What to Do If Your Etsy Shop Account Is Hacked

An Etsy account can be a big part of a small business, so losing access to it or noticing suspicious activity can quickly become a serious problem. Unauthorized listings or messages, changes to payment details or an account suddenly becoming inaccessible can all be signs that something is wrong.

If an Etsy account has been hacked, acting quickly can help limit the damage. Here are the steps to recover the account, check what was affected and make it more secure.

Key takeaways:

If you can still access your Etsy account, change your password immediately and check for changes you didn't make.
If you're locked out or someone changed the email address connected to your account, contact Etsy Support.
Secure your email account too, especially if you reused the same password or suspect your email was also compromised.
Check your listings, messages, sign-in history and payment details for anything you don't recognize.
Once you're back in control, use a unique password and two-factor authentication to better protect your Etsy shop.

How to Tell If Your Etsy Account Has Been Hacked

Sometimes it's obvious, as you try to log in and can't. Other times, the signs are easier to miss.

Take a closer look if you notice:

Password reset or login emails you didn't request
An email saying your Etsy email address or password was changed
Listings you didn't create or changes to existing ones
Messages sent from your account that you didn't write
Orders or transactions you don't recognize
Changes to your bank or payment information
Sign-ins from devices you don't recognize

Even one unexplained change is worth investigating.

How Do Etsy Accounts Get Hacked?

Often, criminals get a seller's login details somewhere else and use them to get into the account. You may have entered your password on a fake Etsy login page after clicking a phishing message. A password you reused on another website may have appeared in a data breach. Malware on your device could steal login information. Or someone may have gained access to the email account connected to your Etsy shop.

Etsy sellers also need to watch out for scammers pretending to be Etsy Support. A warning that your shop is about to be suspended or that there's a problem with an order can create exactly the kind of panic that makes you click first and check later.

Whatever the cause, don't stop at changing your Etsy password. You need to check what else may have been compromised too.

What to Do If Your Etsy Account Is Hacked

The sooner you start checking your accounts, the better. Work through these steps even if the problem appears to be limited to Etsy.

1. Secure Your Email Account

Start with the email address connected to Etsy. If someone can access your email, they may be able to see security messages and password resets for Etsy and other accounts you use for your business.

Change your email password if you think the account may have been compromised, especially if you used the same password for Etsy and your email. Use a new password that you haven't used anywhere else and turn on multi-factor authentication if it isn't already enabled.

Check your email account for unfamiliar logins, forwarding rules, recovery addresses or other changes you didn't make.

2. Change or Reset Your Etsy Password

If you can still log in to Etsy, change your password immediately.

Choose a strong, unique password that isn't being used for your email, PayPal, social media or any other account. A password manager can create and store it for you.

If you can't log in, use Etsy's password reset option.

Don't keep trying different versions of an old password you use elsewhere. If that password has been stolen, assume it shouldn't be used again.

3. Check Whether Your Etsy Email Address Was Changed

If your password suddenly doesn't work, the attacker may have changed the email address connected to your Etsy account.

Check the inbox of the email address you normally use with Etsy. Etsy says that if your account email is changed, it sends a message to the old address with instructions for reversing the change.

If you can't reverse it or still can't access the account, contact Etsy Support.

4. Contact Etsy Support If You're Locked Out

If you can't regain access yourself, report the compromised account to Etsy Support.

Be ready to explain what happened and when you first noticed the problem. Keep screenshots of suspicious emails, account changes or other activity. Etsy may also ask you for information to verify that the account belongs to you.

Make sure you're actually dealing with Etsy. Don't call phone numbers or use support links sent to you in unexpected messages. Go directly to Etsy's official Help Center instead.

5. Check Your Etsy Account for Unauthorized Changes

Once you can get into the account, go through your shop carefully. Check your listings, orders, messages, account settings and sign-in history. Look for anything you didn't create, send or change.

Also review the devices that have signed in to your account and sign out any you don't recognize. If you have third-party apps or services connected to Etsy, check those too and remove anything unfamiliar or no longer needed.

Take screenshots of suspicious activity before removing it, particularly if money or customer orders are involved.

6. Check Your Payment and Bank Details

If you sell on Etsy, this part is especially important.

Check that your bank account and other payment information haven't been changed. Review recent transactions and payouts and look for anything you don't recognize.

If money has been transferred or your financial information has been changed without your permission, contact Etsy and your bank or payment provider as soon as possible.

Don't forget to check other financial accounts connected to your business as well.

7. Turn On Two-Factor Authentication

Once you're back in control, make sure two-factor authentication (2FA) is enabled on your Etsy account. With 2FA, a password alone isn't enough to log in. There's another verification step, which makes a stolen password much less useful to an attacker.

Etsy supports several verification methods, including authenticator apps, SMS and phone calls. Etsy recommends authenticator apps as the more secure option.

Keep your backup codes somewhere safe too. They can help you regain access if you lose the phone or authenticator you normally use for verification.

8. Check Your Devices for Malware

Think about what happened before the account was compromised.

Did you download an unexpected attachment? Install unfamiliar software? Click a link in a message claiming there was a problem with your Etsy shop?

Run a security scan on the computers and phones you use for your business. Check your browser for extensions you don't recognize and remove anything suspicious.

There's little point in changing all your passwords from a device that's still compromised.

9. Tell Customers If They Were Affected

You don't need to announce an account hack to every customer automatically. But if someone used your Etsy account to contact customers, send malicious links or interfere with their orders, the affected customers should know.

Keep the message simple. Explain that someone gained unauthorized access to your account, tell them what may have affected them and warn them not to click suspicious links or respond to messages sent during that period.

Avoid guessing about what happened. Tell customers what you know and what you're doing about it.

10. Keep an Eye on Your Other Business Accounts

An Etsy account may not be the only target. For the next few weeks, pay closer attention to the email, payment, social media and other accounts you use for your business.

Unexpected password reset emails, login notifications or security alerts could mean someone is trying the same stolen credentials elsewhere.

If you reused your old Etsy password on any other account, change it there too.

Etsy Account Hacked? Quick Recovery Checklist

If you need the short version, start here:

Secure the email account connected to Etsy.
Change or reset your Etsy password.
Check whether your Etsy email address was changed.
Contact Etsy Support if you can't regain access.
Review listings, messages, orders and sign-in history.
Check your bank details, transactions and payouts.
Enable two-factor authentication and save your backup codes.
Scan your devices for malware.
Contact customers if they were affected.
Watch your other business accounts for suspicious activity.

How to Protect Your Etsy Shop From Being Hacked Again

Your Etsy shop doesn't exist on its own. It's connected to your email, your computer or phone, your bank account and probably several other services you use to run your business.

Start with the basics. Don't reuse your Etsy password anywhere else. Keep two-factor authentication turned on. Be suspicious of unexpected messages telling you there's an urgent problem with your shop, particularly if you're being pushed to click a link or provide information.

And don't forget the devices you use to run the business.

Bitdefender Ultimate Small Business Security can help protect your business devices, email and online accounts against threats such as phishing, malicious websites, malware and credential theft. That matters because protecting your Etsy shop isn't only about protecting your Etsy password. It's about protecting the wider digital business around it.

Try Bitdefender Ultimate Small Business Security free for 30 days. No credit card required.

FAQs

What should I do first if my Etsy account is hacked?

Start by securing the email account connected to Etsy, particularly if you think it may also have been compromised. Then change your Etsy password immediately if you can still access the account. Check for changes you didn't make, including your email address, listings, messages, payment details and recent sign-ins. If you can't access your account, contact Etsy Support.

How do I recover a hacked Etsy account if I can't log in?

Try resetting your Etsy password using the email address connected to your account. If you still can't get in, contact Etsy Support. If your Etsy email address was changed without your permission, check your original email inbox for a message from Etsy with instructions for reversing the change.

Can someone hack my Etsy account through my email?

If someone gains access to the email account connected to Etsy, they may be able to see security messages or attempt to reset your Etsy password. Secure your email with a strong, unique password and multi-factor authentication, and check for unfamiliar logins or account changes.

How can I tell if my Etsy account has been hacked?

Possible signs include login or security alerts you don't recognize, changes to your email address or password, unfamiliar listings or messages, unexpected transactions, changed payment information or sign-ins from devices you don't recognize.

Should I contact Etsy if my account has been hacked?

If you can't access your Etsy account or can't reverse unauthorized changes, contact Etsy Support. If you can still log in, change your password immediately and review your account for anything you don't recognize.

How can I protect my Etsy shop from being hacked again?

Use a strong password that you don't use anywhere else, enable two-factor authentication and keep your backup codes somewhere safe. Protect the email account connected to Etsy as carefully as the Etsy account itself, and be wary of messages claiming to come from Etsy Support that pressure you to click a link or provide login information.

What to Do If Your Etsy Account Is Hacked: A Step-by-Step Guide