eBay resetting passwords - why?

[oldwestgold]

I have been logged in most of the day working and just now got kicked off eBay stating they have changed my password and that I have to reset it. What the H is up with this? This was a legit eBay message and action and not a spoof. Does someone at eBay have nothing better to do?

[gwzcomps]

Has your account been compromised? That is the only reason I can think of. Or maybe someone tried to hack your account.

[oldwestgold]

Nope, I'm a 25 year IT Mgr and know all about passwords and security. I change my password monthly. The message didn't say anything about security or a breach. Of over 20 years here selling this is a first. Thanks for your reply though. Have a good day.

[gwzcomps]

Last year I had someone try to hack my account. This I got like 5 text messages for my code in a few seconds. eBay CS didn't seem overly concerned.

[coolections]

Ebay does not change your password ever. Almost every internet site on the planet requires users to change their password over a period of time. It is for your protection. I hope the message you got came from Ebay and not a hacker.

[oldwestgold]

Nope. The email stated they changed my password and I would have to reset it. The message came from eBay within eBay messaging system.

[mtgraves7984]

---

@oldwestgold wrote:

Nope, I'm a 25 year IT Mgr and know all about passwords and security. I change my password monthly. The message didn't say anything about security or a breach. Of over 20 years here selling this is a first. Thanks for your reply though. Have a good day.

---

@oldwestgold 

It is a bit unsettling. What is your take?

[oldwestgold]

Going with the flow and continuing to wonder why for now. I just have never experienced this before in 20+ years here. No real explanation or anything which is the norm of communication you get from eBay. Thanks for your concern. Have a good day.

[eburtonlab]

I seem to recall that eBay required a password change several years ago -- I had thought that was site-wide at the time, but I may have been mistaken about that. A google search turns up an article from 2014 about a data breach at eBay that resulted in requiring password changes; that might be the one I am thinking of.

Other than that, I do not think that eBay has required me to change my password since then, though I certainly have since then on my own.

A more targeted requirement might indicate some sort of identifiable threat (such as a simultaneous log in from another country or a suspicious attempt to change your account settings) or perhaps your current password has turned up on a most commonly used passwords list, or your password hash turned up somewhere it should not have.

[valueaddedresource]

@oldwestgold  just as I precaution, I would recommend double checking your payment policies/payment email address on your listings.

There was payment diversion fraud on eBay UK last year where the fraudsters would change the payment email on just a few listings to siphon off money to a different PayPal account.  I have seen at least one recent report of similar fraud on the US site as well.

https://tamebay.com/2019/07/hacked-ebay-account-changed-paypal-address-and-stole-20k.html

https://community.ebay.com/t5/Selling/I-was-hacked-eBay-is-clueless/td-p/31047559

[rebell45]

I received that message about 2 months ago, also in my eBay messages. I checked everything out and never found anything suspicious on my eBay or PayPal account. I think it was caused by a sudden uptick in my buying.

To help protect your account from unauthorized use, we’ve reset your eBay password and secret questions. We do this when we believe that your eBay password and username or email address have been obtained without your permission. Currently, eBay doesn’t have any knowledge about how this information may have happened. There are a number of ways to obtain this information. For example, someone may send emails claiming to be from a company that you do business with and then coerce you to reveal your personal information. Visiting harmful web pages that install malware on your computer can also put your personal information at risk.

We recommend taking the following steps to help keep your account secure:
1. Install or update anti-virus/anti-malware software on all devices that you use to access your eBay account and remove anything that the software finds. As a best practice, you should run scans regularly and ensure that your software is up to date.
2. Change your password on your personal email and any tools (e.g., item listing or bidding) that are linked to your eBay account.
3. Update your secret questions.
4. Verify that your contact information and other stored information is correct on your eBay account.
5. Change your eBay password and make it unique to eBay to avoid sharing of passwords on other accounts you maintain.
6. Turn on 2-step verification to protect your account by adding an extra layer of security.

For more information on changing your eBay password, visit:

[inceptions]

On many if not most websites, they will require a password change if someone tries to unsuccessfully sign in too many times. Someone other than you may have tried to get into your account (either maliciously, or in error because they mistyped or misremembered their user name), and eBay blocked further attempts by changing the password.

Another way could be that someone tried to sign into your account and clicked the link for password help, in which case, your password would be reset and an email notification would be sent to the address associated with the account.

eBay doesn't change passwords just for fun. Some action triggered it and it was done to protect you.