Scam Watch: Phishing DMs Impersonating Etsy Support Are Hitting Seller Inboxes This Week

Sellers have been comparing notes since Monday about a new round of phishing messages arriving through Etsy’s own in-app Messages system, not email. Several threads in the usual seller forums and the r/Etsy subreddit describe near-identical messages: a shop name that reads something like “Etsy Trust & Safety” or “Etsy Support Team,” a warning that the shop has been flagged for a policy violation, and a link to “verify” the account before it gets suspended.

This follows the fake suspension email we covered last week, but it’s a different delivery method, which is worth sitting with for a second. Email phishing is old news to most sellers at this point, and a lot of people have gotten reasonably good at spotting it. A message that shows up inside Etsy’s own Messages tab, sitting in the same inbox as real buyer conversations, is a different psychological setup. It looks like it belongs there.

What the messages actually look like. From what sellers have posted, the pattern is consistent: an account with a name designed to look official, a message claiming an “urgent account review” is needed, and a link that goes to a login page built to look like Etsy’s sign-in screen. The page asks for username, password, and in some versions, a two-factor code. A few sellers reported a second variant that skips the fake login page and instead asks the seller to reply with their registered email and a “verification PIN,” which is really just the 2FA code Etsy sends when someone else is already trying to log in.

Why this works on Etsy specifically. Etsy’s messaging system doesn’t label official accounts any differently than seller or buyer accounts. There’s no blue-check equivalent inside Messages the way there might be on some social platforms. A convo thread from “Etsy Support” looks, at a glance, exactly like a convo thread from anyone else, because nothing in the interface distinguishes it. That’s not a flaw unique to this scam, but it’s the gap this particular wave is built to exploit.

What Etsy actually does. Etsy’s real support communicates through help center tickets you open yourself, not through unsolicited convo messages warning of imminent suspension. Per Etsy’s own guidance on protecting yourself from phishing scams, Etsy will never ask for your password or other sensitive information over Messages, and it does not ask sellers to log in through a link sent in Messages or provide a 2FA code by reply. If your shop has an actual policy issue, it shows up in Shop Manager directly, under your account status, not exclusively through a DM that also happens to include a countdown clock.

What to do if you get one. Don’t click the link from inside the message. Close the conversation, open a new browser tab, and check your shop status directly through Shop Manager or by logging in to etsy.com the way you normally would. If there’s a real issue, it’ll be visible there. If there’s nothing there, the message was fake. Etsy has a “Report” option on individual conversations, under the three-dot menu, and that’s the right way to flag it, both to get it off your plate and to feed Etsy’s own abuse detection. If you already clicked through and entered a password, change it immediately, through etsy.com directly rather than any link from the message, and check whether two-factor authentication is turned on for your account. If it isn’t, this is a good week to turn it on.

We’ll keep tracking this one. If the volume of reports keeps climbing through the week, or if Etsy puts out anything specific about it, we’ll follow up. For now, the practical move is the boring one: verify account status through the app or site directly, never through a link inside a message, official-looking or not.