Hey guys, Bit of a weird one and I'm trying to figure out if it's a Trademe issue, if my account was compromised, or if I have done something dumb here.

Last night I tried to log into Trademe on a new device. The usual email and password worked but it asked for a authentication code from an app. I don't remember ever setting up MFA for Trademe (i know i should have). I went through all the possible authentication apps I could have used (just in case I did set it up and forgot about it). But nothing for trademe in my apps. It also said I could use a recovery code. I would normally save those in Bitwarden, but nothing is there.

I checked with members of my family too. In case they had set it up. Checked my emails for any mention of setting up mfa or an authenticator app.

I should note that I have logged into other devices recently with no issue. As recently as 2 weeks ago. Trademe really needs to email you when a new device is logged in btw.

So, just to be safe I changed my password from a device I was already logged in on. But oops, now I am completely logged out of all devices without the mfa code. At least if my account is compromised I have changed the password now.

I have contacted trademe support but I don't expect I'll get a reply in a hurry.


tl;dr my trademe account has mfa without me setting it up