A Deep-Discount Seller Appears Overnight: Diversion, Counterfeit or Old Stock?

Signals to watch

• price anomaly below authorized floor
• mismatched packaging generation
• unknown seller with high stock depth

It starts with a screenshot forwarded by a regional distributor. A product you recognize — your brand’s SKU — is listed at 40 % below the authorized minimum advertised price. The product image shows packaging that looks almost right, but not quite. The store name is unfamiliar. The stock count suggests hundreds of units.

You have seen this before. The usual instinct is to react fast: send a cease-and-desist, file a platform takedown, or order a test purchase. But none of those moves will tell you whether the seller is offloading diverted old stock, running a counterfeit operation, or simply clearing legitimate inventory through an unapproved channel. You need an evidence chain — a structured way to connect price, packaging, seller identity, and batch data into one decision.

The Cost of Acting on a Fragment

Every brand protection lead knows the feeling of chasing a ghost. A single data point — low price, odd packaging — triggers an investigation. You spend budget on a test purchase, wait for delivery, open the box, and discover genuine product that simply entered the market through a route you cannot explain with the evidence you have. The test purchase cost is sunk. The platform complaint is dismissed for lack of proof. The seller stays live.

The opposite scenario is worse: you dismiss the alert because the price anomaly could be a legitimate promotion, only to see identical complaints multiply across three marketplaces two weeks later. By then, the counterfeit run has already scored hundreds of sales, and your brand’s return rate in that region spikes.

The common thread is the same: price, packaging, seller identity, and batch information lived in separate mental buckets. No one had connected them into a single evidence chain.

Why a Single Clue Is Never Enough

The reflex to escalate from a single signal is understandable — brand protection teams are understaffed and alerts are abundant. But platform takedown systems are built on evidence, not suspicion. A marketplace will ask: can you prove this unit is not genuine? Can you prove this seller is unauthorized? A screenshot of a low price does not answer those questions.

Price alone is ambiguous. The seller may have acquired end-of-life stock through a liquidation channel your company does not track. Packaging alone is suggestive, but counterfeiters routinely copy genuine packaging down to the hologram. Seller identity alone is meaningless without knowing whether the entity is a known distributor’s secondary account or a completely new actor.

The only way to escape this ambiguity is to build a cross-dimensional evidence chain before you decide what to do.

The Suspicious-Seller Evidence Chain Method

The evidence chain method organizes four investigative dimensions into a single worksheet. Each dimension receives a finding, and the routing decision falls out of the combination.

Dimension 1: Price Position. Record the seller’s listed price, the authorized floor price for that SKU in that region, and any historical price data from the same marketplace over the past 90 days. A price below the authorized floor is suspicious; a price below cost of goods is a strong signal.

Dimension 2: Seller Identity. Check the store registration details — business name, address, registration date — and cross-reference against your authorized distributor list. Search for the same seller name across other platforms. A seller that registered two weeks ago with a residential address listing 500 units of your premium SKU is a different risk profile than an established electronics retailer you simply do not have a contract with.

Dimension 3: Packaging Generation. Compare the listing images against your current packaging specifications. Look for seal placement, batch code font, carton dimensions relative to the product image, and any obsolete logo or regulatory mark. If the packaging matches a generation you discontinued 18 months ago, the seller may have acquired old genuine stock — or a counterfeiter using outdated reference photos.

Dimension 4: Batch Trail. If the listing images show a readable batch code, check it against your ERP or quality system. A valid batch code that was shipped to a known distributor in another region points to diversion. An invalid or duplicated batch code points to counterfeit. No visible batch code is itself a finding.

Evidence Chain Worksheet — Quick Reference

Dimension	Green Signal	Yellow Signal	Red Signal
Price	At or above authorized floor	10-30 % below floor	Below cost of goods
Seller Identity	Known authorized distributor	Known entity, not under contract	New seller, no paper trail, recent registration
Packaging	Matches current generation	Minor cosmetic deviation	Obsolete generation or obvious mismatch
Batch Trail	Valid code, expected destination	Valid code, unexpected destination	Invalid, duplicate, or missing code

A row with three or more yellow or red signals triggers a test purchase. A row with mixed green and red requires channel investigation before escalation. All-green findings with one yellow can wait for a secondary confirmation.

Routing the Decision

Once the worksheet is populated, the routing decision becomes mechanical.

Route A — Test Purchase applies when the evidence chain shows two or more red signals. You need physical verification. Order one unit from the seller, document the unboxing against your packaging spec, and if the unit is counterfeit or materially different, submit the evidence package to the platform with a takedown request.

Route B — Channel Investigation applies when the seller identity is the only red signal, but price, packaging, and batch trail are green or yellow. The product is probably genuine but diverted. Investigate which authorized distributor could have supplied this seller. Common leakage points include overproduction allowances, employee purchase programs, and regional distributors who sell outside their territory.

Route C — Platform Complaint without Purchase applies only when the listing itself violates platform policy in a detectable way — for example, the listing uses your trademarked images without authorization or claims a discount that violates the platform’s pricing policy. File the complaint on policy grounds, not on authenticity grounds.

When an Old Stock Investigation Becomes a Deeper Problem

The ambiguous case — the one that keeps brand protection leads awake — is the seller with a deep discount, packaging that looks one generation old, and a seller name that rings no bells. That combination could be a distributor quietly liquidating aged inventory through a shell account, or it could be a sophisticated counterfeiter who sourced an old packaging sample.

The evidence chain method does not resolve the ambiguity by itself. What it does is give you a documented basis to escalate to a test purchase without second-guessing. The worksheet becomes the first page of your investigation file. When the test purchase arrives and the product is counterfeit, the evidence chain shows exactly which signals triggered the decision. When the product is genuine diverted stock, the same worksheet guides the channel investigation.

For teams that manage multiple marketplace alerts simultaneously, the method also prevents decision fatigue. You stop evaluating each alert from scratch. The worksheet applies the same threshold every time. Consistency across cases means your platform complaint success rate improves because every submission is backed by the same documented process.

Key Takeaways

• A single signal — price, packaging, or seller identity — is never enough to route an investigation. Cross-reference all four dimensions before deciding.
• The evidence chain worksheet transforms scattered screenshots into a documented, repeatable decision framework.
• Routing falls into three categories: test purchase (red signals dominate), channel investigation (seller identity is the sole red flag), or platform complaint on policy grounds.
• For teams managing cross-border brand protection, pairing the evidence chain method with Telegram business signal frameworks helps surface unauthorized sellers before they scale, while Telegram source governance provides a structural view of supply-side leakage points that the evidence chain alone cannot reach. For teams requiring continuous cross-platform monitoring, signal intelligence capabilities can automate the first two dimensions of the chain at scale.

FAQ

What is the minimum evidence needed before escalating a suspicious seller to a test purchase?

At minimum, complete the Identity + Price + Packaging columns of the evidence chain worksheet. A test purchase should only be triggered when the seller identity cannot be resolved to any known authorized distributor, the price sits below the authorized floor, and the packaging shows at least one visible generation mismatch (e.g., missing seal, outdated batch code format, or non-standard carton). Initiating a test purchase without these three columns creates wasted budget and exposes your investigation timeline.

Can the evidence chain method distinguish between diverted genuine stock and counterfeit product?

The evidence chain method itself does not make that final distinction — it routes the case to the appropriate next step. If the seller identity resolves to a known but unauthorized distributor and the packaging appears genuine (no generation mismatch), the routing decision is diversion investigation. If the packaging shows clear generation anomalies and the identity is opaque, the routing flips to counterfeit test purchase. The method’s value is removing guesswork from that routing fork.

How often should the common signal patterns be updated?

Update the regional signal patterns at least once per quarter and after every major platform policy change. Counterfeiters and diverters adapt their listing language within 48-72 hours of a crackdown, so the keyword and image signal bank needs constant refreshing. Assign one team member per region to scan and update the signal patterns; rotate the assignment monthly to avoid pattern fatigue.

What if the listing does not show a batch code in the product images?

Absence of a visible batch code is itself a valid finding in the Batch Trail dimension. Record it as a yellow signal and proceed to complete the other three dimensions. If the price, seller identity, and packaging collectively show two or more red signals, proceed with the test purchase regardless of the missing batch code. During the physical unboxing, document the batch code from the actual unit — that single data point will often determine whether the case routes to counterfeit enforcement or diversion investigation.

---

Sources

Frequently asked questions

What is the minimum evidence needed before escalating a suspicious seller to a test purchase?

At minimum, complete the Identity + Price + Packaging columns of the evidence chain worksheet. A test purchase should only be triggered when the seller identity cannot be resolved to any known authorized distributor, the price sits below the authorized floor, and the packaging shows at least one visible generation mismatch (e.g., missing seal, outdated batch code format, or non-standard carton). Initiating a test purchase without these three columns creates wasted budget and exposes your investigation timeline.

Can the evidence chain method distinguish between diverted genuine stock and counterfeit product?

The evidence chain method itself does not make that final distinction — it routes the case to the appropriate next step. If the seller identity resolves to a known but unauthorized distributor and the packaging appears genuine (no generation mismatch), the routing decision is diversion investigation. If the packaging shows clear generation anomalies and the identity is opaque, the routing flips to counterfeit test purchase. The method's value is removing guesswork from that routing fork.

How often should the common signal patterns be updated?

Update the regional signal patterns at least once per quarter and after every major platform policy change. Counterfeiters and diverters adapt their listing language within 48-72 hours of a crackdown, so the keyword and image signal bank needs constant refreshing. Assign one team member per region to scan and update the signal patterns; rotate the assignment monthly to avoid pattern fatigue.

Sources and further reading

1. OECD Digital Economy Outlook 2024
2. WTO Global Trade Outlook and Statistics