r/Mercari • u/1chiban1 • 23h ago
GENERAL Account got breached under mysterious circumstances. Mercari needs better security and customer support.
For context, I exclusively use Mercari on my phone, I have 2FA via both SMS and Email.
I wake up to 23 notifications from Mercari on my phone, which is quite unusual for me as a seller, as I'm just a small time seller. I open the app and see that my profile picture and name was changed to fit the common Mercari admin scam and that the malicious individual who got into my account had DM'd over 50+ people to try to scam.
Overall I'm quite puzzled because I know I wasn't cookie logged since I definitely never tap any sort of links on my phone as I use it exclusively for apps, messaging, and calls, so I have absolutely no idea how someone could get into my account and it didn't notify me via email or SMS. Maybe another data breach happened? None of my information was changed, my email was the same, phone number, password and so was the banking information. They didn't use my card for any purchases either and luckily I didn't have a balance. I don't know how they were able to access my account and I'm not sure why my account was the target to be the catalyst of this scam, they could've done the same thing with any account really, I don't think reviews really change anything when it wouldn't really make sense to have them to be able to pull this off.
I immediately secure my account by checking all my information and resetting my password, and then I started messaging back all the people that the scammer had DM'd to tell them to ignore the message and not to do what it says so they don't fall for the scam.
I contacted customer support and surprisingly they replied within 10 minutes, but told me that my situation was more advanced so they would notify other teams. A few hours later, someone else replies to my inquiry and honestly they don't really do much except ask me to reset my password, restore the email to what it was previously (It wasn't even changed in the first place), and they asked me for my ID verification.
At this point, I thought everything was all good to go and that I could move on, however, a few hours later, my account is restricted for "unusual activity". Not really sure why, I'm assuming that despite me contacting support immediately and prior, they still put limitations on my account after everything was resolved? So I contact them again today, sort it all out and go through the same routine as before. So far, everything is working properly again and my account isn't limited anymore, but why on earth does imposing limitations on account DELETE ALL YOUR LISTINGS?
Overall, I think Mercari needs stronger security, especially when the current security they have is seemingly easily bypassable. Other apps would automatically secure your account for you if the login IP and location are suspicious. Additionally, I don't think account limitations should delete all of your listings, why doesn't it just de-activate all of them instead?