Stop Fraud Before It Executes: A Deployable 25-Step Security Architecture for EU Online Marketplaces

The European Commission's investigation announced on 21 October 2026 concerning fraudulent accommodation listings, phishing scams, and advertising transparency under the Digital Services Act (DSA) raises a fundamental engineering question: Can Very Large Online Platforms prevent unauthorized consequential actions before they affect consumers, rather than relying primarily on fraud detection and remediation afterward? This technical proposal presents a 25-step, end-to-end marketplace fraud-prevention architecture addressing three representative threats: (i) fraudulent accommodation listings promoted through paid search rankings; (ii) compromised accommodation-provider accounts sending unauthorized payment requests to genuine customers; and (iii) substitution of payment beneficiaries after an otherwise legitimate transaction has received upstream authorization. The architecture integrates Virtual Identity–Compliance Jurisdiction Binding (VI–CJT), Communication Validation (CVID), Protected Enforcement Domains, execution-time Finality Sink verification, algorithmic accountability, and distributed revocation. Its central mechanism distinguishes authentication and upstream approval from authority to produce the actual consequential effect. Operations involving listing publication, message dispatch, payment execution, and advertising presentation are checked against applicable identity, authorization, transaction, and policy state at their respective enforcement boundaries. Technical feasibility is a principal focus. The proposed mechanisms can be implemented using technologies available today, including API gateways, cryptographic identity services, policy engines, transactional databases, message brokers, and existing payment infrastructure. The design separates expensive onboarding and fraud investigation from lightweight, operation-specific enforcement, allowing incremental deployment without wholesale replacement of legacy systems. Illustrative additional p95 latency targets include 10–40 milliseconds for protected messaging, 15–60 milliseconds for payment verification, and 20–80 milliseconds for listing publication, excluding external processing. These are proposed engineering targets, not experimentally verified performance results. The article examines conventional-control limitations, implementation workflows, interoperability, scalability, revocation, fail-closed behavior, and adversarial testing. It also identifies potential engineering contributions toward systemic-risk mitigation and advertising transparency under DSA Articles 26, 34, and 35, without claiming automatic regulatory compliance. The principal contribution is a technically implementable prevention model: verify the actual operation at the boundary where it becomes effective, rather than assuming that an authenticated identity or earlier approval is sufficient. The proposal is presented for independent technical examination by European policymakers, Digital Services Coordinators, Very Large Online Platforms, security architects, and researchers. It does not allege established wrongdoing by any platform or claim that complete marketplace fraud prevention has been demonstrated. Runnable GitHub Reference Implementation — Invitation to Engineers To support independent technical examination and reproducible validation, a runnable multi-language reference implementation (Python, Go and JavaScript) is publicly available on GitHub, accompanied by 200 automated tests, execution results, implementation documentation and a non-commercial research license. The implementation demonstrates selected VI–CJT, CVID, Finality Sink, phishing-prevention, payment-integrity, advertising-transparency and revocation mechanisms. Security engineers, platform architects, researchers and trust-and-safety teams are invited to clone the repository, run the tests, examine the enforcement logic, identify limitations and provide technical feedback. The code is a research reference implementation rather than a production-certified platform solution. GitHub: https://github.com/sangmdas/DAS-Marketplace-Fraud-Prevention-AI-Security-Phishing-Protection-Execution-Finality