{"id":"2560bb55-9676-40fc-b209-98efb22bc386","arxiv_id":"2412.14985","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A five-platform, 11-marketplace measurement finds 38,253 accounts advertised for over $64 million and links sold accounts to six scam categories, while estimating platform takedown at 19.7%.","lead":"Researchers mapped the online marketplaces where social media accounts are bought and sold, finding over 38,000 accounts advertised for a combined asking price above $64 million between February and June 2024. The study tracks what happens to 11,457 of these accounts after sale, identifying scam patterns and arguing platforms take down only about one in five of them.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 8's 19.71% platform-detection rate conflates platform takedowns with voluntary deletions/renames, so the paper's central policy claim rests on an unvalidated status taxonomy.","rationale":"I read the paper as a descriptive measurement study of the account-trading ecosystem, and its census contribution — 38,253 advertised accounts across 11 public marketplaces, 11,457 visible profiles, and the $64.2M aggregate asking price — appears coherent with the described collection methodology. The reader's weakest-assumption identification is exactly right and is the most load-bearing concern: the Section 8 detection-efficacy headline is the empirical basis for the paper's main policy claim about platform weaknesses. I would add one nuance: the paper's own text says it classifies both voluntary disappearances and platform takedowns as efficacy 'conservatively,' but this is not conservative — it overstates platform enforcement. A sold account that is renamed by its new owner, or a listing that the seller deactivates, is not evidence of platform detection. The lack of a baseline takedown rate for non-advertised accounts compounds the problem, since the absolute percentage cannot be attributed to the marketplace context without a control group. The Section 6 scam-post projection from 25 manually reviewed posts per cluster and the internal numeric inconsistencies (e.g., $157 vs $120 median price; 211 vs 212 categories) are secondary but reinforce the CONDITIONAL posture rather than changing it. If the authors decompose inactive statuses and add the matched baseline, the central claim can be validated or corrected; until then, the policy conclusion is unverified. This does not change the reader's verdict, which already conditions acceptance on resolving this ambiguity.","tokens_in":19979,"tokens_out":4084,"duration_ms":29018,"concrete_test":"For each of the 2,259 inactive accounts in Section 8, record the exact API status returned (e.g., Forbidden vs Not Found vs does not exist). Then, 30 days after collection, re-query the original handle: (i) if the profile is reachable, the account was renamed or transiently unavailable, not blocked; (ii) check whether the corresponding marketplace listing was removed, marked sold, or deactivated by the seller — if so, the disappearance is seller-side; (iii) for a random sample of 150 ambiguous 'Not Found'/'does not exist' accounts, use the Wayback Machine and platform search-by-handle to determine whether a takedown notice or archived ban page exists. Separately, sample a matched control cohort of non-advertised accounts (same platform, creation-year bucket, follower quintile) and measure the same inactive-status rate over the same collection window.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing claim is Section 8's 'overall efficacy of social media platforms in blocking these accounts was 19.71% (2,259 accounts),' which the abstract and Section 10 convert into the policy conclusion that platforms 'face challenges in detecting and mitigating these threats.' For this inference to hold, inactive API statuses must predominantly reflect platform enforcement. The paper's own taxonomy undermines that premise: on X, 'Not Found' is defined as the owner having changed UserID or voluntarily deleted the account, and for TikTok, YouTube, and Facebook the 'does not exist' status is only 'suspected' to be abuse-related. The authors then count owner-side disappearances — including post-sale rebranding, voluntary deletion, and 'accounts go offline intentionally after successfully executing scams' — together with takedowns as 'efficacy,' and call this 'conservative.' That label is backwards: pooling owner-initiated disappearances into the numerator inflates the apparent detection rate. Renaming is especially common immediately after an account is sold, and seller-side delisting is not evidence about platform detection. There is also no matched baseline: platforms take down ordinary accounts too, so the absolute 19.71% does not isolate enforcement against marketplace-advertised accounts. If most of the 2,259 inactive accounts are seller-side or owner-side disappearances, the true platform enforcement rate is lower, possibly substantially, and the cross-platform comparison (48% TikTok/Instagram vs 5% YouTube/Facebook) partly reflects API status conventions or seller behavior rather than detection capability.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper measures the market for buying and selling social media accounts. Between February and June 2024 the authors crawled 11 public marketplaces and manually collected data from six underground forums, obtaining 38,253 advertised accounts across X, Instagram, Facebook, TikTok, and YouTube, with a combined asking price of $64,228,836; 11,457 of these listings contained visible links to social media profiles, for which the authors collected metadata and 205,583 posts via platform APIs. The authors cluster posts with BERTopic/UMAP/HDBSCAN and manually vet clusters to produce a six-family scam taxonomy (18,792 posts, 3,769 accounts), analyze profile metadata and account creation dates, perform attribute-based network clustering, and report in Section 8 a 'detection efficacy' figure of 19.71% (2,259 of 11,457 accounts inactive at collection time). The paper concludes that platforms face challenges detecting these accounts and offers recommendations for platforms, payment providers, and policymakers.","tokens_in":20057,"tokens_out":13071,"duration_ms":99576,"significance":"The study is a substantial measurement contribution if its headline results survive scrutiny. Its strengths are concrete: the crawler and data-collection methodology are described in unusual detail (seed selection, semi-automated crawling, manual underground collection), the reported totals are arithmetically consistent where I checked them (Table 1 sums to 38,253; Table 2 sums to 11,457 and 205,583; Table 5 sums to 3,769 and 18,792), the authors release the collection code, and they performed responsible disclosure to the five platforms. The census alone — 38,253 listings, a $64M total asking price, per-platform price and follower distributions, and the payment-method landscape — is a useful reference for abuse researchers. The detection-efficiency claim in Section 8 is the one result that is load-bearing for the paper's policy conclusion, and it is currently overstated; because the authors hold the raw data, the needed re-estimation is feasible within the scope of revision. The scam taxonomy is a reasonable qualitative contribution but needs precision reporting before its counts can be taken at face value.","major_comments":[{"comment":"The headline 'efficacy' figure of 19.71% conflates platform enforcement with owner-initiated account disappearances, and the paper's own status taxonomy makes this explicit. The text defines X's 'Not Found' status as meaning 'the account owner either changed their UserID or voluntarily deleted the account,' and for Instagram, TikTok, YouTube, and Facebook the authors only 'suspect' that 'Not Found' or 'does not exist' corresponds to abuse-related profiles. Yet all of these statuses are then counted in the numerator of the 19.71% figure, and the paper calls this 'conservative.' The labeling is inverted: an account whose owner changed the UserID has not been blocked at all, and a voluntarily deleted account is not evidence about platform detection. Pooling these outcomes with confirmed takedowns makes 19.71% an upper bound, not a conservative lower bound, on platform enforcement against marketplace-advertised accounts. I ask the authors to re-estimate the rate with a status taxonomy that separates (i) confirmed suspension or platform deactivation, (ii) renamed account, (iii) voluntary deletion, and (iv) unknown, and to report the resulting ranges; Section 10's claim that 'only 19.7% of identified fraudulent accounts were actioned upon' should be revised accordingly.","section":"§8 (Table 8)"},{"comment":"The metric also lacks a baseline and is a one-shot observation. No matched control group of comparable non-advertised accounts is measured, so the absolute inactivity rate of 19.71% does not isolate what platforms do to marketplace-advertised accounts; ordinary account churn (renaming, abandonment, voluntary deletion) also produces 'Not Found' and 'does not exist' responses. In addition, statuses were checked only at collection time (February to June 2024), so accounts suspended after the check are counted as 'not blocked,' while the paper's framing in Section 10 as a general detection gap ignores this right-censoring. A practical fix within the paper's scope is to re-query the 11,457 accounts after a fixed interval and to compare the inactivity rate against a cohort of accounts matched on age and follower count, or at minimum to report the result as a contemporaneous inactivity rate with these caveats stated.","section":"§8"},{"comment":"Two downstream statements inherit the conflation identified above and should be removed or re-derived. Section 8 states that 'blocked accounts frequently featured names associated with trends like crypto, NFTs, beauty, luxury, animals,' but the accounts in that analysis include renamed and voluntarily deleted profiles, so the claim is about inactive accounts, not blocked ones. Section 10 states that 'only 19.7% of identified fraudulent accounts were actioned upon by social media platforms,' which converts an inactivity observation into an actions claim without support; the data do not distinguish who performed the action. The qualitative conclusion that platforms face challenges in detecting these accounts may survive, but it cannot be quantified with the current numbers.","section":"§8 and §10"},{"comment":"The scam-post counts (18,792 posts, 3,769 accounts) are extrapolated from cluster-level labels whose precision is not reported. The authors manually inspected 25 randomly selected posts per cluster and then counted all posts in the 16 'scam' clusters as scam posts; if a cluster is mixed, the per-category counts in Table 6 are inflated, and the manual step is not calibrated with an inter-annotator agreement or a precision figure. In addition, the pipeline restricts input to English-language posts via CLD2, but Tables 5 and 6 are presented as totals over all 205,583 posts without stating the English-only denominator. Please report the fraction of posts that passed the language filter, the per-cluster scam ratio for the sampled posts, and the resulting precision-corrected counts.","section":"§6 (Tables 5-6)"}],"minor_comments":[{"comment":"Headline numbers disagree: median price is $157 in the Abstract but $120 in §11, and the category count is 211 in the Abstract versus 212 in §4.1.","section":"Abstract vs §4.1 and §11"},{"comment":"The sentence reporting 'a median value of $7,573,348 across the platforms' is unexplained (no plausible median of the five platform totals equals this), and 'The median number of seller accounts was 77' is inconsistent with Table 1, whose six listed seller counts have a median of about 278.","section":"§4.1"},{"comment":"The seller-country counts sum to 38,253 (29,420 + 8,833), which is the number of accounts, not the number of sellers (9,944 in Table 1, 9,949 in the text); the country analysis appears to be per-account and should be relabeled.","section":"§4.1"},{"comment":"The 'All' row is malformed ('0 7,830, 20,500,000') and the column header says 'media' instead of 'median'; additionally, the TikTok median of 1 follower for API-visible accounts contrasts sharply with the marketplace-reported TikTok median of 20,807 followers in §4.1, and the paper should explain which population each number describes.","section":"Table 4"},{"comment":"Verified-account counts differ (185 in §4.1, restricted to YouTube and not linked via URLs, versus 669 in §5); the two figures should be reconciled or clearly labeled as different populations.","section":"§4.1 and §5"},{"comment":"The citation 'Kurt et al. [57]' does not match reference [57], which is Thomas et al., 'Trafficking fraudulent accounts,' a work also cited earlier in the same section with a different description; the naming and registration study appears to be mis-attributed.","section":"§2"},{"comment":"The term 'fraudulent accounts' is applied to accounts that were advertised on selling marketplaces; the paper should state explicitly that marketplace listing, rather than independent ground truth, defines the study population, since this is a selection-based definition and not a detected-fraud label.","section":"§8 and §10"}],"recommendation":"major_revision","confidential_remarks":"The manuscript would be a strong empirical contribution after the Section 8 re-analysis. The data are shared only on request, which limits reproducibility, though the released code and the detailed collection description mitigate this somewhat. The abstract versus conclusion inconsistencies (median price $157 versus $120; 211 versus 212 categories) suggest the paper was finalized in haste and that a careful pass over headline numbers is needed. The paper's scope fits the venue well. I would not reject: the census and taxonomy stand regardless of the Section 8 outcome, and the fix is within the authors' reach because they retain the raw data."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What you should know: this is a genuinely new measurement study, the first cross-platform census of social-media account trading. The authors crawled 11 public markets and 6 underground forums, found 38,253 advertised accounts with a combined asking price over $64M, and tracked 11,457 visible profiles across X, Instagram, Facebook, TikTok, and YouTube. Prior work was mostly Twitter-centric and smaller. The collection methodology is described in enough detail to be believed: seeds, crawler, API queries, manual underground collection. The per-platform price medians, seller geography, payment rails, and the six-family scam taxonomy are all useful descriptive findings. They also ship code and disclosed their results to the platforms, which is more than most papers in this space do.\n\nThe soft spots are real but mostly fixable. The biggest one is Section 8's 19.71% \"efficacy\" figure. The paper counts every inactive account (\"Not Found\", \"does not exist\") as platform action, while conceding in the same section that some owners voluntarily delete or rename accounts. That makes 19.71% an upper bound on platform takedowns, not a direct measurement. Calling this \"conservative\" is backwards: pooling owner-side disappearances inflates the apparent detection rate. The policy conclusion (platforms face challenges) probably still holds, but the number needs re-framing as an upper bound, and ideally a decomposition of the statuses plus a baseline takedown rate for ordinary accounts.\n\nSecond, the 18.7K scam-post count is a projection. They sampled 25 posts per cluster, labeled the cluster as scam or not, then counted every post in the cluster. That's fine as a qualitative taxonomy, but the quantitative total needs confidence intervals and reporting of the clustering hyperparameters and annotation agreement. Right now it looks more precise than it is.\n\nThird, there are internal inconsistencies: the median price is $157 in the abstract but $120 in the conclusion; the category count is 211 in the abstract and 212 in Section 4.1; and the \"median value of $7,573,348 across the platforms\" sentence is garbled. These are minor but sloppy.\n\nAlso, the abstract says \"bot farming\" as if directly observed; what they actually observed is high follower counts, which is evidence of engagement farming but not proof. The body hedges this correctly; the abstract overreaches.\n\nThis is a solid descriptive paper for security and cybercrime-economics readers. A serious referee should engage with it. The census itself is the contribution, and that part holds up. The efficacy figure is a secondary claim that needs revision, not a fatal flaw. Send it to peer review.","headline":"First cross-platform census of the account-resale economy, with real data and a plausible descriptive core; the 19.71% detection-efficacy headline is an upper bound, not a clean take-down rate.","tokens_in":20858,"tokens_out":3628,"would_cite":true,"duration_ms":36532,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that only 19.71% of social media accounts advertised for sale were inactive at collection time, an outcome it reads as weak platform enforcement.","keywords":["social media account trading","account marketplaces","scam taxonomy","fraudulent engagement","platform detection efficacy","underground markets","economic analysis of cybercrime","account lifecycle"],"falsifier":"Take a sample of the 2,259 inactive accounts and check whether a large fraction can be re-found under new handles or via archived snapshots using their stored metadata, such as the same profile description, email, or phone number; if many are re-found, the 19.71% figure would not be a valid measure of platform detection.","tokens_in":19590,"feed_emoji":"📉","tokens_out":7130,"duration_ms":54593,"temperature":0.7,"pith_summary":"This paper tries to establish that the buying and selling of social media accounts is a large, organized economy that platforms are mostly failing to police. Between February and June 2024, the authors counted 38,253 advertised accounts across 11 marketplaces, with combined asking prices above $64 million and a median price of $157 per account. They then tracked 11,457 accounts whose listings included a visible social media link, collected public metadata and more than 200,000 posts, and classified 18,792 of those posts into six scam families. The headline finding is that only 2,259 of the 11,457 tracked accounts (19.71%) were inactive at collection time, which the authors interpret as the platforms' detection efficacy. A sympathetic reader would care because the result implies that roughly 80% of advertised accounts were still live, leaving a ready stock of aged, follower-rich profiles available for fraud.","feed_headline":"Just 19.7% of advertised social media accounts are blocked","feed_subtitle":"A census of 11,457 listed accounts across 11 marketplaces shows most remain live at collection time.","key_machinery":"The argument is carried by a three-stage measurement pipeline: a crawler that collects listings from 11 public marketplaces; platform API queries that recover public metadata and posts from the 11,457 advertised profiles that link to a social media handle; and a topic-modeling stack that embeds the 205,583 posts, reduces their dimension, clusters them into 86 groups, and leaves 16 clusters for manual vetting into six scam families. The load-bearing measurement is the account status check: each advertised profile is queried through the platform API, and the returned status — 'Forbidden', 'Not Found', 'Page Not Found', or 'does not exist' — is coded as inactive, producing the 19.71% efficacy figure.","core_discovery":"The paper asserts that this is the first large-scale empirical study of marketplaces selling social media accounts on X, Instagram, Facebook, TikTok, and YouTube, and its central measurable claim is a detection gap: of 11,457 advertised accounts with visible profile links, only 2,259 (19.71%) were returned by platform APIs as forbidden, not found, or nonexistent, and the authors count all of those as platform deactivations or blocks. The supporting census claims are that the 38,253 advertised accounts represent over $64 million in combined asking price, that these accounts are pre-tailored to mimic organic profiles, and that their posts cluster into six scam types: financial scams, engagement bait, phishing, product and service fraud, adult content, and impersonation. The conclusion the authors draw is that platforms face challenges in detecting and mitigating this threat, leaving users exposed to fraudulent accounts that resemble legitimate profiles.","pith_inferences":["An implication the paper leaves implicit is that the 19.71% figure is best read as an upper bound on platform enforcement, because 'Not Found' and 'does not exist' statuses also cover sellers renaming or deleting accounts before transfer; the true takedown rate could be lower.","A testable extension suggested by the data is to re-contact the same handle cohort after a fixed interval and measure how many statuses change, which would separate voluntary deletion from platform action.","A natural next study would link purchase timestamps with post-sale behavior changes such as location, device, and posting frequency to measure how quickly bought accounts are repurposed for scams, a step the paper's cross-sectional design does not take.","The marketplaces' payment mix, preferring cryptocurrency and digital wallets over traditional rails, implies that payment-sided monitoring, such as flagging addresses tied to these marketplaces, could complement platform-side takedowns."],"forward_implications":["If the 19.71% figure holds, roughly 9,200 of the 11,457 tracked accounts were still live when the census ended, meaning marketplace-advertised profiles are a substantial ready inventory for fraud.","The six scam families give platforms concrete signals to monitor: crypto and NFT narratives, like/follow/subscribe bait, and impersonation of public figures are the most frequent patterns among the 18,792 scam posts.","The price and follower distributions imply sellers invest in niche appeal such as humor, luxury, gaming, and fashion, so detection that only targets trending topics will keep missing a large share of traded accounts.","The per-platform spread — TikTok and Instagram near 46-48%, X near 19%, Facebook and YouTube near 5% — suggests enforcement is uneven and that a uniform detection benchmark would be a useful next step."],"supporting_citations":[{"why":"Prior work showing underground markets supply fraudulent Twitter accounts; the paper's census of marketplace-sold accounts builds on this baseline.","marker":"[57]"},{"why":"Early analysis of Twitter follower markets; provides the comparative baseline for studying account-selling marketplaces.","marker":"[53]"},{"why":"Measurement of follower market growth and dynamics; supplies prior marketplace sources and comparison for seller behavior.","marker":"[55]"},{"why":"Topic-modeling library used to group the 205,583 collected posts into clusters prior to manual scam classification.","marker":"[27]"},{"why":"Dimensionality reduction used in the clustering pipeline that yields the 86 post clusters.","marker":"[37]"},{"why":"Clustering algorithm that forms the post clusters from the embedded text.","marker":"[36]"},{"why":"Pretrained sentence transformer that produces the post embeddings fed into the clustering pipeline.","marker":"[7]"},{"why":"Keyword extraction used to refine and label candidate scam clusters.","marker":"[26]"}],"fun_headline_variants":["Only 19.7% of sold social media accounts get blocked","$64M market in social accounts, most escape bans","38k accounts on sale, 80% still live after listing","Scam-engine accounts: platforms catch fewer than 1 in 5","First census of account-selling market reveals fraud risk"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result depends on treating API status messages like 'Not Found' and 'does not exist' as evidence that the platform removed the account, when those same messages can also mean the owner renamed or voluntarily deleted it.","fun_headline_variants_meta":{"raw":{"variants":["Only 19.7% of sold social media accounts get blocked","$64M market in social accounts, most escape bans","38k accounts on sale, 80% still live after listing","Scam-engine accounts: platforms catch fewer than 1 in 5","First census of account-selling market reveals fraud risk"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000441,"raw_usage":{"total_tokens":2272,"prompt_tokens":1017,"completion_tokens":1255,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":633,"completion_tokens_details":{"reasoning_tokens":1170}},"tokens_in":633,"tokens_out":1255,"duration_ms":9162,"temperature":1.0,"reasoning_tokens":1170,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T11:44:44.088196+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a sample of the 2,259 inactive accounts and check whether a large fraction can be re-found under new handles or via archived snapshots using their stored metadata, such as the same profile description, email, or phone number; if many are re-found, the 19.71% figure would not be a valid measure of platform detection.","supporting_citations":[{"cited_title":"{Trafficking} fraudulent accounts: The role of the underground mar- ket in twitter spam and abuse","cited_arxiv_id":null,"evidence_quote":"Prior work showing underground markets supply fraudulent Twitter accounts; the paper's census of marketplace-sold accounts builds on this baseline."},{"cited_title":"Poultry markets: on the underground economy of twitter followers","cited_arxiv_id":null,"evidence_quote":"Early analysis of Twitter follower markets; provides the comparative baseline for studying account-selling marketplaces."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Measurement of follower market growth and dynamics; supplies prior marketplace sources and comparison for seller behavior."},{"cited_title":"HDBSCAN: Hierarchical Density Based Clustering","cited_arxiv_id":null,"evidence_quote":"Clustering algorithm that forms the post clusters from the embedded text."},{"cited_title":"https://huggingface.co/sen tence-transformers/all-mpnet-base-v2","cited_arxiv_id":null,"evidence_quote":"Pretrained sentence transformer that produces the post embeddings fed into the clustering pipeline."}],"review_version":1}