Poshmark

Is Poshmark safe?

Poshmark is safe enough for buying second-hand clothes, provided you pay through the app and inspect the parcel as soon as it lands. Posh Protect refunds orders that never ship or are not as described, but its window is short: three days after delivery. We score Poshmark 49/100, close to Depop and below Etsy, mainly because of a 2019 breach, basic login protection and heavy ad tracking.

Poshmark has belonged to NAVER, the South Korean internet group, since January 2023. Nothing about the app's buyer protection changed with the takeover.

The three-day rule in Posh Protect

Poshmark holds the buyer's payment until the order is accepted. When the parcel arrives, you have 72 hours, based on the tracking on Poshmark's shipping label, to open a return case in the app or on the website with photos. Accepted reasons are undisclosed damage, an incorrect or missing item, an item not as described, a fake, or an order that never shipped or arrived. If Poshmark agrees, it sends a return label and refunds you once the item is sent back within five days.

Two things catch people out. Accepting the order releases the money to the seller and ends any chance of a return, so don't tap accept before you have checked the item. And emailing Poshmark support does not count as opening a case. Items that simply don't fit or that you no longer want are not covered at all.

The same policy explains the main scam risk. Posh Protect does not cover trades or deals where the full payment did not go through Poshmark, and the terms say you bear all the risk of such transactions.

Poshmark scams to watch for

The patterns are the ones every resale app sees. A buyer or seller suggests finishing the deal by PayPal or bank transfer to avoid fees, or proposes a swap. A message or email that looks like Poshmark asks you to confirm a payment, enter your password or read back a verification code. A buyer claims an item arrived damaged and returns something else.

Never share your password or a verification code with anyone. Poshmark's help pages say that if a code arrives that you did not request, you should not use it and should contact support at once. Keep all conversation inside the app, so there is a record if you need to open a case.

Was Poshmark hacked?

Yes, twice in a way that mattered for users. In early 2017 attackers used stolen usernames and passwords to get into several hundred Poshmark accounts and take their balances, and Poshmark said it would reimburse those affected. In August 2019 Poshmark disclosed a breach of its own systems: an unauthorized party took usernames, names, gender, city, email addresses, size preferences and hashed passwords. Poshmark's 2021 annual report put the number at several million accounts. The passwords were hashed with bcrypt, a strong method, and Poshmark said financial data and street addresses were not taken.

Login protection is still basic. Two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sends a code to your email or, if you added a phone, by text, and Poshmark decides when to ask for it, for example when you log in or change account details. We found no option for an authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, and no public bug bounty. If you lose access to your email or phone, you verify your identity with a driver's licence, passport or state ID in the app.

What data does Poshmark collect?

Apple's label lists four kinds of data that may be used to track you across other companies' apps and websites: purchases, contact info, identifiers and usage data. Linked to your identity, it adds user content, search history and diagnostics. That puts Poshmark level with Etsy and well behind eBay, which declares no tracking.

The privacy policy, last updated on 24 March 2026, goes further. Poshmark may share your information with brands, advertising and affiliate networks for marketing, and it calls some of that sharing a sale. It may also receive demographic data from commercial data brokers and ask for photo verification in which an identity vendor processes face geometry, which some states treat as biometric data. Some records are kept for seven years to meet financial and anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary rules.

How to use Poshmark safely

1. Keep your email and phone number current, because that is where two-step codes go, and use a password you do not use anywhere else.
2. Pay only with Buy Now or an accepted offer in the app. Refuse trades and payments by PayPal or bank transfer.
3. Open the parcel the day it arrives, take photos and open a case within three days if anything is wrong. Do not accept the order first.
4. Ignore emails or texts asking for your login or a code, and report them to Poshmark.
5. Use the Do Not Sell or Share link in the privacy policy, and deny tracking on your iPhone.

How we scored it

The regulatory record (88) is Poshmark's strongest factor: we found no fine or order, though no regulator appears to have looked closely at the 2019 breach either. Privacy (38) is the weakest, given the tracking label and a policy that allows ad-network sharing, data-broker inputs and face scans for ID checks. Security (45) reflects a breach of several million accounts within the last ten years and two-step codes limited to email and text.