My active Etsy account has been hacked and I can't access it. Urgent help needed.

[ManifestOnTheMoveAU]

Hi There, 
I am deperately hoping that somebody can assist me in removing hackers from my account and regaining my access. With every passing hour myself, and unknowing customers are being stolen from. 
My login email address was compromised on 6th Jan, I received an email from Google telling me so. Within a couple of hours I received numerous 2FA texts and upon logging into Etsy the next day, I could see the banking details for receiving payments had been changed, and was awaiting the two small denomination credits to be confirmed. 
I instantly emailed Etsy support and got a reply within around 12 hours acknowledging the issue and asking for verification details, but unfortantely that was overnight for me and by the time I got to my desk the next morning, the hacker had replied before me, confirming the verification details, but as these are all easily accessble within the settings - last 4 digits of bank account, last deposit made, it's really not an accurate verification at all?
What followed then was a ridiculous chain of me saying HE was the hacker, and him saying I WAS the hacker, before finally my password was changed and I was removed from the account. 
So ultimately the hackers have been given my business account with NO ID verification. I do not understand how this been allowed to happen with 2FA on and so far my new Help Request Log has been unanswered for 22 hours, with every passing hour being allowed to let fraudulant sales happen, and my personal, security and banking details at risk. My finances, security and reputation are at high risk every hour this goes unassisted.
I have reported the situation to Australian Cyber Support Centre, the WA Police, and ID Care. 
It's imperitive I regain access, and remove the hackers from my account immediately and urgently request some support from Etsy Tech in helping me fix this. 
Can anybody, PLEASE, help me? 
Warmest, 

[ManifestOnTheMoveAU]

PS. The account that has been hacked is not this one. I am lucky I have a secondary business in which to be able to post to the community from. 
Thank you. 

[CryzalisDesigns]

Are you sure the email was from Google? I received a similar email the other week but it said to click on a link to change for my own security so deleted this email and logged into google and changed it myself in my settings just in case. 

It is shocking that no ID verification was required and even more worrying that Etsy took the word of a hacker without ID to remove you from your own shop, this is just another reason they need a 24/7 direct line for security cases.

I am not sure if any of the moderators are around to assist you but although not reassuring in about 9 hours (16:00 CET) live chat opens in your dashboard which will at least give you direct access to someone from Etsy, they probably will not be able to help you but at least get this expedited to the right department.

So sorry this has happened to you.

[ManifestOnTheMoveAU]

Thanks so much for the reply, I so appreciate your time. I'm not sure if the original email was from google no, or if that has been hacked too. In diving deep into other forum cases online, it seems like a double hack job most certainly. 
I'm also awaiting unanswered emails from Google. 
Great to know a chat option opens up - opposite side of the world to me but I'll be sure to stay up tonight and hopefully get something, anything.. from somebody. 
Thanks so much again. 

[BootifulLabels]

You will get plenty of sympathy from the forums, but with this issue you don't need that , you need to contact Etsy.  I understand that using the message topic ACCOUNT HACKED gets their attention quicker.  Also, if you receive a  generic response saying your message has been received and someone will get back to soon, there is a link at the bottom that says "I still need help".  Click this and keep all replies in the same message chain, if you keep sending new messages, rather than replying to the existing thread, Etsy assumes that it is a new issue and you go to the bottom of the queue.

I wish you luck.

[CryzalisDesigns]

There needs to be a quicker way for such cases, this is security or the lack off, especially as it seems to be happening more frequently

[ManifestOnTheMoveAU]

That's great advice thanks so much for taking the time to write. I'm continuing to add to the same chain every couple of hours right now but still no reply. Now 25 hours of fraudulent sales and my personal information in the hands of hacker. I feel sick!  

[LindasJewelryShop]

That's great advice! I can't understand how a company as big as Etsy can be so lax on security. Its frightening actually. Now this is happening to those with 2FA on?

My computer was hacked a couple years ago, and with every creditor I called, credits card companies, banks, credit bureaus, all of them answered immediately. There was no waiting even for a return call. It was immediate assistance and they all take it very seriously. When something scary like that happens, I can't imagine how much worse it is to see it going on while waiting for days for help.

I am so sorry you are going through this. I wonder if the police department can provide some guidance as to what next steps you can take. They may not get involved with online marketplaces, but I would bet they might be able to point you in the right direction.

[FallenAngelBrass]

@LindasJewelryShop 

Seems as though the OP had replied to a phishing email, which enabled the entry to the shop.  Thus, the "failure" of the two factor authentication.  

[ManifestOnTheMoveAU]

@LindasJewelryShop hello, no actually I didn’t action or click anything within that initial email until I returned to my desk on Monday - by that time the 2FA texts had already been pinging like crazy, and the banking details inside my Etsy account had been changed. 
But I’ve no idea how any of this works.. is that how it would work, a link click from a phishing email overrides a password and 2FA? I understood 2FA was to protect scams from going much further? 
Keen to be enlightened to ensure this never happens again! 

[UniqueWoodShaper]

@ManifestOnTheMoveAU

No, this is not quite how it would work. A simple click on a link does not overwrite your password or 2FA.

A Phishing email has the intention of YOU entering your credentials (usually your password) into a malicious website, that imitates to be Etsy, for instance. This way, a scammers gets your credentials which they can use to login into your real etsy account.

2FA requires you to have a second token for authe tication (beside your password), often a phone, where u get a text message with a login code. The point is to verify, that ONLY YOU would ever be able to receive that code (similar to how only you should know your password, therefore identifying you as a person), and hence making sure that no third party is using your password.

However, I could imagine a situation where you click on a Phishing link, enter your login details which are immediately used by the scammers to log into etsy. You will then receive the 2FA code, send it to the scammers, and then they are inside your account. This would only enable them to login to your account once. 

[steelhipdesign]

Etsy does have security features for this situation.  The first one is when a seller makes any changes to their bank account data, transactions are not processed for 4 to 5 days.  The second, bank accounts must match the ID credentials provided when the seller account was opened.  Unless the hackers also have access to your bank account, they are going to find it very difficult to do anything.  Due to this some hackers, upon taking over an account, try to move the transaction off Etsy using less secure payment options.  Needless to say, most buyers are not going to do that.  Most payments leave a very clear paper trail back to them.  Etsy shops can't be transferred so there is no option for them to change the name on the account to match their bank account.

I couldn't find the name of your other shop declared on the one you're posting from.  I would run a scan on all your devices for a keylogger.

[VintageVenueShop]

Have you checked your phone recently (the one that you receive 2 code verifications from Etsy on) ? Can a family member call you to check to see if you receive incoming calls or texts still on that phone?

I ask because was a victim of what is called "Sim Card Swap Fraud" last year and it is frightening....google it and see. The fraudsters basically take over your iphone number (by convincing a 2nd phone provider party that they are "you" and want to switch from your legit provider) and therefore have access to all your texts where they can request 2 code verifications to change your passwords to any account you have that protection lodged on.   Thankfully, they "only" got away with a few hundred bucks worth of cigars and hula hoops (of all things!) from my Paypal.... just wanted to throw that out there for you, so you can check!

[nta58flx9piiejnb]

Hi @ManifestOnTheMoveAU 

I am sorry to hear about the circumstances, however I am escalating your case internally to our account specialists who will be able to assist in resolving the matter.

Thanks! 

[ManifestOnTheMoveAU]

Hello, that’s wonderful thank you. 
How will I be contacted? Does the person this is being escalatedto need to know original help request number ID - or need to know the name of my other account? 
I haven’t provided that information here? 
Thank you. 

[ManifestOnTheMoveAU]

Hi, 
24 hours have passed and I haven't receive any contact from any account specialists. 
My account has now been in the hands of hackers for 74 hours. Please please help me in fixing this. 

[CryzalisDesigns]

@ManifestOnTheMoveAU I would still try the live chat, just keep at them until they put you shop in vacation mode then you know they are taking it seriously, whilst your shop is active they are still doing god knows what.

The minute you contacted them and the hacker accused you of being a hacker Etsy should have put the shop in vacation mode for protection until ID's where checked and doubled checked

[DreamGreatDreams]

just in case you can’t find the links to contact support, here they are. 

here is a link to the “how to contact support” from the seller’s handbook.

here is a link to initiate chat or email.

here is a link to request a callback.

or try this link or this link to email them.

if you do email them you *should* get an automated reply and once you do, you must reply to that email above the line of asterisks that their automated best guess solutions did not work. all you have to say is something like “i still need help” send the reply, and it should stay active.  it’s critical that you reply to the automated response you receive and don’t send additional emails thinking it will speed things up (this actually slows things down.)

*** none of these links seem to work all the time. also know they may, or may not work outside the usa, may or may not work outside non-standard usa business hours (m-f & 8-5) and like many companies on major holidays, support may be limited, if available at all (these holidays are typically posted in advance before a new year begins. i do not know if etsy does this)***

[ManifestOnTheMoveAU]

Thank you so much for sharing these with me, I really appreciate it! I'm in Australia so not all of the options are available to me but I'll push through with the ones that are!

[CryzalisDesigns]

@ManifestOnTheMoveAU the live chat is now active in the dashboard, maybe give them a try

[EnergyPeace]

This is insane....Etsy, you need to get some kind of emergency feature for situations like this. Where we can contact you, and request a pause on our shops while you investigate and confirm we are the shop owners. This is scary that it can happen and you allow fraudelent sales to continue for hours and days without stopping it !!!

To the OP, I am so sorry you have to deal with this. I hope they have helped you??

[ManifestOnTheMoveAU]

Thanks so much for the support. 
No help yet - now 74 hours with my personal and banking info within the hands of hackers, and the shop reputation falling into absolute disarray! 

[CryzalisDesigns]

They have still not put your shop in vacation mode?

[ManifestOnTheMoveAU]

Hi! 
It now says 'this shop is currently not selling on Etsy' but as I STILL have not heard a peep from Etsy, I am not sure if it is a security measure they have taken, or if the hackers have possibly deleted the account, or renamed in? I am absolutely in the dark. 
I have a friend in PR who has said she'll help me take this to the media once it gets to 7 days of no contact. We're heading in to day 5. 
I've still not had the chat option pop up for me too! 
Maybe it's not available in Australia...  
Heart-breaking stuff. Thank you for your support x

[CarpetCollectionAU]

@ManifestOnTheMoveAU I am in Australia and I can see a "Have us call you" option here. Wait time is one minute

https://help.etsy.com/hc/en-us/requests/new?segment=selling#issue_sell_desposits_fees-contact_select

Chat is available in Australia, but it all depends on the time of day.

Usually, I can see the Instant Chat link up to about 9 / 10 am our time (different time in US). You probably cannot see the Instant Chat as you are not a SS yet. But Chat can still be found in the Help Center.You just have to search for a topic that is offering it at the time you are looking.