Scammer: Etsy should not allow accounts named "Etsy Staff"

[MythicEquips]

I received an Etsy message:

[This content has been removed by Moderation. We ask that you please review Section 1, Item 1 of our Community Policies before posting in the Forums.]

PS: The message in question did not come from Etsy, and we have already actioned the account attempting to impersonate admin.

[CraftyCornishMaids]

read the orange message etsy put under messages, about scams, and click through and read it.

You can click it off, so it goes away, but you should read it first.

If the message is from etsy, it is in the "from  Etsy" folder on the left hand side,

if it's not in there, and just in your inbox, mark it as spam, and ignore it.

[MythicEquips]

This is fine, but I am just saying Etsy should prevent an account named Etsy Staff.

[AnniebelloPaper]

And the scam wording continues to evolve.

Etsy should be able to instantly reject any account with any version of their name. Sadly there are already many shops that use it as part of their shop names so Etsy are unlikely to take that step. They should also make the warning on the message page something that cannot be clicked away. It should be a permanent pop-up.

[CraftyCornishMaids]

absolutely not a permanent pop-up

Etsy is enough of a nanny state as it is.

[CryzalisDesigns · Accepted solution]

I am not sure how they can not have a system which rejects the name Etsy in the username box.

it's mindboggling especially as many seem to use "Etsystaff"

[AnniebelloPaper]

@CraftyCornishMaids while in most cases of pop-ups, I would agree with you but it's obvious that most sellers have glossed over that warning and clicked it away without actually taking in the message. If it's there, perhaps in a smaller (heading only) window that can be expanded if necessary, a lot of sellers might not be caught out by scammers. Every day more and more are coming here talking about near-misses and sadly, actually falling for these scams.

[DaysofYoreTreasures]

@CraftyCornishMaids 
I disagree. In the current situation of multiple scammers targeting mostly new sellers, Etsy can be as nanny as they like as far as I am concerned. Anything it takes to stop even one seller providing their details to a scammer is a win.

[CraftyCornishMaids]

I do not want a permanent pop-up.

You don't even know if they clicked it off - it could still be sitting there , being ignored.

these scams are so obvious ... I'll send you a link - click on it - give me your credit card details

I am not sure anyone can do anything about businesses who fall for scams like this

definitely a permanent popup for us all to be faced with, is not the answer

... and some have probably already fallen for the you-tubers advocating pod shops are get rich quick money makers

and spend loads on money on ads, without a proper seo

and sell "healing" items

[audreytherese]

There are millions of sellers. 

A few dozen, or even a couple hundred, that post here because they clicked off the pop-up without reading it does not mean most have glossed over that warning. 

I'm with those that don't believe the rest of us (millions of us) should have to have that annoy us every time we go into messages because a small fraction couldn't be bothered to read the warnings.

[MyTinyShopy]

Hello Etsy sellers, My profile got hacked just an hour ago despite having Two-factor authentication enabled. Oddly, I didn't receive any notification email about a security breach. Within moments, I saw that I had sent over 20 messages similar to the ones above as an Etsy Stuff profile.

After changing my password, I realized they changed my profile pic into an Etsy pic and my profile name into Etsy Stuff. I promptly moved all the suspicious messages to the spam folder and informed everyone not to respond to them.

However, I'm puzzled about how they managed to breach my profile despite the 2FA protection. Interestingly, I've just received an email from Etsy regarding the Misuse of Messages in my account.

Thank you in advance, Anastasia from My tiny Shopy

[CraftyCornishMaids]

if you go to the security page, where you set up 2FA, scroll down, you will see the whereabouts the person logged in from, and make sure you log them out

[MyTinyShopy]

that's the thing, I  reviewed my sign-in history and it just shows my IP address!!!

[bradgoodell]

It may be your computer was hacked.  2FA offers more protection, but it is not infallible.  

https://securuscomms.co.uk/how-hackers-bypass-two-factor-authentication/