Short answer: Sign in at etsy.com, go to Your account → Account settings → Security, and turn on two-factor authentication. Choose the authenticator app rather than SMS or phone call, scan the QR code, and save the backup codes. Sellers should then verify their bank deposit details, because that is what a takeover is actually aiming at.
What a compromised Etsy account costs
For a buyer: a saved payment method and an address history. Annoying, generally recoverable.
For a seller: considerably more. Your shop is a business with a review history, a bank account for deposits, and a customer list. The standard takeover script is to change the deposit bank details and then either let existing sales pay out to the attacker, or list high-value digital items cheaply and collect from buyers who never receive anything. The same payout-diversion script turns up on other marketplaces, which is why 2FA on an Airbnb host account matters just as much.
The damage that lasts is reputational. Reviews and shop age do not transfer to a new account, and a period of fraudulent listings under your name is not easily undone.
Step 1: Turn on two-factor authentication
- Sign in at etsy.com and click You (top right) → Account settings.
- Open the Security tab.
- Find Two-factor authentication and turn it on.
- Enter your password to confirm.
Step 2: Choose the authenticator app
Etsy offers three methods:
- Authenticator app — codes generated offline on your device. Choose this.
- Text message — exposed to SIM swap attacks, which are worth an attacker’s effort when there is a business behind the account.
- Phone call — same underlying weakness as SMS.
Select the app option. Etsy displays a QR code with a manual key. Scan it with Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or a password manager. If this is new, start with what is an authenticator app; if the QR will not scan, use manual key entry.
Do not screenshot the QR code. It contains your raw secret key — see what’s inside a 2FA QR code.
Confirm with the six digits, and Etsy will show your backup codes.
Step 3: Save the backup codes
Store them offline or in a password manager. Not in your shop’s Google Drive if that Google account also signs you into Etsy.
Etsy support can help with lockouts, but the process involves identity verification and takes time — time during which your shop keeps receiving orders you cannot fulfil. See where to store backup codes safely, and enrol a second device while the QR is on screen: how to back up your authenticator app.
Step 4: Check the money and the access
For sellers, this is the part that matters most:
- Deposit bank account — under Finances → Payment settings, verify the account is yours. Check it after any unusual login alert. Etsy notifies you when it changes, so do not filter those emails away.
- Email address — current, and protected with its own strong 2FA. Etsy recovery runs through it. See Google and Microsoft.
- Password — unique, from a password manager. Reuse is how most shop takeovers begin: credential stuffing.
- Shop managers — if you have added other people, review the list and remove anyone no longer involved. Pattern: 2FA for small teams.
- Third-party apps — printing partners, listing tools, analytics services. Revoke what you no longer use.
The scams aimed at Etsy sellers
2FA prevents account takeover. These do not need it:
- Off-platform payment requests. A “buyer” asking to pay by bank transfer or a payment app for a discount. You lose all seller protection, and the payment is often reversed or fake.
- Overpayment and refund scams — a buyer “accidentally” pays too much and asks for the difference back.
- Fake Etsy emails about policy violations, held funds, or account suspension. These lead to a login page that relays your credentials in real time — see can 2FA be hacked?
- Fake buyer messages with attachments — “here’s my custom design” files that carry infostealer malware, which takes session cookies and bypasses 2FA entirely (session hijacking).
- Requests for a verification code. Etsy never asks. See OTP scams.
The habit that covers most of it: read messages inside Etsy, never through an email link, and keep every transaction on the platform.
Frequently asked questions
Does Etsy support security keys or passkeys?
Not for standard accounts at the time of writing, so an authenticator app is the strongest option available. If a passkey option appears in your security settings, take it — see passkeys vs 2FA.
Which authenticator app works with Etsy?
Any standard TOTP app — Etsy uses the normal algorithm. See how TOTP codes work.
Why is Etsy rejecting my code?
Usually clock drift on your phone. Turn on automatic network time. More causes: why 2FA codes get rejected.
What if I lose my phone during a busy sales period?
Use a backup code, or your second enrolled device. Etsy support is the fallback and it is not fast — which is the argument for enrolling two devices at setup. See recovering accounts after losing your 2FA phone.
Can I turn 2FA off later?
Yes, from the same security page. Rarely a good idea on a shop — if the prompts bother you, note that Etsy only asks on new devices. See how to turn off 2FA safely.
My shop was taken over. What order?
Change the password and sign out all sessions, verify and correct the deposit bank account, remove listings you did not create, contact Etsy support, then secure your email account — that is usually the original entry point (what to do if your email is hacked).
The bottom line
Five minutes for the app and the backup codes, five more for the deposit account, shop managers and old third-party tools. And keep everything on-platform — because for Etsy sellers, the losses that actually happen come from conversations that moved to email, not from someone guessing a password.
Selling in more than one place? See our guides for eBay, Shopify and PayPal. If you promote your listings on social platforms, apply the same treatment to two-factor authentication on Pinterest.
One Response