Mercari

Is Mercari safe?

Mercari is safe enough for buying used goods, as long as you pay in the app and check the parcel the moment it arrives. Your money stays with Mercari until you rate the order, and you have 72 hours after delivery to report a problem. We score the US app 49/100, level with Poshmark and below eBay, held back by heavy ad tracking and basic account security.

Mercari is a Japanese company. The US app is run by Mercari, Inc., a US subsidiary, and serves the United States; Japan has its own, much larger app. This page scores the US app and points out where the Japanese one differs.

How Mercari Buyer Protection works

Every purchase carries a Buyer Protection fee of 3.6% of the item price and buyer-paid shipping. In return, Mercari holds the payment until the item is delivered and you rate the order. If you do nothing, the deal completes 72 hours after carrier-confirmed delivery and the seller is paid.

Within those 72 hours you can report an item that was damaged in transit, the wrong item, or one that significantly does not match the photos, description or condition. If Mercari approves the claim, it sends a free return label, and you must ship the item back within three days. Returns for fit, style, smell or a change of mind are not accepted. Once the money has been released, all sales are final.

That design makes the rating button the thing scammers want. Mercari's fraud guidance warns about sellers who invent an urgent story and ask you to rate an item you haven't received, about requests to pay outside Mercari, and about anyone who asks for your card, PayPal or bank details directly. Mercari's safety guidelines also suggest paying with a credit card rather than a debit card.

Swapped returns: the Japanese controversy

Sellers carry risk too. In early November 2024, Japanese users complained on social media that after they accepted returns, they got back empty boxes or different items, and that Mercari's support did not help. Mercari apologised on 17 November 2024, and on 25 November announced more involvement in hard disputes, a centre to collect and inspect returned goods, wider identity checks and closer cooperation with police.

Mercari's transparency report for the first half of 2026 says it restricted about 510,000 fraudulent accounts in Japan and now completes compensation within 48 hours once a claim is approved. Those figures cover the Japanese marketplace, not the US one. We found no comparable public data for the US app.

What data does the Mercari app collect?

This is Mercari's weakest area in the US. The App Store label lists six types of data that may be used to track you across other companies' apps and websites: purchases, location, contact info, search history, identifiers and usage data. Financial info and user content are also linked to you. The Japanese app's label lists only identifiers and usage data for tracking.

The US privacy policy, last updated in August 2025, lists identifiers and commercial information among the data sold or shared with partners for cross-context behavioral advertising, and says Mercari may share personal information with Mercari, Inc. in Japan and other group companies. Because Mercari US is a licensed money transmitter, it can also ask for your Social Security number, tax ID or date of birth, and refusing can block your account.

Deleting your data is harder than on most apps. Deactivating an account can be undone, permanent closure needs a separate request form and up to 45 days, and Mercari says federal rules oblige it to keep some transaction records for up to five years.

How secure is a Mercari account?

In the US, Mercari verifies new accounts with an email code and a text message code to your phone, and says it uses the phone check to make sure only the owner can log in. We found no option for an authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary in the US help centre. Mercari's own security help admits that some users have had accounts taken over with passwords leaked from other sites, so a unique password matters. Mercari accepts vulnerability reports but pays nothing for them, offering only merchandise.

The Japanese app is ahead here: it dropped the password requirement in January 2024, made passkey login mandatory in September 2024, and had more than 13 million users with a passkey by June 2026. In 2021 the Tokyo parent disclosed that attackers who exploited the Codecov developer tool had exposed 27,927 records, among them customer support records with names, addresses and messages of 13 marketplace users, and details of employees. Mercari said it found no sign the data had been misused.

Age rules that contradict each other

The US privacy policy says people under 18 may not use Mercari, and Apple rates the US app 18+. Yet Mercari's Age Verification FAQ describes accounts for 13 to 17-year-olds, who need a parent to provide a US ID and consent before they can be paid out. Parents should assume teens can sign up and talk to strangers in Mercari's direct messages.

How to use Mercari safely

1. Use a password you use nowhere else and keep your phone number current.
2. Rate an order only after you have opened and checked the item.
3. Report any problem through the Help Center within 72 hours of delivery, with photos.
4. Keep every message inside Mercari, and refuse any request to pay or be paid outside the app.
5. Deny tracking when the iPhone app asks, and turn off advertising cookies under Cookie Preferences on the website.

How we scored it

The regulatory record (88) is Mercari's strongest factor: we found no fine or order in the US or Japan, but also no regulator investigation that tested its practices. Privacy (35) is the weakest, because the US label lists location and search history for tracking and the policy describes sharing for cross-context advertising. Transparency and control (45) suffers from a separate form for permanent closure and five-year retention.