This week’s pattern: fake “Purchase Protection update” phishing messages, directly exploiting this week’s genuine platform news about the Purchase Protection changes we’ve been covering.
The setup
Several sellers reported messages this week claiming to be from Etsy, stating their account needs to be “re-verified” or “updated” to remain covered under the new Purchase Protection changes, with a link requesting login credentials. This follows the exact same pattern we’ve flagged multiple times this year, a phishing attempt riding on genuine, currently-circulating platform news to appear legitimate.
Why this is a particularly effective version of the pattern
Given how much real, confirmed news there is this week about actual Purchase Protection changes, a fake message referencing the same topic has more surface credibility than a similar scam would have without genuine news to point to. This is precisely the mechanism we’ve described every time this pattern has recurred throughout the year.
How to tell the difference, once again
Any genuine Etsy communication about account status or coverage changes appears directly within Shop Manager, not through an externally linked login page, regardless of how current or accurate the referenced news appears. Etsy does not require account re-verification through an emailed link to maintain coverage under a policy update.
What to do if you receive one
Don’t click the link. Check Shop Manager directly for any actual account notices related to the Purchase Protection changes. If you’re unsure whether something is genuine, navigate to Etsy directly through your browser or app rather than through any link in an unsolicited message.
The pattern, once again, for what feels like the umpteenth time this year
We’ve now covered this same underlying mechanism, real news creating an opening for a convincing fake message, more times this year than almost any other single scam pattern. If you’ve read our coverage throughout the year, this should be immediately recognizable rather than a new threat. The defense remains exactly the same every time: verify through Etsy’s own official channels directly, never through a link in an unsolicited message, no matter how current and relevant the pretext.
