eBay account hacked

[mudskipper]

Turns out you can't automatically log the account out of all connections. Nice touch, I feel. Really good for security.

yep, that was my thought - changing your password doesn't log out other devices. Pretty crappy.

<checks ebay password>

[ladymuck]

Well a call with eBay later and they say my account has now been secured and the two buyers will be helped.

Not entirely sure what they've done but I'll see if any additional listings turn up tomorrow.

In poking around the site settings, I did find several third party things that had been set up over the past 48 hours which I suspect are auto listing things. I revoked them before eBay did my account securing so I'll double check they are still done.

Turns out you can't automatically log the account out of all connections. Nice touch, I feel. Really good for security.

[ladymuck]

So some fecker has hacked my eBay account. It had a lousy password and no 2FA so my own fault. Password changed and 2FA now enabled.

The hacker just put up a crappy bulk item listing and I deleted it. I noticed that the payment didn't seem to have come through properly so told the buyer (giving them benefit of the doubt that they weren't the hacker) to make sure their PayPal account wasn't debited. eBay won't let me cancel the sale, says I have to wait a few minutes (24 hours later is more than a few minutes). There didn't seem to be any proper facility for reporting "some fecker has hacked my account" so I reported myself for fraudulent listing and got a template reply.

I made 100% sure that the listing was not active and that it was entirely deleted from things like drafts and scheduled and unsold. I have nothing that could be reactivated, as far as I can see.

So, imagine my surprise that I've sold another item!

So, now going through the same rigmarole with another user. Another round of making sure the listing doesn't exist anymore. Another odd PayPal transaction that goes to page cannot be found. The PayPal destination settings were not changed on my account so in theory the money should be coming to me (or can you pick another account on a per listing basis? I don't use it often enough to know).

The item was relisted at 0251 this morning. How? This is what I now need to know. I didn't receive any emails to confirm a successful listing had started (I will see if that's something I'd previously switched off). Is a random password from a password manager and 2FA so easy to bypass that someone can still get into my account?

eBay won't let me close my account because I owe them for listing fees. If I paid that, I would still have to wait 30 days. Absolute farce.