eBay account security is four controls working together, which are 2 step verification, a unique password on a separately secured email account, Team access instead of shared logins, and a monthly check of payout and contact details. Once 2 step verification is on, eBay says a person who has your password still cannot get in without the second confirmation. That single setting removes most of the takeover risk we see. The other controls close the gaps that remain, such as the email account that can reset your eBay password, the staff member whose device is compromised, and the payout account change that goes unnoticed for weeks. When eBay suspects an account has been taken over, it may place a temporary hold until it can safely return control to the owner, and a seller’s payouts may be held while the account is restricted. The controls below keep you out of that position, and each one takes minutes to set up.

How eBay Seller Accounts Get Taken Over

eBay’s hacked account page lists the signs of a takeover, including changes to your password, contact information or address details, bids, offers or purchases you did not make, and listings you did not create. Behind those signs, the routes in are few and predictable. In the cases we see, almost every takeover starts in one of four ways.

Phishing

A spoof email copies eBay’s branding to get you to sign in on a fake page or open a file. Fake suspension and payment notices work best, because they create urgency. eBay gives a clean test for account notices. When eBay restricts or suspends an account, it emails the registered address and also posts a message in eBay Messages with the reason and next steps. eBay’s restrictions page says that if you cannot find a copy of the email in Messages, it was not from eBay. Do not click links or open attachments in a suspicious message. Forward it to spoof@ebay.com, which eBay’s security tips page names as the reporting address.

Password reuse

A password used on another website is exposed whenever that site is breached. eBay’s account security tips tell members not to reuse a password from any other account. A reused password is the easiest route in, because the intruder does not need to trick you at all.

Shared logins

Many sellers give their password to staff, virtual assistants or agencies. The eBay User Agreement, in the version effective June 28, 2026 for existing users, lists sharing your log in credentials with any third parties among the things members may not do. Apart from the policy issue, every person who holds the password is another device and another inbox that can be compromised. Shared logins also make a real takeover harder to prove, because the account already shows activity from many places.

Acquired accounts

An account bought from or handed over by someone else may still be reachable by the previous holder through the password, the recovery email or the phone number. The same agreement prohibits transferring an eBay account, including feedback, and a user ID to another party without eBay’s consent. An acquired account carries security risk and policy risk at the same time.

A first takeover compared with a repeat takeover

eBay does not publish separate tiers for security holds. What changes with a repeat is the question the reviewer has to answer. After a first takeover on a well-kept account, eBay mainly needs the owner to change the password, restore changed details and confirm the listings. After a second or third, eBay has reason to ask whether the account is controlled by the person asking for it, and whether the owner’s setup makes it unsafe to return control. Accounts with shared logins, mismatched registration details or a history of acquired access are where holds last longest. Strong security after the first event is what keeps a second event from turning into an ownership review.

Why sellers face more risk than buyers

A seller account holds things an intruder wants, such as a payout account, active listings that buyers trust, and saved payment methods. Changing the payout account diverts money. Creating fake listings collects payments from buyers. The damage reaches your feedback, your buyers and your cash flow, and the recovery can include a temporary hold that stops sales. Our guide on recovering a hacked eBay account after a temporary hold covers that recovery in full.

Turning On 2-Step Verification

With 2 step verification on, every sign-in needs a code or an app confirmation on top of the password. A stolen password alone stops working. eBay offers three methods, and the setup steps below follow eBay’s tips for keeping your eBay account secure.

The screens a seller moves through to switch on eBay 2 step verification and keep it on. Step through each screen in the order eBay sets out.

The eBay app

Sign-ins are confirmed with a push notification in the eBay app. eBay’s steps are to download the latest version of the app, sign in, go to My eBay and tap Settings, go to Sign in and security, choose 2 Step Verification, and tap Turn on beside Use the eBay app. This is the simplest method for a single owner who always has their phone.

Text message

A code is sent by SMS. eBay’s steps on the web are to sign in, open Account settings from the menu under your name, select Sign in and security, select Edit next to 2 Step Verification, select Use text next to Text messages on mobile, and add your mobile number. eBay notes that landlines are not supported and that a code is only valid for 15 minutes.

Authenticator app

A one-time passcode is generated by an authenticator app. eBay’s steps are to open Sign in and security, select Edit next to 2 Step Verification, select Authenticator App, install an authenticator app, scan the QR code and confirm the 6-digit code on eBay. eBay names Google Authenticator, Microsoft Authenticator and Authy as examples.

Which method to choose

For a business, we prefer the eBay app or an authenticator app over SMS, because neither depends on a phone number that can be ported or reassigned. To switch methods or turn the feature off, you repeat the same steps. eBay emails you whenever 2 step verification is switched on or off, so an unexpected email of that kind is an alert, not a receipt.

When codes do not arrive

eBay’s security page includes troubleshooting that saves time when a team first switches on 2 step verification. If you request an email code, leave the browser window open until it arrives, because leaving the sign-in page, closing it or going back revokes the old code and produces an invalid code error. Enter codes within the 15-minute window, and check the spam folder for email codes. For SMS, confirm the phone can receive texts and has reception, check which SIM is active on phones with two SIM cards, keep the network type on automatic, and be aware that some messaging apps that encrypt SMS can stop eBay’s texts from arriving. A team that knows these points is less tempted to switch 2 step verification off after one failed sign-in.

Trusted devices

When you sign in with 2 step verification, eBay may offer “Remember this device.” A trusted device may not be prompted for a code on later sign-ins. eBay allows up to 100 trusted devices and lets you check them at any time in the Security Center. If you change your 2 step verification method or remove a trusted device, you need to add it again. Keep the list short. Every trusted device is a device that can sign in with only the password.

Passkeys

eBay also supports passkeys, which let you sign in with a fingerprint, face recognition, a pattern or a PIN instead of a password. eBay states passkeys help protect the account against unauthorized access and that biometric data is never shared with eBay. You add one from Account, then Sign-in and security, then Passkeys. eBay lists eligible devices, including Apple devices on iOS 16, iPadOS 16 or macOS 13 Ventura and later, Android 9 and later with Chrome, and Windows 10 and later. Passkeys are set per marketplace, so selling on eBay.co.uk as well as eBay.com needs a passkey on each or another sign-in method.

eBay account security prevention control checklist

2 step verification on, using the eBay app or an authenticator app.
Trusted devices reviewed and limited to devices the owner controls.
A unique eBay password used on no other site, or a passkey.
A separate, unique password on the email account linked to eBay, with its own two-factor protection.
No shared passwords. Staff and agencies on Team access with only the permissions they need.
Payout account confirmed monthly as the owner’s own, in the owner’s name.
Contact details and addresses confirmed monthly.
All account notices confirmed in eBay Messages before acting on them.
A written record of each review, with the date and the person who completed it.

If a takeover already left a limit on selling, the fix runs through a different process, set out in our walkthrough on removing an eBay selling restriction.

Where an intruder changed the recovery email and phone before you noticed, our eBay suspension team can map every unauthorized change before you contact eBay.

Password and Email Hygiene

eBay asks members to change their password regularly and to make it strong and hard to guess. Leave out your name, birth date and user ID. A phrase with numbers and special characters works well, and it must not match a password on any other account.

The email account is part of your eBay security

The email address on your eBay account receives password resets and account notices. If someone controls that inbox, they can take the eBay account without knowing its password. eBay’s guidance is to keep your email password different from your eBay password, and to change both if you think the eBay account was compromised. We go one step further for sellers. Turn on two-factor protection on the email account too, and use an email address that is used for the business and nothing else.

Keep contact details current

eBay emails you when a device you have not used before signs in, and tells you to contact eBay and change your password if you do not recognize it. A phone number you no longer hold, or an old inbox you no longer check, means that warning lands nowhere. eBay also asks members to review My eBay and their preferences regularly and to report unauthorized changes right away.

Phishing discipline

Never sign in through a link in an email about your account. Open eBay directly.
Confirm every notice in eBay Messages before acting on it.
Do not open attachments in messages that claim to be from eBay.
Forward suspicious messages to spoof@ebay.com.
Train anyone with Team access on the same rules.

Monitoring Payout Account Changes

The change that costs a seller most is a payout account redirected to someone else. eBay pays sellers to a linked checking account or a Visa or Mastercard debit card, and its page on registering as a seller states that the names must match, meaning your first and last name for a personal account, or the business name used to register on eBay for a business account, with a business checking account for a business eBay account.

What to check each month

The linked payout account or card is yours, with the correct bank name and last digits.
The name on the payout account matches the eBay account.
eBay payout records match deposits in your bank statement.
No hold appears in the Payments tab of Seller Hub or My eBay, where eBay’s Payments Terms say hold amounts and status are displayed.
No unfamiliar payment method has been added for fees.

When you change the payout account yourself

The current eBay Payments Terms of Use carry a posting date of October 21, 2026 and take effect November 4, 2026 for sellers who registered earlier. They state that eBay may withhold payouts until you have provided information it asks for. If you change banks, expect verification by bank login, two microdeposits that can take up to 4 business days to arrive, or a statement. eBay accepts a color picture or PDF of up to 10MB, no more than 3 months old, showing your name, your eBay address, the bank name and the last 4 digits of the account. Screenshots and voided checks are refused. Plan changes for a quiet period, so a verification delay does not land on a busy sales week.

When the change is not yours

Change it back, tell eBay, and contact your bank. eBay’s Payments Terms require you to notify eBay right away of any unauthorized, delayed or incorrect payment. eBay’s page on getting help with a hacked account also tells you to contact your credit card company and your bank if someone used the account without permission, and to consider a police report. Our guide on eBay hacked account holds and your payouts covers the steps in order.

The first hour after an alert

Speed limits the damage. When a new-device email, a 2 step verification change email or an unexpected listing appears, we work through a fixed order. Open eBay directly, never through the email. Change the email account password, then the eBay password. Confirm the email address and phone number on the account. Confirm the payout account. Scan active listings and recent bids and offers. If anything changed, follow eBay’s hacked account steps and contact eBay. If nothing changed, write a short note of what you checked and when. That note becomes useful evidence if the same device or the same pattern appears again.

The alerts that tell an eBay seller something may have changed on the account, and the fixed order we work through for each. Open an alert to see it.

Weekly review routine with owner and evidence for each step

Notices. The owner is the account owner. Check eBay Messages for security, restriction or verification notices. The evidence is a dated note.
Sign-in alerts. The owner is the account owner. Review any new-device sign-in emails from the week and confirm each one. The evidence is a short list of confirmed devices.
Listings. The owner is the listings lead. Scan active listings for anything not created by the team. The evidence is a yes or no line.
Team access activity. The owner is the account owner. Review the activity log for unexpected actions. The evidence is notes on anything unusual.
Payout and holds. The owner is the finance lead. Confirm the payout account is unchanged and the Payments tab shows no unexpected hold. The evidence is a dated confirmation.
Phishing. The owner is the whole team. Report any suspicious messages received. The evidence is a count of messages reported.

When a restriction lands on top of a payout change, the money questions get their own answers in our breakdown of selling restrictions with payouts on hold.

Quarterly Access Review

Once a quarter, review who can reach your account and how. People change roles, contractors finish projects and devices are replaced. A quarterly review stops old access from lingering.

Team access

eBay’s Team access lets other users perform tasks on your behalf, and eBay states your password and personal account details are not shared with them. You need to be opted in to Seller Hub, each invited person needs their own eBay account, and invited accounts must turn on two-factor authentication. Pending invitations expire after 24 hours, so send them when the person is ready to accept. You choose permissions from eBay’s list, which covers drafts, publishing and revising listings, viewing and downloading orders, tracking and shipping labels, Product Research, refunds and disputes, promotions and buyer groups, advertising campaigns, and member to member messages. Invited users can act only in Seller Hub and only for the tasks you permit.

Each quarter

List every user on the Team access page and confirm each still needs access.
Reduce permissions to what each person uses.
Remove anyone who has left. eBay lets you change or remove permissions from the Team access page.
Review the activity log under My eBay, Account, Team access, Activity. It shows each action with dates, times and the account that completed it.
Confirm no one is still signing in with the owner’s password.

Devices and sign-in methods

Review trusted devices in the Security Center and remove any that are replaced or unrecognized.
Confirm 2 step verification is still on and the method is still right for the business.
Confirm passkeys are on current devices only.

Identity and registration

eBay’s Payments Terms require you to keep your information accurate and current, and note that changing key details may require repeating onboarding steps. Use the quarterly review to confirm your registered name, address and business details still match your documents. The INFORM Consumers Act took effect on June 27, 2023. US sellers who meet its high-volume threshold, which eBay describes as 200 or more new or unused items totaling more than $5,000 in a 12-consecutive-month period over the last 24 months on ebay.com, must keep bank, tax and contact information current, and eBay asks them to confirm it annually. eBay’s INFORM Consumers Act page adds that once a seller reaches $20,000 in annual eBay revenue, the seller’s name and physical address appear in buyers’ order details unless an exception applies. A takeover that edits those details changes what buyers see. Our guide on eBay MC001 registration and identity verification explains what eBay checks.

Business Models and How to Run Them Securely

Sellers who share logins with staff or virtual assistants

Access from many devices on one password looks like a takeover and hides a real one. Move every person to Team access, set the narrowest permissions, and change the owner’s password once everyone is moved. eBay’s own Team access page suggests that employees create a new eBay account used only for your business tasks, which keeps their personal activity separate.

Agencies managing several stores

An agency should hold no client passwords. eBay notes there is no limit to the number of accounts a single eBay account can be given access to through Team access, and authorized users switch between accounts from a banner in Seller Hub. This also helps keep unrelated client stores from looking connected. Our guide to running multiple eBay accounts within the linked account rules explains why that matters.

Owners who reuse passwords

Give eBay and the linked email account unique passwords, turn on 2 step verification on both, and consider a passkey for eBay. A password manager makes unique passwords practical.

Sellers who bought or inherited an account

The User Agreement prohibits transferring an account without eBay’s consent. An account acquired that way carries an ownership problem that no security setting resolves, and in a takeover the person asking for control may not match the registration. Do not buy or accept eBay accounts.

Regional Differences and the Law

eBay’s security tools are the same across its sites, with one practical difference, because passkeys are set per marketplace. The legal framework around a security restriction depends on where you sell. The table sets out the rules we work from for sellers on eBay.com, the EU sites and eBay.co.uk, as general information rather than advice on a specific case.

Region	Law or term	Relevance to account security
United States	eBay Payments Terms of Use and User Agreement	Sellers are responsible for keeping login credentials safe and for actions taken on the account unless seller protections apply, must report unauthorized payments right away, and may not share credentials with third parties.
United States	INFORM Consumers Act, 15 U.S.C. 45f, effective June 27, 2023	High-volume sellers must provide bank, contact and tax information within 10 days of qualifying, and certify changes within 10 days of a notice that comes at least annually. The marketplace must suspend future sales activity until missing information is provided.
European Union	Platform-to-Business Regulation, Regulation (EU) 2019/1150, Articles 4 and 11, applying from 12 July 2020	Business users receive a statement of reasons on a durable medium for a restriction or suspension, 30 days’ notice before full termination, and an internal complaint-handling system.
European Union	Digital Services Act, Regulation (EU) 2022/2065, Articles 20, 21 and 30, applying from 17 February 2024	Traders must give their name, address, phone and email before selling to EU consumers. A restricted user can complain internally for at least six months after the decision and can use a certified out-of-court dispute settlement body.
United Kingdom	Retained Regulation (EU) 2019/1150, Article 4	A statement of reasons for restrictions and suspensions, and 30 days’ notice before full termination unless an Article 4(4) exception applies.

For EU business sellers, the DSA point is practical. eBay’s Digital Services Act page says business name, address, verified email and phone, and any registration number show on listings available to EU buyers, with no exceptions for registered business sellers. An intruder who edits the email or phone under Account Settings, Public business information redirects your buyers to them. Add that page to the monthly check.

Frequently Asked Questions

How do I protect my eBay seller account?

Use 2 step verification, a unique password and a secured email account. Give staff Team access instead of your password, confirm notices in eBay Messages, and check payout and contact details every month.

What changes should I watch for?

Watch for payout account, email, address and listing changes you did not make. eBay also lists changed passwords, bids, offers or purchases you did not make, and listings you did not create as signs of a takeover. New-device sign-in emails are an early warning.

What does eBay do if it detects unauthorized access?

It may place a temporary hold on the account. eBay says the hold can stay until it can safely return control to you, and that it can help remove unauthorized bids or listings. Seller payouts may be held while the account is restricted.

Can my staff share my password?

No, shared passwords raise takeover risk, so avoid them. eBay’s User Agreement prohibits sharing log in credentials with third parties. Use Team access, which requires invited users to turn on two-factor authentication and logs their actions.

How often should I review account access?

At least quarterly. Review Team access users and permissions, trusted devices and sign-in methods, and remove anyone who no longer needs access. Check payout and contact details monthly and after any suspicious email.

Get Help With eBay Account Security

Most sellers can put these controls in place in an afternoon. Where we help is the situation where prevention came too late, such as when payouts were redirected, the intruder changed the recovery details, or eBay is asking who owns the account. Restoring control and funds then depends on a precise record of ownership and every unauthorized change, and that is what we build. If you are already dealing with a longer restriction, our guides on MC999 account warnings, MC999 account suspensions, indefinite suspensions and permanent suspensions explain each path.

Hand it to our eBay suspension and reinstatement service, submit your case for a free assessment, or book a consultation to review your security setup.

Sellers who also run Amazon, Walmart or Etsy stores can find the matching desks under our marketplace suspension services.

eBay Account Security Setup to Prevent Takeover Holds