TikToker Urges Etsy Sellers to Delete Their Accounts After Sharing Security Nightmare Story

Etsy is like an online flea/craft market of sorts where folks can sell their bespoke items and designs to people all over the world. The online retail space is big business too: with nearly 82 million active buyers who purchase goods through the platform, and some 4.36 sellers, there are a number of folks who were able to create so much success on the site that it ended up becoming their full-time job.

Like Alicia Shaffer who, at one point, was generating around $1 million a year in income on the site. And while that type of financial success is atypical, there are still sellers who manage to secure a hefty amount of money for themselves each and every year on the platform.

However, a TikToker and former seller on the site by the name of Marisa says that doing business with the brand has been a huge headache for her.

In a post that's garnered hundreds of thousands of views on the popular social media platform, Marisa, who posts under the TikTok handle @marisadabirdie, states that Etsy has allowed a known hacker to compromise her account while providing little recourse for her to fix it in a timely fashion.

In a text overlay of the now-viral clip, Marisa writes: "Delete your Etsy account now." She says in the viral clip: "If you're seeing this please delete your Etsy account, whether you're a buyer or a seller their security is awful. You are currently at risk of being impersonated, having your account hacked, and not being able to recover it."

She said that a hacker was able to gain access to her Etsy account and take control of her store, see her customer's personal information, and attempt to reroute her sales and payment information to another bank account. The underhanded scammer was able to do this by gaining access to an old email account that belonged to Marisa.

Since this old email address was once associated with her Etsy account, they were able to get a password reset link forwarded to that address. After doing this, they were then able to set a new password and take control of her online Etsy store. Once Marisa saw this happen, she immediately contacted Etsy and let them know the deal.

She was able to regain control of her account and changed her password to a "very strong" one and even enabled two-factor authentication, which means that any new log-ins would have to ping a secondary device that only Marisa would have access to. This is usually done by pinging someone's smartphone through an installed application, or a text message that goes directly to the phone number associated with that account.

However, some security protocols only allow dual-factor authentication as an "option" which means that the previous method of resetting a password through an old email address could still theoretically work. This is what sounds like happened in Marisa's case, as the same hacker was able to get control of her account yet again.

In fact, the TikToker said in her video that her issues with the site's security has been happening for five days and she delineated the frustrating way this happens: she receives an automatic notification from Etsy that the email address for her account has been changed. In the email, there's a blurb that tells the account holder that if they didn't approve this change, they should go to a particular URL.

The issue is that the URL is "plain text" and when she uses that text to try and regain control of her account, she can't because the email address has been changed to another one she doesn't have access to, i.e. the hacker's email.

After it happened for the second time, she told Etsy that she wanted to delete her account, but was then informed by the site that she couldn't for "180 days because that's the return period for people who've bought things from you."

She then had to take matters into her own hands by finding the domain that the hacker's address was registered to: namecheap. Marisa then contacted their customer service department and let them know what the deal was. She said that they helped her immediately, but Etsy continued to be a nightmare to deal with, especially when it came to linking/un-linking her bank account information.

Although Marisa said that Etsy promised her they wouldn't allow there to be any changes made to her account in this regard it was ultimately a "lie" as the hacker was able to use her "full legal name" which they were only able to get because they managed to get access to her account in the first place to, once again, regain control of her online store.

She enlisted the help of an attorney, who suggested she report the hacking to the FBI's cyber crimes division, which she did. At the end of the video, a visibly frustrated Marisa ponders whether or not the hacker has a "friend inside" at the site and doesn't understand why Etsy is constantly allowing her online store to be compromised by this criminal.

She caps off her video by once again urging others to delete their Etsy account as, from her experience, she's seen that the site is "very susceptible" to security risks.

If what Marisa is saying is true and you're an Etsy seller, then you'll probably want to check and see which email addresses you've had associated with your account in the past.

If you still have access to those email accounts and no longer use them, then you may want to delete them or change their passwords to something ridiculously difficult to crack if deleting isn't necessary.

Enabling dual-factor authentication is also generally a good rule of thumb, too.

Have you ever had site security issues with Etsy?