The Shadow Sales Channel

The channel runs on accounts you already issued

Removing a reseller's storefront need not stop delivery: the underlying account may still work, and another sales entry point can take its place. The operational question is which accounts supply the channel, and what happens when that supply is interrupted.

It runs like a sales channel. Storefronts bring buyers in. Private chats close sales and handle renewals. Relay sites let many buyers use the product through a single account.

The payment goes to the reseller, while the product is delivered through access originally issued by the brand. Some buyers may be potential direct customers; their willingness to switch to an official plan needs separate evaluation.

For paid-account supply, repeat replacement can raise the seller's acquisition cost. Account survival after resale is therefore worth measuring alongside replacement cost, supply availability and retained buyer revenue—not just the number of accounts banned.

Scope and evidence This method brief draws on the qualitative monitoring and test-purchase observations described in the source material. It does not provide a reproducible sample or observation window, so it establishes neither prevalence nor measured intervention effectiveness. Section 3 is an illustrative scenario, not observed pricing or a universal shutdown threshold.

1 Recognizing a shadow sales channel

Listings offering shared access, group buys or team seats can indicate a secondary sales channel. Offers may advertise discounted access, renewals, support or replacements. Verify what is actually delivered and whether the seller is authorized before treating an offer as unauthorized resale.

The core issue is the resale of access to the real service: a login or a seat on an account the brand originally issued. That differs from selling a counterfeit product.

The framework is relevant to account-based services such as B2B SaaS, AI tools, creative software, developer tools and streaming. Internal usage data alone may not identify who sells the access, which accounts feed it or how many buyers are involved.

2 How the channel works

The channel has three parts, and each one looks a lot like its legitimate equivalent. Figure 1 shows supply leaving the brand's system, and the point at which it can be switched off.

Enlarge

Supply: where the accounts come from

Different sources have different economics for the seller. They should not be treated as a single problem with a single fix.

1. Team seats. A team or business plan is bought and sold seat by seat. The seller usually pays for a real plan. Profit depends on how many seats can be resold and how long the plan remains usable.
2. Free trials. Trial accounts are registered in volume, used until they expire, then replaced. The account itself costs the seller almost nothing. The lever is making bulk registration hard, not only shutting accounts after they have been sold.
3. Regional and discount pricing. Accounts are bought where they are cheaper — for example in lower-priced regions or through education offers — and resold elsewhere. Acquisition still usually costs money, but less than the list price.
4. Compromised accounts. Supply may also come from accounts taken over from paying customers. Account recovery and protection of the legitimate owner take priority. The seller's acquisition cost can differ from that of a paid plan; no share of this supply route is estimated here.

Distribution: how buyers are found

Marketplace and second-hand storefronts bring in buyers through search. Private chats and community groups close the sale and handle renewals; this is where repeat business is usually kept. Social and content platforms attract new buyers through tutorials, “how to get it for less” posts and referral promotions. Underground markets supply sellers with accounts wholesale.

Delivery: how buyers get in

• Handed-over logins. The buyer receives credentials, sometimes with a request not to change any settings.
• Relay and mirror sites. A site sits between the buyers and the real product, so a number of buyers can use one account without each of them logging in. From inside the brand's system, this often looks like one heavy paying user. These sites exist to make device and location checks less able to see how the account is really being used.
• Browser extensions or ready-made sessions. The buyer uses the product through an extension or an already open logged-in session, without holding credentials they can reset themselves.

The groups behind this are organized. A single group may run storefronts on several platforms, a private renewal channel and a relay entry point at the same time. When one storefront is removed, the others keep selling, and replacements may appear under new names.

Enlarge

3 How sellers make money

The following scenario isolates replacement spending while holding buyer revenue constant. Both editions use identical illustrative units, without a currency or exchange-rate conversion.

• One account serves 20 buyers paying 15 each per four-week month: revenue is 300 per month, or 1,800 over 24 weeks.
• Each purchase or renewal costs 100 for four weeks of access. Early shutdown forfeits unused time; no refund or credit is applied.
• The horizon is [0, 24) weeks. Pay first at week 0, then at each replacement or renewal strictly before week 24. Do not buy again at the endpoint.
• Replacement is immediate, resets the four-week billing clock and costs the same. Supply is always available. No buyer churn, revenue interruption or other operating expense is modeled.
• For shutdown cadences d = 1, 2, 3 or 4 weeks: N = ceil(24/d), cost = 100N, modeled profit = 1,800 − 100N. Without shutdown, renew at weeks 0, 4, 8, 12, 16 and 20.

For example, weekly replacement pays at weeks 0–23 (24 purchases); a three-week cadence pays at 0, 3, …, 21 (8 purchases). These profits are revenue minus account spending only, not net business profit.

Enlarge

What the model implies

The scenario shows a cost mechanism, not a forecast. Actual profit depends jointly on account cost, replacement availability, resale revenue retained and other operating expenses. A shutdown need not cause buyer churn. Where trial supply has little acquisition cost, bulk-registration controls address a different lever from shortening paid-account life.

4 What it costs you

1. Revenue. These buyers use the product and may keep paying — just not to you.
2. People who might have been your customers. Some buyers may fit the target market, but resale spending is not automatically recoverable revenue. Direct conversion must be measured separately.
3. Capacity and data. One account shared across many users can mean unusually heavy usage or bulk exports. For a data product, it can also mean systematic extraction of the very thing you sell.
4. Security and compliance. Accounts pass between people you have never verified. It is hard to know who is using them, or for what.
5. Distorted metrics. Activity, regional demand and conversion rates can be polluted, which then feeds into pricing and market decisions.

5 Why the usual defenses often fall short

Login and location checks can constrain casual sharing, but a relay can aggregate demand behind one account. Heavy legitimate use can resemble resale, so usage anomalies require investigation. Storefront removal and legal action address different parts of the channel; neither alone identifies all accounts supplying it.

Combine external sales evidence with internal account records. Account action, platform complaints and legal remedies can complement one another; the appropriate response depends on verified conduct, account ownership and applicable terms.

6 An account-level intervention loop

Resold access ultimately depends on accounts in the brand's system. Confirm the account behind an offer before acting, distinguish unauthorized resale from permitted sharing and protect legitimate users. For paid supply, the timing and repeatability of intervention can affect replacement spending.

That takes an outside-in view, run as a continuous loop:

1. Monitor marketplaces, private chat groups, social platforms and underground markets.
2. Investigate high-value sources through test purchases, confirmed back to exact account identifiers.
3. Act. After verification, apply proportionate account restrictions under the relevant terms, with recovery or review for legitimate users. Platform complaints may help suppress infringing storefronts; removal decisions rest with each platform.
4. Recheck with repeat purchases to confirm the effect, and follow groups as they switch entry points and templates.

The aim is not to remove one store or one site. It is to raise the ongoing cost of reselling your product, so the trade is harder to make pay. Where free sign-ups feed the supply, add checks at registration that make bulk creation harder, so accounts meant for resale are more difficult to obtain in volume before they are used.

Enlarge

How to tell it's working

The measures below are suggested directions to watch. They are not results measured in this brief.

7 Is your product already being resold? A 12-point check

These are investigation leads, not a diagnostic score. Listings may be misleading or authorized; heavy usage and weak conversion have other explanations. Correlate outside offers with verified delivery and account records before concluding that unauthorized resale exists or estimating its scale.

Outside signals: what you can see from the outside

1. Searching a marketplace or second-hand platform for your brand plus “shared”, “group buy”, “team seat” or “membership” returns listings.
2. A website offers access to your product as a “relay”, “mirror” or “one account, many users” service, with an interface that copies or embeds yours.
3. Someone in a private chat, Telegram or Discord group sells monthly or yearly access to your product, with renewals.
4. Social or content platforms carry “how to get it cheap” tutorials or promotions for your product.

Account signals: what you can see in your own system

1. A small number of accounts log in from far more devices, networks or regions than normal users, or move between regions.
2. Single accounts are in use almost around the clock, with usage far above others on the same plan.
3. Team seats are always full, members change often, or member emails follow near-identical patterns.
4. Free trial sign-ups cluster around certain phone-number ranges, address ranges or email domains, and heavy usage starts right away.
5. After you ban a batch of accounts, similar ones reappear quickly.

Business signals: what shows up in your numbers and your teams

1. Some regions show strong traffic or brand search but unusually weak paid conversion.
2. Support receives tickets such as “the account I bought elsewhere stopped working”.
3. Prospects tell sales they “already use it”, but no paid account matches.

8 Where to start

Start with a bounded investigation and an agreed review process. These five steps help establish what is happening and how to evaluate a response.

1. Run the 12-point check. If any outside signal applies, treat resale as a sales channel that may already be running.
2. Map your supply routes. Team seats, free trials and regional pricing each feed resellers differently, and each needs its own response.
3. Give it one owner. Resale sits between revenue, Trust & Safety and security, which is why it often belongs to no one.
4. Measure how long resold accounts live after they are sold. Ban counts alone do not show the economics. The more useful numbers are how quickly an account is shut down after it is sold, and whether the seller can still replace it quickly.
5. Get an outside-in view. You cannot switch off what you cannot see. Watch where your product is sold, and trace it back to the accounts behind it.

See your own exposure

Discuss an exposure review with Threat Hunter: visible sales entry points, evidence gaps and the account-level questions that need verification. Agree the scope and evidence requirements before drawing conclusions about scale or revenue impact.

threathunter.com ↗ · Contact: tim@threathunter.com

About this brief Prepared for revenue, Trust & Safety and security teams. Figures 1, 2 and 4 are structural or method schematics; Figure 3 is an illustrative economic scenario. No customer or victim brand is identified.