We wanted to share an update following the email alert we sent out on Saturday 7th November concerning a phishing attack that day. 

Phishing is not unique to Yumbles. The fact that this attack made it through our security measures is unfortunately indicative of a significant escalation in the pace and volume of a range of security challenges affecting companies worldwide, powered by AI. 

We want to reassure all our sellers that firstly your account remains absolutely safe and was not compromised by this effort. Secondly, we are committed to avoiding any further disruption to our sellers. You should not have to be inconvenienced by messages like this in your Yumbles inbox. 

We immediately put in added security measures on Saturday, with more to come this week.

Below is a recap of what happened, an update on what we have done and how you can also spot phishing.

The Phishing Messages

Below is an example of the message that was received by some sellers.  Note that it was sent via the customer messaging system on Yumbles and yet, the person is pretending they are us. The name they entered in the field for Customer Name is Yumbbles Agent. And they sign off their message as "yumbles support". 

In the message, they are asking you to follow an external link (not on Yumbles) to confirm your bank details. 

We would never direct you to confirm your bank details outside of your Yumbles account, and certainly not contact you like this via the customer messaging system.

How did this happen?

Bad actors created customer accounts and then with those customer accounts they used the Contact the Maker buttons on product pages to send a message to sellers just like customers can, but in their message they are pretending to be us.

We already had security measures both to prevent bad actors from creating customer accounts and also to spot and block phishing messages. These measures are something we regularly evolve, and they were successfully preventing numerous phishing attempts every month. However, on Saturday some managed to get around our controls and get delivered to sellers.

What are we doing about this?

Until now we have being carefully balancing having security measures that avoid impacting genuine customers but put barriers in the way of bad actors posing as customers, which inherently is a fine line.

On Saturday we immediately blocked the ability for customer accounts to message sellers via product pages to put a swift end to the attack. This was just a temporary measure.

Later this week this function will be restored but with added layers of security.  For obvious reasons we won't make public the specifics of all that we are changing but it will require customers some extra verification. 

Messaging via orders has not been changed.

We will also be stepping up our daily 365 monitoring to ensure these measures are successful.

How to spot a fake phishing message

We hope that as a result of our efforts you do not receive such messages again. However, we do ask that you be vigilant just in case.

Please note that we will never:

• direct you to a different website outside of Yumbles to provide your banking or personal data
• message you concerning your account via your Yumbles inbox (unless it is via an order just for a specific order issue we are assisting with).  We will only ever contact you about your account directly via email outside of your Yumbles inbox.

If you receive any message that purports to be from us but it seems suspicious please contact us immediately for verification.