Multiple Erroneous Transactions

[ForeverAgoStudio]

It is just gone 12:30 am.  From midnight, my phone has gone mad with sales notifications. Orders coming in 3, 4, 5 at a time, seemingly for the same item over and over again. For example, 4 lots of an XL in the same t-shirt design.

The app is limited, so I checked on my laptop, and suddenly I can't log in. This is despite having been online all day, and literally only having stopped half an hour ago.

Etsy seems to have sent automated messages to all these buyers, asking if they intended to buy these items. Now I'm getting inundated with people assuming they've had fraudulent activity.

Am I alone with this issue?

[VintageRescueSquad]

Sounds like you were hacked and your shop has been hijacked. Is it another shop you have? This one has no sales....

[ForeverAgoStudio]

It's a different store. 

[ForeverAgoStudio]

I don't think I have been hacked as I'm not sure how anyone benefits from this. 

It is multiple Etsy customers who have had credit cards billed for transactions they did not approve. Whilst my account is getting the funds, I don't know how a third party would have got random people from around the world to buy my stuff, and then get the money from me.

I think this is an Etsy issue. I think they applied security measures to my account in an attempt to stem the flow of transactions. It's just unfortunate that now I can't access my own account! I know from previous experience that they are pretty horrendous at helping with anything.

As I write this, someone else has just purchased 6 items.

I'm trying to contact those impacted. I am conscious that for each item 'purchased' they will get an email asking to rate their experience. Even when I cancel a transaction, they get a 48 hour review window. So to use the person I just highlighted as an example, it's likely he may get 6 opportunities to review my store.

[TheVintagePineapple]

When you tried to log in, did it say your password was wrong?

What is the name of the other shop?

[ForeverAgoStudio]

No, as far as I can tell, the password has not changed.

I am still logged in on the app on my phone.

But I cannot access on my laptop. I don't know if I was logged out. The password is usually saved, but now it asks me to input a confirmation code sent to an authenticator app. I have never set up an authenticator app, so I cannot receive a code. 

[bradgoodell]

It sounds like someone is using your shop to test credit card numbers.  I had this happen on my website.  I had 3 odd orders, where people had ordered personalized items with no personalization details, and they weren't responding to my emails.  Then I noticed the names looked odd, and the state and zip didn't match.  

I checked the back end, (I used Stripe and could see all activity) and I had 10-15 purchases PER MINUTE, for 2 days solid, 99% of them being rejected but 3 went through.  I increased security by adding Captcha, but I also closed my shop for a few hours to break the bot chain of purchases.  

I had spoke to a police detective who specialized in credit card fraud.  He said it is common for thieves to test the cards.  Then they package the credit card numbers and sell them in bulk.  The thieves will sometimes purchase then ask for cancellations, or give a bad address so the company will cancel, knowing the card holder will see a charge and reversal and since it balanced out, they will assume it was a mistake and won't report it.  Then weeks or months later, the real fraud happens. 

[Jewels2at]

@bradgoodell   Interesting!

[ForeverAgoStudio]

This sounds worryingly plausible.

[GlassyFields]

wonder if Etsy is preventing you from loggin in due to the abnormal activity. 

And Etsy sending messages regarding these transactions ... that seems like a good thing to let them know their credit card is being used. Otherwise, how would they know. If it was my credit card I would assume fraudsters, not your shop.

Anyhow, I hope you get this sorted out soon so your shop can resume normal activity.

[ForeverAgoStudio]

Yes, I agree. I do appreciate they've sent the auto response. Just rather they didn't literally sign it off with my store's name. I realise that's the least of my issues!

[ForeverAgoStudio]

Thank you Bradgoodell.

I was working on my account all day yesterday.

There was one thing that I noticed that I thought very odd. But I fixed it and I dismissed it as a glitch.

I usually set each product's stock level as '10'. The prices are invariably around £17.99-£24.99 for most items.

I noticed I suddenly had about 10 items set with a stock level of 999. And their prices were randomly high, like £124 each. In some cases, something that was £19.99 was set to £199, like someone had stuck a 1 at the front.

[ForeverAgoStudio]

Thank you for the responses thus far. I've not heard anything from Etsy. This all kicked off about midnight last night. I went to bed about 2am and just woke up at 6:30 am. I'm so worried about this. I have so little confidence in Etsy to actually deal with anything in a manner where I'm protected. The communication is always so poor.

I had about 22 weekend sales to complete, which were legitimate. I don't even know what I have now as the app only states '99+' once you get as far as that.

Customers don't seem to be charged anymore, so today I'll just manually refund and grovel to all those who have. Etsy have sent automated messages, but I'm kind of peeved that they make out they're sent from me, rather than Etsy HQ. The wording is so blasé and impersonal. I've got people sending me messages complaining of having had $300 gone from their account.

My account balance prior to all this, was about £500. It now shows £7,700. I am doubtful I'm ever going to see the portion that is genuinely mine, certainly not any time soon. This is in addition to another issue I had last week, where I've not been paid... see this thread; 

https://community.etsy.com/t5/All-Things-Finance/I-haven-t-received-funds-for-almost-a-week/m-p/1420...

The funds in question there was over £500. I've still not received it - although it is a bank holiday here now which doesn't help.

So I've not been paid for about 10 days now. I am owed around £1,000. I need the funds to pay for stock and postage to complete orders in times. I've spent over £300 on a credit card to secure new stock to fulfil orders. And I've billed shipping costs to my Etsy account where it makes sense to do so (ie. overseas orders), the rest I've just paid from my own pocket. But these costs are real, and impact my life. And Etsy don't care. #StandWithSmall

[TheVintagePineapple]

@ForeverAgoStudio If you still have access to the shop through the app, you should consider putting the shop on vacation.

[ForeverAgoStudio]

I did consider this, but I think any customers who email would get an automated 'out of office' style reply. 

I don't think customers are being charged anymore for irregular transactions.

Putting the store on holiday mode would presumably also stop any new purchases. So I would be losing out on legitimate sales.

[CraftyCornishMaids · Accepted solution]

@ForeverAgoStudio 

I noticed I suddenly had about 10 items set with a stock level of 999. And their prices were randomly high, like £124 each. In some cases, something that was £19.99 was set to £199, like someone had stuck a 1 at the front.

But I cannot access on my laptop. I don't know if I was logged out. The password is usually saved, but now it asks me to input a confirmation code sent to an authenticator app. I have never set up an authenticator app, so I cannot receive a code. 

you have been hacked, check the bank account number for deposits is still yours

put your shop on vacation, if you still can, change the date on your billing card to today, so no money can be transferred, if it's not your bank account

run virus checkers on all your devices

report the fraud to the police, through - actionfraud
https://www.actionfraud.police.uk/secureyouraccounts

and contact your bank, and report it to them

........

where you set up 2FA on etsy, scroll down, you will see logins, and the IP addresses and location,

make a note of the ones that are not yours, and if they are logged in, log them out

check they have not changed your e-mail address too, if they have, get a new e-mail address, and change to that one

give the above info to the police and your bank, when you report it

[ForeverAgoStudio]

Thank you. I'm contacting police now.

[ForeverAgoStudio]

Hi, I just wanted to update, should anyone be interested.

It's precisely 3pm. This all kicked off pretty much bang on midnight. So in the space of 15 hours, my livelihood has been removed. 

I am personally £1,000 out of pocket, and on top of this, other customers are around £7,000 down. Presumably they're protected by CC companies, but all advice I've had thus far from Police and fraud is to assume that my money has gone. Even though the balance is still sat there, I can't intervene! 

In hindsight, it's all so obvious. I am annoyed with myself for not seeing it. I am also very annoyed with Etsy, for not addressing my concerns when I raised issues last week about not being paid. I knew something wasn't right, and I just got fobbed off. I am still yet to receive contact from Etsy. I cannot access my account. It's fortuitous that I have this second account for a store that I've not set up yet, otherwise I'd have no contact at all. I can no longer sign in on my main account. My store is closed. I can't access the app.

So, for the sake of sharing experiences, this is what seems to have happened. I hope we can all be a little wiser from my experience.

Monday 24th April. I didn't get a payout. Nor Tuesday,  nor Wednesday. On Thursday I got notice payment had been sent. This was never received. I am an idiot.

Sunday 30th April/Monday 1st May, a huge amount of transactions go through. All intensively in a short burst.

It seems my bank account was removed and replaced by someone else's last week. They stole my takings. They've waited until Monday, which is a bank holiday in the UK, and absolutely rinsed my store. I'm assuming all sales are with stolen card details. All the takings from my legitimate sales, piled on top of £6,000+ of stolen card sales go through to their bank account.

The irony is, that I think I was due a Star Seller triple star rating. Literally on 1st May. The reviews are gonna kill me. I've worked so hard to get to a stage where I actually get by. I noticed this happening BECAUSE I was still working at midnight on a Sunday night. I know you have to roll with the punches sometimes, but this might be the last I can absorb. I have two or three creative projects on the go, but I need this Etsy store to just give me the basic income to allow me to do other 'works in progress'. Without it, I can't pay the bills. Time to get a proper job, but first I'm going to curl up in a little ball and see if that helps.

[CraftyCornishMaids]

that's s h * t

keep banging on at Etsy - the police might be able to retrieve something

[EphemeralExpressions]

OMG, how absolutely horrible - it's no wonder you want to curl up into a little ball!  So sorry this has happened to you.

"My store is closed."  Is it possible that the tickets you opened with Etsy (which I believe you mentioned in another thread, regarding missing payments), alerted Etsy something weird was going on with your account, and they closed it rather than the hackers closing it.  I'd assume the hackers changed the email on your account also, which is why you haven't heard anything from Etsy?  I dunno - just grasping at optimistic straws, I suppose.

I hope this is all sorted out to your benefit soon.