Whatnot

Is Whatnot safe?

As a place to buy a specific item, Whatnot is reasonably safe: you pay inside the app, and Buyer Protection refunds you if the item never arrives, arrives broken or turns out to be fake. The danger is less about fraud than about how the app sells. Fast live auctions and randomised card "breaks" can drain money quickly, and more than 70 customers now allege in arbitration that some breaks are illegal lotteries. We score it 51/100, above Temu and below PayPal.

Whatnot grew fast. Its live sales passed $8 billion in 2025, and investors valued it at $20 billion in August 2026. Trading cards and collectibles are its core, though fashion is now its largest category by order volume.

Are card breaks gambling?

A card break works like this: a seller opens sealed boxes of cards on stream, and buyers pay for a spot, often a team, chosen or assigned at random. You get whatever cards land in your spot. Sometimes that is a valuable rookie card, often it is little.

Since March 2026, the lawyer Paul Lesko has filed arbitration demands for Whatnot customers alleging that randomised box breaks and repacks are unlicensed lotteries under California law, where Whatnot is based. By August 2026 the count had passed 70, according to Value Added Resource. A separate whistleblower suit under California's False Claims Act, filed in July 2025 and later unsealed, makes similar claims about breaks on Fanatics Live and Whatnot; the state's Justice Department declined to intervene. These are allegations. Whatnot says "gambling isn't allowed on Whatnot, and we strictly enforce this policy," and that sellers who run breaks are about 4% of its sellers.

Whatnot's own rules have tightened. Its Card Breaks Policy bans prizes, randomiser wheels and gumball-style machines, requires the whole break to stay on camera, and says every buyer must receive at least one card. Its gambling policy bans raffles and "golden tickets." The policy work is real. The format still mixes chance with fast bidding, and the Wall Street Journal has reported buyers who ran up debt on breaks and auctions.

What Whatnot does to protect buyers

Buyer Protection covers three cases: the order does not arrive, it arrives damaged, or it is not what you bought, including items that are not authentic. Lost high-value cards from a break can be reimbursed at market value. The catch is time. Most claims must be filed within 14 days of delivery, and sports cards, trading card games, coins, sneakers and luxury goods have only 7 days. Open every parcel the day it arrives and photograph it.

On the seller side, everyone who sells must verify a phone number, a payment method and a government ID. That deters throwaway accounts but does not stop shill bidding, where a seller's friends push up prices. Whatnot told Value Added Resource in 2026 that shill bidding fell nearly 80% over six months, a figure it has not explained.

Whatnot's own scam page lists the common tricks: emails from look-alike addresses claiming your account is restricted, messages asking you to "activate" a payout, romance approaches in DMs and fake giveaways. Whatnot says it never asks for payment details by email.

Is Whatnot safe for kids and teens?

Whatnot says you must be 18 to hold an account. Teens aged 13 to 17 may buy and sell only on an account a parent owns and registers, with the parent's payment details and supervision. The App Store, though, rates the app 13+, notes frequent contests and user-generated content, and lets anyone download it. In practice, a teenager with a parent's card saved in the app can join live breaks.

For a young collector, the mix of live chat, countdown auctions and random packs is the main concern. Parents who allow it should set a hard monthly spend limit in Account Controls and keep the PIN themselves.

What data does Whatnot collect?

Apple's label for Whatnot lists identifiers and usage data used to track you across other companies' apps and websites, and user ID used for third-party advertising. Linked to your identity for Whatnot's own marketing are name, email, coarse location, photos and videos, search history, device ID and product interactions. The label also lists your contacts, used for personalisation and app features. That is heavier than Shop, which declares no tracking, but lighter than Depop.

How to use Whatnot more safely

1. Set a monthly spend limit in Account Controls before your first live show, not after.
2. Treat a break as entertainment with a fixed budget, not as a way to make money.
3. Pay only inside the app. Off-app deals lose Buyer Protection.
4. Film yourself opening valuable packages and file any claim within 7 days.
5. Turn off tracking in iOS (Settings, Privacy and Security, Tracking) for Whatnot.

How we scored it

Scams and harmful content (38) is the weakest factor because of the unresolved gambling claims around breaks and the gap between the 13+ app rating and the adult-account rule. Privacy (40) reflects ad tracking. Security (57) credits a clean record, seller ID checks and a paid bug bounty. The regulatory record (88) is the strongest factor: we found no regulator fine or order, only private claims that remain allegations and count only as context.