)

If we let this program run for X amount of time, we can analyse the database and conclude:

  • The ratio of sellers to scammers
  • The ratio legit listings to scams
  • Make an educated guess as to how many people got scammed and how much they lost

Operation boredom GO

I was able to collect data from and around the month of August.

TL;DR

SELECT COUNT(*) FROM listing;
SELECT COUNT(DISTINCT seller) FROM listing;
SELECT COUNT(DISTINCT seller) FROM listing WHERE removed;
SELECT COUNT(*) FROM listing WHERE removed;
  • 978 listings in total
  • 582 unique accounts
  • 114 removed accounts (19%!)
  • 143 removed listings (14%!)

19% of all user accounts that I came across in a months time were deleted after a short time. Let’s continue what this actually implies for the bad guys:

Scam yields

SELECT AVG(price) from listing where removed;

Listings from removed accounts had an average of 330€.

Tin-foil hat time

Let’s try to find out how much money the bad guys make.

Educated guesses:

  • Marktplaats starts terminating user accounts after multiple reports, e.g., 3 reports.
  • Within this timeframe, at least 2-3 people can get scammed but could be a lot more - lets just go with 2 to be on the safe side.

Our ‘equation’ *kugh* becomes:

(avg(scam price) * scammers) * 2 
SELECT (SELECT AVG(price) 
        FROM   listing 
        WHERE  removed) * (SELECT Count(*) 
                           FROM   listing 
                           WHERE  removed) * 2; 

Which brings us to 94.478€ of scam profits over 143 listings (out of 978).

As previously mentioned, this is just a raw educated guess - it’s up to the reader to verify my conclusions or perhaps do some research him/herself.

Most popular models for scams

SELECT COUNT(id), make FROM listing WHERE removed GROUP BY make ORDER BY COUNT(id) DESC;

The illegitimate listings targeted the more expensive cards the most:

Count Model
52 nvidia 1070
26 nvidia 1060
25 nvidia 1080
25 nvidia 970
12 nvidia 980
3 nvidia 960

Avarage account age for scams

SELECT seller, active_since_days from listing WHERE removed 
GROUP BY seller ORDER BY active_since_days;

SQL Output: link

  • 50% of the accounts are less than a year old
  • 37% of the accounts are less than a week old

There are still some old accounts to be spotted within this list. Older accounts seem more legit and as such you would pay more to obtain one. I suspect hacked accounts can be bought at some shady darkweb forum.

Scammer locations

SELECT count(*), location FROM listing WHERE removed 
GROUP BY seller ORDER BY count(id) DESC;

SQL Output: link

Looking at this output, we can see most of these graphics cards are generally located in the less populated areas of The Netherlands. Buyers are reluctant to travel far to pick up a card so they pay via bank transfer.

Sorted per province:

SELECT *, COUNT(1) 
FROM (SELECT SUBSTR(location, INSTR(location, ',') + 2, 5) 
      FROM  listing 
      WHERE removed 
      GROUP BY seller) 
GROUP BY 1 ORDER BY 2 DESC; 
Location Count
Limburg 21
Noord-Holland 19
Noord-Brabant 18
Gelderland 15
Groningen 9
Friesland 8
Overijsel 6
Drenthe 5
Zuid-Holland 5
Belgie 3
Zeeland 3
Utrecht 2

For some odd reason, Flevoland is not included in the list.

Conclusion

10-15% of the video card listings are scams. Draw your own conclusion!

Safe trading!

full database dump