ACCOUNT WAS HACKED, BANK NUMBER CHANGED

[CatherinePlante]

Hi

Someone hacked my account 3 days ago and changed my deposit method. They have set up 2 step authentication but i don't receive the codes. I've been able to log in anyway with my phone but I can't turn the 2factor down without accessing the code. I also tried to update the deposit bank info to put back again my bank number, but the system won't let me without knowing the complete hacker's bank number (-__-).

Does anyone have any suggestions?

I've contacted Etsy support and the responses were not helpful and now they don't answer me anymore. I've seen some people received more help by posting on the forum than contacting Esty Support directly so I try my luck here.

Please help!

[catfluff]

sadly we are just sellers like you in the forums.  I do not understand why Etsy is not taking these hackings seriously they are  dime a dozen these days.  Between here and FB groups not a day is going by that somebody hasn't gotten hacked. And yet nothing out of Etsy.   If this is as common as it is then 2 FA should be compulsory for all shop owners.  And a dedicated team to help shops who do get hacked, this doesnt look good for Etsy as a company if they can not be trusted to keep the site safe.

[CatherinePlante]

Yes, their help support is pretty much inexistant.. I looked at a lot of forum posts with the same situation and some appears to received help from etsy just because of their post here, that's why I tried. Contacting them directly is a nightmare since they seem to have no humain behind their emails and take days or more to respond... If I can't get help from them I'm thinking switching for and other website host, but I don't know if it's safer or if the problem comes from me elsewhere so.. we'll see.

[hopeandjoystudios]

how does this happen with all the Plaid verification bullcrap we had to go through? Or are they just hacking, verifying a new bank account and moving on? ( I would not make a good hacker)

[CappuccinoLace]

OP's in Canada, no plaid there.

[ChristmasIsLove]

To change your bank account, the person needed your previous bank account number. That means either it was someone who has access to your computer/device or financial information, or someone who hacked your computer and obtained your bank account number that way. This was more than a hack of your Etsy shop. A person who hacked only your Etsy shop could not get your bank account number that way, as it is encoded. You may have given access to your computer through a phishing email or another means.

Run a virus scan and malware scan. Check other devices you have for hacking as well. Change all the account passwords you can, especially those that access personal and financial information.

At least it looks like Etsy (or you?) have put your shop on vacation, so there are no deposits to go to the fraudulent account. You will have to work with Etsy to get your account restored. But you should identify the source of the hack before you do that, since the person has more than just access to your Etsy account.

[catfluff]

are you sure they need the  bank account? I'm not sure that is true.  I dont want to go into my account and play with it to find out ,  LOL.

[CappuccinoLace]

@catfluff  in order to change the bank account on file, you have to enter the full account number of the current account on file.

It's a security measure.

This is why hacking on this level is a bit insane.

[nineteen27]

yes they need the full bank account number in order to change it.

that is why it is not etsys fault when an account has been hacked.

[ThePurplePuppy]

I always wonder how  a bank account can be redirected by a hacker on Etsy since you MUST have the old account number and enter it first before entering the new. And yes, you do need this info.

I have always suspected these people have clicked on something and it is the computer that is infected , not just Etsy. Even in that case they would have to  have entered their BA number somewhere in order for a keystroke program to have picked it up.  (Or maybe I don't understand hacking since I am so old! LOL)

The point is, I  just don't understand how this can be happening otherwise.

[CatherinePlante]

Thanks! Yes I have been able to put it in vacation at least. I ran a virus scan and it doesn't seem to be a virus, I really don't understand how they got my bank info.. 

[AmoreTreasure]

Must have the old bank number to change IF Etsy's software is working as it should.  Certainly not out of the question that the hacker has found some sort of bug in the software.

[catfluff]

so how do these hackers get the bank account info, and why is this happening daily here?

[CraftyCornishMaids]

It's either someone they know

or they have a keystroke virus

with millions of sellers, this will happen daily

[FallenAngelBrass]

My understanding of this kind of "hacking" is that it's usually a person known to the Etsy shop owner. 

[ThePurplePuppy]

@CraftyCornishMaids 

I too thought of a keystroke program on the computer--but even so--the hackee would have had to have typed out their bank account number in full somewhere in order for even that to have picked it up.  

Do people do this? I have NEVER typed out my bank account number anywhere on the computer EXCEPT when  entered it for Etsy. (I do not do online banking- but even then one only types out a user name and password)

[nineteen27]

here is one way:

usually from sellers who have not secured their own email address.

and/or they receive phishing emails from fake etsy email addresses saying they need to change something in their account and click on a malicious link and enter their banking information.

and then chaos.

[ThePurplePuppy]

@nineteen27 

That is why I NEVER NEVER click on those type of links--and I don't even click on any links posted here in the forum. 

[CatherinePlante]

I never typed my bank number anywhere other than on Etsy and I'm always very mindfull of suspicious emails that I put in trash right away. I really don't understand what could have happened. I changed my password everywhere but I don't know if it's enough. Gonna call my bank Monday to be sure, though they didn't steal me money or whatever (yet..)... Thanks so much for your responses, it's cheering me up a bit at least.

[catfluff]

 basically  keystroke virus would give them access to login into many different accounts correct? . But I do not write  my bank account number into the computer  like ever so they wouldnt have that number .  But  theoretically they  get into your bank account with your login  and get your account number  but at that point why not take all your money what is the point of  hacking an etsy account?   Somebody explain this?  Like its so easy to Zelle somebody from my Bank account .

[ThePurplePuppy]

@catfluff 

Yes, if  one had a keystroke logger on the computer I would think there would be a lot bigger fish to fry than hacking an Etsy account!

[catfluff]

@ThePurplePuppy  exactly i never write my account number out, well I did for Plaid  verification.  HMMMMM

[ThePurplePuppy]

@catfluff 

Yes, the only time I have done it was originally signing up for Etsy and then for Plaid. That is the only times a keystroke logger could have grabbed it. 

[TheGlowingSkin]

I don’t know what the OP’s situation is but since the pandemic started, financial hacking has become a major commerce around the world. My credit card was hacked thrice in 2020, purchases started showing up in Hungary and Russia and I have never even been to either country other than a layover in Moscow when we lived in London. Amazon accounts are getting hacked almost every day in this holiday season so it’s high time Etsy instituted a 2 person authentication for all compulsorily. Please call your bank OP and let them know what is happening.

[ThePurplePuppy]

@TheGlowingSkin 

IF Etsy made it compulsorily then it would eliminate anyone who did not own a cell phone--and I know a LOT of us elderly do not. I did not get one until last year after our wildfire. I still have trouble using it, even tho I am fairly adept with a computer. 

I did once try 2 step verification with an account (not Etsy) and never received the verification codes until AFTER they expired--they are only good for a few minutes.

So doing that would eliminate a lot of us sellers, I suppose.