Hacked account, random listings, poor Etsy customer service

[iknowmyselfjournal]

Yesterday, I started receiving a series of Cha-Ching! notifications on my phone, which raised some concerns. Given that I hadn't been actively using the platform and had only listed one item, I was puzzled by the sudden surge in sales notifications. Upon logging into my account, I discovered a total of 27 active listings that I had not created myself. I immediately reached out to customer service, changed my password, deactivated the unauthorized listings, and conducted a thorough check of my bank details and address. Fortunately, everything appeared to be in order.

During the night, I received a two-factor authentication notification, indicating that an attempted breach of my account had occurred. I hoped that the hackers were unsuccessful in their efforts. In response to this security breach, I engaged with Etsy's customer service through both live chat and email, but unfortunately, I have yet to receive any response, despite it having been a full day since I reached out. 

I am left wondering how the perpetrators managed to create listings on my account and how they planned to receive payment for these sales, considering there had been no alterations to my bank details. I am also puzzled as to how they gained access in the first place, especially since I had two-factor authentication enabled, which had never prompted notifications until I changed my password yesterday. These were downloadable sales that they had created. I am super confused and frustrated with Etsy's poor customer service.

[NanaLetha]

https://help.etsy.com/hc/en-us/articles/115015654008-What-to-Do-if-You-Suspect-Fraud-in-Your-Etsy-Ac...

[ZehOriginalArt]

Yes, that makes me wonder as well - how they get in with the 2FA set up. Another forum member made a post about this back in July: How Attackers Bypass Two-factor Authentication (2FA)

[JDTotesnDolls]

2FA is not perfect.  If the hackers have email, they can break 2FA.  It's still will slow them down but it is not a complete deterrent.

[JDTotesnDolls]

2FA is not a complete deterrent.  It is good to have but it is also possible for the hackers to set up their own 2FA.

Have you checked out your computer?  Your phone?  Is security high on your phone?   Have you run anti-virus?  

Are you working now from a clean device?

Have you changed passwords from a clean device to your bank and anything else that is sensitive.

I don't see listings in your shop other than your own.

Your email can be hacked.  Social media can provide clues to hackers making it easy for them to discover how to get in. If you use a credit card for gasoline, skimmers can pick up credit card information and use it to get even more information.  Facebook or other social media that contains family or personal information ought to be more private and comments restricted.  It's easy for hackers to get all sorts of information. 

Just know even the best people can get hacked.  All you can do is pick up the pieces.

Do you visit your shop daily?  Add new items?  Your shop policies are not UK compliant.   One thing hackers may look for are shops without a lot of activity.  Shops not quite finished. 

[nta58flx9piiejnb · Accepted solution]

Hi there @iknowmyselfjournal 

Sorry to hear about your circumstances, your case has been escalated internally to our account specialists who have assisted with resolving the matter.

Thanks!