How does the online marketplace enforce that identifier in the provided NFT corresponds to hardware id of the card? How do you prove that said NFT is issued by

How does the online marketplace enforce that identifier in the provided NFT corresponds to hardware id of the card? How do you prove that said NFT is issued by OEM? How do you avoid NFTs being issued by the seller themselves?