Kids’ resale marketplace with school and club Hubs · October 2026
A fake “support” account with a verified badge
What the operator asked for
A member named after the marketplace, with the bio “Official … Support”, showed a verified badge five minutes after signing up and contacted a real seller. A member reported it; the operator banned the account 36 hours later. The question, pasted into a support case on the day the marketplace was connected: how did they get verified, what did they do, and are there other accounts like this?
The problem
A verified badge on a brand-new account is what makes an impostor believable. The operator needed the mechanism, the account’s activity, and any look-alikes, from data they had never had in one place.
What Empavision did, step by step
- 1
The case, as the operator asked it
Pasted as written, with the member’s name and email. The marketplace had been connected to Empavision the same morning.

The request as pasted. Names, emails and ids are replaced. - 2
The first answer: the facts right, the case missed
“They are verified, but Empavision cannot show how.” Every fact about the account was correct and cited, and it said plainly what it could not see. But it had no history from before the connection, never looked at what the account did, and searched for look-alikes on the incident day only. Its plan pointed at staff tools: the wrong direction.

The first answer, as the operator saw it. Names, emails and ids are replaced. - 3
What was fixed in Empavision, the same day
Connecting a marketplace now also stores its last 90 days of change history, without replaying it. The change history says who wrote each change: the member’s own session or the operator’s tools. Before the report says who set a flag, a new check compares that member’s write with every other member’s write of the same flag. A new step lists everything a member did through transactions. Look-alike searches cover the whole marketplace, strongest matches first, and long result lists are no longer cut short before the report is written.
- 4
The same question, asked again
“The badge appears to be app-set, not manually granted.” The report compared this account’s badge write with every other member’s: the same member-session source as 209 writes across 177 members, seconds after an email is confirmed or a payment account is created, so the marketplace’s own app granted it. The real seller this account targeted got her badge the same way. The impostor confirmed its email, created a payment account without finishing the identity checks, and the app granted the badge 14 seconds later. It then opened three enquiries, 25, 26 and 27 minutes after sign-up, all to one seller on one listing, with no message in any of them.

The answer after the fixes, as the operator saw it. Names, emails and ids are replaced. - 5
The look-alikes, by name
A second account built from the marketplace’s name, created two months earlier and never banned, plus the marketplace’s own shop account. Schools and clubs came up for staff words like “team”; the report lists them for review and does not call them abusive.

Look-alikes as the operator saw them. Names are replaced.
Verified after
- ✓Checked against the marketplace’s own event log, read independently: the flag was written from the member’s session at the second the report gives, the same way and after the same trigger as for every other member, and the three enquiries carry no messages.
- ✓First answer in 2 minutes, the answer after the fixes in under 2 minutes, both on a marketplace connected the same day.
What did not go well
An earlier run’s headline said the member “self-set” the badge, an intent the event log does not show; it was retracted the same day. The method now compares a member’s write with every other member’s write of the same flag before it says who set it.
The first answer missed the mechanism, the activity and the second look-alike. It was honest about what it could not see, but an operator could not act on it.
Some runs tie the badge to the payment account created 14 seconds earlier, which is the real trigger; others leave that link out. The event log says it every time.
Finding a case after the fact is not catching it. The detection that would flag such an account within minutes of sign-up is being built from this case.






