Shop hacked again 2 hours after being restored

[HomeDecorDezigns]

 2nd time since Thanksgiving my shop CreativeSoulArtz has been hacked. My shop was restored only to be up for  2 hours before the listings for fake sneakers that I did not list were back.  Etsy is just taking its ole sweet time getting this fixed, meanwhile, at least a dozen customers are trying to get refunds from Etsy and Etsy is telling them I will refund them. Not in this lifetime when I did not receive the money in the first place.  Today I got the following message from a customer:

[This content has been removed by Moderation. We ask that you please review Section 1, Item 1 of our Community Policies prior to posting.]

I have no doubt that this posting will probably be removed very quickly, or I will receive another sit down and shut up email, but at least I will have had the satisfaction of doing it. I've had to close my store anyway to stop the hackers, so what else do I have to lose?? Etsy is already pointing the finger at me anyway. Looks like Etsy has a big problem and they are about to loose the war on the hackers!

[CoolCyberCats]

Assuming they are hacking your store by logging in as you, use a SUPER LONG COMPLEX password. At least 15 characters and have upper case, lower case, numbers and symbols in it. Use NO words or any part that you have ever used in the past.  Hopefully that helps.

[catfluff]

also google authenticator  which is connected to your phone and Etsy, you need to insert the code it generates , this is only good for your financials but at least they can't get into your financials and change accounts.  I'm not sure why Etsty doesn't take these matters more seriously, as it reflects badly on the site as a whole.   I do recall when I got hacked a few years ago, and somebody got into my account an made purchases Etsy treated  me as If i was the criminal.

[PlatypusDream]

Have you checked your devices for keystroke hacks?  They may be able to see your new passwords as you enter them this way.

There are a lot of stories of latent stores being hacked on Etsy and then used to direct sales offsite, or illegal merchandise uploaded.

Etsy really needs a serious, dedicated team to deal with these issues quickly and effectively!

[catfluff]

when you see all these posts on FB about I need to buy and Etsy shop , or I have an Etsy shop for sale,  makes me wonder why Etsy can not get tighter security.  There is way too much of it.  

[JMOldeVintage]

@HomeDecorDezigns  - Make sure you are using a clean device when resetting password, etc.

Per Etsy's community standards for the forums they may delete this post - or - edit out the message to you from your "buyer". We are advised to not share private communications here in the forums.

Or, you can edit your post - you have one hour from the time you initially posted. 

[HomeDecorDezigns]

Normally, my professional standards are way higher, but no one seems to have my back so professionalism with ETSY has gone out the window

No worse than ETSY pointing the finger back at me with the customer. What is Etsy going to do........ hack my shop??? I spent a nice amount here monthly in fees and advertising.  We need to stand up and push back and my best way to vote is taking my business elsewhere.

[CraftyCornishMaids]

that is no reason, to post a lovely customers private communication to you, in an open worldwide forum

[GriffithGardens]

Etsy also offers 2 factor verification so make sure to set that up as well.

[BagmakerSupply]

@HomeDecorDezigns: It would be interesting to know how the hackers got into your account a second time as presumably you changed your password, added two factor authentication, etc.

[HomeDecorDezigns]

I changed passwords and email, the listings reappeared before I could finish doing the 2FA. I did find out that they were logging into my account from multiple areas in the country, so I'm not sure what to make of that. However I am keeping screenshots of everything and copies of the login logs for my protection. 

[EnergyPeace]

@HomeDecorDezigns they may be using a VPN (most likely) so that is why it appears as they log in from different areas in the country. Could be one person.

[CraftyCornishMaids]

The account access to give back to you, is for etsy to sort out

the fraud is for you, the police, and your bank to sort out

someone knows your password, your 2fa codes, and and your bank account, and assuming you set up a new bank account for the shop, they have found that out too.

either you have something like a keyword stroke virus, or it's someone who has access to this information.

go to the police again

did you set up 2FA, and use a different bank account this time?

[catfluff]

The FBI recommends that cybercrime victims call them first -- not your local police. The agency has an Internet Crime Complaint Center, where you can file details on what happened and analysts will review the case to determine what actions to take. Often, though, nothing much is done.  -Cause I know my local cops could care less

[CraftyCornishMaids]

I didn't say local police

[HomeDecorDezigns]

All I care about is my customers getting taken care of. Proper decorum has gone out the window. And all the customer wants is his money. There is no identifying info here.

[HomeDecorDezigns]

Oh it is being investigated all right. Etsy need to take care of the customers that have been victimized as well as me. I never received any money from any of these sales.

[CoolCyberCats]

@catfluff Unless the hackers are operating from your basement or in your town, what can local police do about a hacker 4 states away or in another country? Nothing. It may not be that they do not care, but more like you reporting a peeping tom in Seattle to a NYC officer.

[catfluff]

I know that , that is why I dont understand why @Crafty is always telling people  to contact the cops, they don't care.   SO I informed her that it should be the FBI that is contacted, or the equivalent in your country.

[CraftyCornishMaids]

Our police has a department called

action fraud, it's part of the police department

it's not the local police

one part of it looks at "facility takeover" which is what this is.

so whatever part of the police where you are from, provide this service, contact them.

It's a fraud on the account holder, it is not fraud on etsy

this is from their help pages explaining it

An account or facility takeover can happen when a fraudster poses as a genuine customer, gains control of an account and then makes unauthorised transactions.

Any account could be taken over by fraudsters, including bank, credit card, email and other service providers.

Fraud has been committed if money has been lost.

then there is a link to report it

[catfluff]

@CraftyCornishMaids   so the Police are what?  If not Local?

[CraftyCornishMaids]

the police service has different aspects, some of them are local, some are not, actionfraud.police.UK you can report cyber fraud to directly

[Amaradorn]

Sounds like you have some malware on your device that is sending your password to the hackers. What anti-virus software are you running?

[CoolCyberCats]

@HomeDecorDezigns  While you wait for Etsy help... Do you run a good virus scanner? If not, get one and do a deep scan on your system to make sure you are not compromised.

[ModFabio]

Howdy!
 
I see that you have already gotten in contact with our support team with regard to this issue, so please hold on while your case is reviewed. Moving forward, our team will handle this matter directly with you, so stay tuned to your email for any future updates. 

In the meantime, I'm closing this thread to prevent it from going off-topic. Thanks!