Etsy requires two-factor authentication to open a new shop, but for sellers who opened their shop earlier it is still optional. Many established shops heading into their busiest weeks of the year are protected by a password alone.
Never Miss a Craft-Seller Story
Daily updates on marketplace news, seller tactics, and more, straight to your inbox.
Table of Contents
- Introduction
- Why a Strong Password Alone Falls Short
- Your Email Account Is the Front Door
- Step-by-Step: Securing Your Etsy Account Before Black Friday
- Common Account Security Mistakes in Q4
- Tools and Resources
- Worked Example: A Two-Person Print Shop Runs the Checklist
- If You Think Your Account Is Already Compromised
- Frequently Asked Questions
- Key Takeaways
- The Bottom Line
Introduction
An Etsy seller account holds more than a login. It holds your listings, your buyers’ addresses, your sales history and the bank account Etsy pays out to.
Losing access to it in late October is bad. Losing it the week of Black Friday, with orders stacking up and no way to message buyers, is far worse, and recovery through Etsy Support can take days.
This guide walks through the account security settings Etsy offers sellers, in the order that protects the most for the least effort. It is based on Etsy’s Help Center articles on account security, suspected fraud and Etsy Payments bank details, checked in October 2026. Here’s exactly how it works.
Why a Strong Password Alone Falls Short
A long, unique password protects you against guessing, but most account takeovers don’t involve guessing at all.
They involve a password the seller typed into a fake page, a password reused from a site that leaked it, or a password reset sent to an email account someone else already controls. A strong password does nothing in any of those three cases.
Etsy’s own password advice is still worth following. Its Help Center recommends at least 8 characters, a mix of upper and lowercase letters, numbers and symbols, and avoiding reused passwords, names and birth dates (Etsy Help: How to Make Your Account More Secure). It also suggests changing the password every 6 months and using a password manager.
Question is:
What stops someone who already has your password?
That’s the job of the second factor, and of the email account behind it.
Your Email Account Is the Front Door
Whoever controls the email address on your Etsy account can usually reset the Etsy password, so the email account deserves at least as much protection as Etsy itself.
Etsy’s article on suspected fraud lists changing the password on your linked email account as one of the first steps after a compromise (Etsy Help: What to Do if You Suspect Fraud in Your Etsy Account). The same article explains that when an account’s email address is changed, Etsy sends a message to the old address with instructions to reverse the change.
That safeguard only works if you still control the old address. If an attacker is already inside your inbox, they can read Etsy’s warning before you do.
So the order matters. Secure the email first, then Etsy.
What to check on the email account
- Turn on two-step verification with your email provider, using an authenticator app or security key where offered.
- Change the email password if it has ever been used anywhere else.
- Look at the provider’s recent sign-in or device list and sign out anything you don’t recognize.
- Check for forwarding rules or filters you didn’t create. A rule that forwards or deletes messages from Etsy is a common sign someone has been inside the inbox.
- Confirm the recovery phone number and recovery email are ones you still own.
If you only have twenty minutes this week, spend ten of them on the email account.
Step-by-Step: Securing Your Etsy Account Before Black Friday
Here’s how to do it. The whole checklist takes about an hour for a solo shop, and it’s best done before November, while order volume is still manageable. Black Friday falls on November 27, 2026.
Step 1: Turn on two-factor authentication
What: add a second sign-in step to your Etsy account.
Why: with two-factor authentication (2FA) on, a stolen password alone isn’t enough to get in.
How: on Etsy.com, go to You, then Account settings, then Security, and switch on two-factor authentication. Etsy’s Help Center says you can receive codes by text message, by phone call, or through an authenticator app, and that calls and texts are only available in certain countries. Where they aren’t, you’ll need an authenticator app.
Etsy’s Help Center says that once 2FA is on, you’ll need a verification code when you sign in from a new browser or device, and every 30 days. It’s a small amount of friction for the protection it buys.
Example: a seller with a shop opened in 2019 never had to set up 2FA, because the requirement covers opening new shops. She turns it on in October and picks an authenticator app, so her codes don’t depend on her phone signal at a craft fair.
Etsy calls 2FA “strongly recommended” for existing sellers. It is the single setting that blocks the most common way shops get taken over.
Step 2: Choose your code method with care
What: pick the 2FA method that fits how you work.
Why: each method has a weak point, and you want the one you’re least likely to lose.
How: an authenticator app (Google Authenticator, Microsoft Authenticator, or a password manager with codes built in) works without a phone signal and doesn’t depend on your phone number. Text and call codes are easier to set up but depend on your number. If your carrier account is ever hijacked through a SIM swap, text codes go to the attacker.
Example: a seller who travels to holiday markets picks an authenticator app, then adds the same account to a password manager on her laptop so she isn’t locked out if her phone dies.
Step 3: Save your backup codes somewhere you’ll find them
What: download or copy the backup codes Etsy gives you during 2FA setup.
Why: backup codes are how you get back in if you lose your phone, change your number or delete the authenticator app.
How: Etsy’s Help Center says each backup code works once and the codes are shown only once, so save them right away. Store them offline or in a password manager, not in a note on the same phone that generates your codes.
Etsy also states that Etsy Support will never ask you to share account or personal information through Messages, email or social media. Anyone asking for your backup codes is not Etsy.
Example: a seller prints her codes and keeps them with the shop’s tax paperwork. When her phone is stolen at a market in December, she signs in on her laptop with one code and resets her authenticator.
Step 4: Review your sign-in history
What: check which devices and sessions are signed in to your account.
Why: an old session on a shared or lost device is an open door.
How: in Account settings, under Security, Etsy shows up to your 10 most recent sign-ins, according to its Help Center. You can sign out of any session you don’t recognize, such as one left open on a library or market computer. If you see a location or device that isn’t yours, sign it out and change your password straight away.
Example: a seller finds a session from a laptop she sold in the spring. She signs it out, then reminds herself to factory-reset old devices before selling them, which Etsy’s security article also recommends.
Step 5: Turn on security alerts and update your contact details
What: make sure Etsy can reach you when something unusual happens.
Why: an alert about an unfamiliar sign-in is only useful if it reaches you within minutes.
How: Etsy’s Help Center says security text alerts need a verified mobile number, and landlines aren’t accepted. Keep your email address and phone number current in Account settings so alerts about unusual sign-ins or account changes reach you.
Etsy also says its authentic security alerts won’t contain any links. That gives you a simple test. A “security alert” text with a link in it should be treated as phishing. Our coverage of phishing messages impersonating Etsy Support and the fake Etsy suspension email shows what those messages tend to look like.
Example: a seller gets a text saying her shop will be suspended unless she verifies her account at a link. Etsy’s own alerts carry no links, so she deletes it and signs in to Etsy directly to check. Nothing is wrong.
Step 6: Review third-party connections
What: check which outside apps and services can access your shop.
Why: every connected tool is another way into your shop data, and old connections tend to outlive the tools you stopped using.
How: Etsy’s security article suggests reviewing third-party connections and removing anything you don’t recognize. Keep the tools you use every week, such as a keyword tool or a print-on-demand partner, and remove trial apps you abandoned. Our fresh look at eRank’s free plan and our guide to evaluating a bulk editing tool cover the kinds of tools sellers commonly connect.
Example: a seller finds five connected apps. Two are tools she still pays for; three were free trials from 2024. She removes the three.
Step 7: Check your payment and bank details
What: confirm the bank account Etsy deposits to is still yours and still correct.
Why: an attacker who changes the deposit account can redirect your earnings, and you want to know your own details before a busy month.
How: Etsy’s security article recommends sellers regularly review payment and billing details. Open Payment settings in Shop Manager and confirm the bank account. If you need to change banks, know the timing first. Etsy’s help article on updating bank details says that after a bank account change, your net earnings become available for deposit 5 days after the update (Etsy Help: How to Update and Verify Your Bank Account for Etsy Payments Deposits). The same article says Etsy may send a small verification deposit that you confirm on Etsy, and that bank details must be verified within 60 days or the shop is suspended.
Don’t change your deposit bank in the middle of Q4 unless you have to. If a change is needed, make it in October so the delay lands before your biggest weeks. Our guide to avoiding an Etsy payment reserve covers the other cash-flow surprises worth heading off now.
Example: a seller switching to a business bank account makes the change on October 25, accepts the 5-day delay in a quiet week, and confirms the verification deposit before November.
Step 8: Limit who has your login
What: decide who can sign in to the shop, and how.
Why: Etsy’s Help Center reminds account holders that they’re responsible for activity on their account, and every person who knows the password is another place it can leak.
How: if a seasonal helper only packs orders, they may not need to sign in at all. Print packing slips and shipping labels for them instead. If someone does need access, share the password through a password manager rather than a text message, and change it once the season ends. Our guide on when to bring on seasonal help covers what to hand over and what to keep.
Example: a seller hiring a packer for December gives them a printed pick list each morning. The packer never needs the Etsy password, so there’s nothing to change in January.
Step 9: Write down your recovery plan
What: keep a one-page note of what to do if you’re locked out.
Why: during a lockout you won’t want to be searching help articles from your phone.
How: list where your backup codes are, the email account and its recovery options, how to reach Etsy Support, and your buyer communication plan if you lose access for a few days. Our mailbag answer on how to reach a human at Etsy Support covers the support route.
Example: a seller keeps the note in the same folder as her backup codes, alongside her processing times plan, so one folder covers both a lockout and a production delay.
Common Account Security Mistakes in Q4
Most takeovers trace back to a handful of habits. Five come up again and again.
Clicking the link in an urgent message
Fake suspension notices, “verify your shop” texts and messages claiming a buyer’s payment is on hold all push you to act fast. Open Etsy yourself and check from there. Etsy says genuine security alerts contain no links, and that Etsy Support won’t ask for account details through Messages, email or social media. Our weekly Scam Alert roundup tracks the current versions.
Leaving a dormant shop unprotected
Sellers often assume a shop they stopped using is safe because it’s quiet. In October 2022, ValueAddedResource reported several cases where old, dormant Etsy shops were taken over and used to sell items that didn’t exist, including one Vancouver shop whose owner said more than 300 customers had been scammed (ValueAddedResource: Does Etsy Have an Account Security Problem?). If you keep an old shop open, give it 2FA too, or close it.
Reusing the Etsy password elsewhere
If your Etsy password matches the one on an old forum or supplier site, a leak there is a leak here. Etsy’s suspected-fraud article tells sellers to change other accounts that share the password. Change Etsy’s to something unique and let a password manager remember it.
Ignoring the “temporarily limited your access” message
Etsy’s fraud article says the “Our security team has temporarily limited your access” message is a precaution, not proof your account was hacked. The fix it gives is a password reset through the forgot password page. Check your spam folder for the reset email before contacting support.
Changing several settings at once in a panic
Changing the email, the password, the phone number and the bank in one evening can trigger extra security checks and lock you out longer. Work through the checklist calmly, one setting at a time, starting with the email account.
Tools and Resources
You don’t need to buy anything to do this. These help:
- Etsy Account settings, Security tab (free): 2FA, backup codes and sign-in history.
- An authenticator app (free): Google Authenticator and Microsoft Authenticator are free; many password managers include a code generator.
- A password manager (free and paid plans): generates unique passwords and stores backup codes.
- Your email provider’s security page (free): two-step verification, sign-in history and forwarding rules.
- Etsy’s Help Center: the account security article and the suspected fraud article are worth bookmarking, since menus move.
- Crafts Daily Wire’s Scam Watch: our Scam Alert series for the phishing patterns currently aimed at sellers.
Worked Example: A Two-Person Print Shop Runs the Checklist
The shop and numbers here are illustrative. They show the method, not a specific shop’s data.
Before: a two-person art print shop opened in 2020. It has about 150 listings and expects roughly 400 orders between Black Friday and mid-December. Both owners sign in with the same password, which is also used on their old website host. 2FA is off. The Etsy account uses a free email address with no two-step verification.
What they did, on one October evening:
- Turned on two-step verification for the email account, with an authenticator app, and changed its password.
- Found an old forwarding rule in the email, created years ago for a virtual assistant, and deleted it.
- Changed the Etsy password to a unique one stored in a shared password manager vault.
- Turned on Etsy 2FA with an authenticator app, then printed the backup codes and filed them.
- Reviewed sign-in history and signed out a session from a laptop they had sold.
- Removed two third-party apps left over from expired trials.
- Confirmed the deposit bank account in Payment settings and decided not to change banks until January.
- Wrote a one-page recovery note and stored it with the backup codes.
The time cost: about 70 minutes in total.
What it protects: if 400 orders average $40, that’s around $16,000 in sales over the period. A takeover in that window could mean missed messages, late shipments and a pause in deposits while the account is recovered. An hour of setup is cheap against that exposure.
The habit that sticks: each owner now gets a code prompt on a new device and every 30 days. They agreed that if either of them ever gets a “security alert” with a link in it, it goes straight to the trash.
If You Think Your Account Is Already Compromised
Act in this order. It follows Etsy’s suspected-fraud article, with the email step moved to the front:
- Secure the email account linked to Etsy. Change its password and sign out other sessions.
- Change your Etsy password. Go to You, then Account settings, then Password.
- Turn on 2FA under Account settings, then Security, if it isn’t on already.
- Change any other account that shared the same password.
- Check what changed: email address, phone number, bank account, listings, prices and shop policies. Etsy’s fraud article says an email change triggers a message to your old address with instructions to reverse it.
- Contact Etsy Support if you can’t get in to change the password. Our mailbag answer on reaching a human at Etsy Support covers the route.
- Tell open buyers what’s happening once you’re back in, especially if orders may ship late. Our guide to cutting response time during Q4 has message templates you can adapt.
If any buyer disputes a charge during the incident, our guide to handling an Etsy Payments chargeback covers the response.
Frequently Asked Questions
Is two-factor authentication required for Etsy sellers?
Etsy requires two-factor authentication to open a new shop. For existing sellers and for buyers it is optional, but Etsy’s Help Center says it is strongly recommended. You can turn it on under Account settings, then Security.
How often will Etsy ask for a 2FA code?
According to Etsy’s Help Center, you’ll need a code when you sign in from a new browser or device, and every 30 days. You won’t be asked on every sign-in from a device Etsy already recognizes.
Which 2FA method should I use on Etsy?
Etsy offers codes by text message, phone call or authenticator app. Calls and texts are only available in certain countries. An authenticator app works without a phone signal and doesn’t depend on your phone number, which makes it the sturdier choice for most sellers.
What are Etsy backup codes?
Backup codes are single-use codes Etsy gives you when you set up 2FA. You use them to sign in if you lose access to your phone or authenticator app. Etsy shows them only once, so save them right away somewhere offline or in a password manager.
Will Etsy ever ask me for my password or backup codes?
No. Etsy’s Help Center states that Etsy Support will never ask you to share account or personal information through Messages, email or social media. Anyone asking for your password or backup codes should be treated as a scammer.
How can I tell a fake Etsy security alert from a genuine one?
Etsy says its authentic security alerts won’t contain any links. If a text or email claiming to be an Etsy security alert includes a link, don’t click it. Open Etsy directly in your browser or app and check your account from there.
How do I see where my Etsy account is signed in?
Go to Account settings, then Security, to see your sign-in history. Etsy shows up to your 10 most recent sign-ins, and you can sign out of any session you don’t recognize.
What happens if someone changes the email address on my Etsy account?
Etsy sends a message to your old email address with instructions to reverse the change. If you didn’t make the change, follow those instructions, then change your password and turn on two-factor authentication.
Does changing my bank account on Etsy delay my deposits?
Yes. Etsy’s help article says that after you change your bank account, your net earnings become available for deposit 5 days after the update. Avoid changing banks during your busiest weeks if you can.
What does “Our security team has temporarily limited your access” mean?
Etsy describes it as a precautionary measure, not proof that your account was hacked. Etsy’s advice is to reset your password through the forgot password page and check your spam folder for the reset email.
Should I protect an old Etsy shop I no longer use?
Yes. Dormant shops have been taken over and used to sell items that didn’t exist, as ValueAddedResource reported in 2022. Turn on 2FA for the old account, or close it if you no longer need it.
How long does it take to secure an Etsy account?
For a solo shop, the full checklist in this guide takes about an hour. Turning on 2FA and saving backup codes takes only a few minutes, so start there if time is short.
Key Takeaways
- Secure the email account linked to Etsy first, because whoever controls it can usually reset your Etsy password.
- Turn on Etsy 2FA under Account settings, then Security; it is optional for existing sellers but strongly recommended by Etsy.
- Prefer an authenticator app over text codes where you can.
- Save your single-use backup codes offline; Etsy shows them only once.
- Check your sign-in history and remove third-party apps you no longer use.
- Treat any “Etsy security alert” with a link in it as phishing.
- Avoid changing your deposit bank during Q4, since earnings become available 5 days after a change.
The Bottom Line
Start tonight with the email account linked to your shop, then turn on Etsy 2FA and file your backup codes. Those three steps take under half an hour and close the most common ways shops get taken over.
Then work through the rest of the checklist before November, while order volume still leaves you time. Get Started with the rest of your Q4 prep by checking your Star Seller standing next, so a busy December doesn’t cost you on two fronts.
Disclaimer: Etsy settings, security features and policies change. Nothing in this article is official Etsy guidance, legal advice or financial advice; check Etsy’s Help Center and your Account settings for current options before making changes.
Related Articles
- The Fake Etsy Suspension Email Making the Rounds: what one of the most common phishing messages aimed at sellers looks like.
- How to Avoid an Etsy Payment Reserve Before Q4 Hits: the other way sellers lose access to their earnings in a busy month.
- How to Handle an Etsy Payments Chargeback: what to do when a buyer disputes a charge.
Also worth reading before Black Friday: our guide to using Etsy vacation mode without losing ranking and our Q4 production planning guide.
About This Research
Chloe Cruz writes Crafts Daily Wire and has spent four years writing about eCommerce.
This article is based on Etsy’s Help Center articles on account security, suspected account fraud and Etsy Payments bank details, plus ValueAddedResource’s October 2022 reporting on Etsy shop takeovers, all checked in October 2026. The worked example uses stated, illustrative numbers, not a specific shop’s data. Crafts Daily Wire is not affiliated with Etsy, Inc. Etsy settings and menus change; check Account settings for the current layout.
Content reviewed and updated: 2026-10-25
Connect With Us
Enjoyed This Story?
Subscribe for daily craft-seller news and tips.