Staying safe on Peppaca

Look for the badge. When Peppaca messages you, a small badge sits next to our name. The site draws that badge itself, from your account records — it is not something a sender can type. Anyone can call themselves “Peppaca”, “Support”, “Official” or add a ✓ to their name. Nobody but us can put the badge there.

This is what it looks like in your inbox and at the top of a thread:

One account, and only one, contacts sellers: support@peppaca.com — “Peppaca Support Team”. If a message claims to be from Peppaca and carries no badge, it is not from Peppaca, however official the name looks.

Not “rarely”, not “only in special cases” — never. If a message asks for any of these, it is not us, and we would like to know about it.

• Ask for your password. We cannot see it and we will never request it.
• Ask for your card number, bank details, or your PayPal login.
• Ask you to “verify”, “reactivate”, “unlock” or “confirm” your shop in a message. Account emails — confirming your email address, resetting your password — arrive as email, on their own, never as a message from someone you are talking to.
• Ask you to pay a fee by message — to keep your shop open, to release an order, or to lift a penalty. Your seller fee is invoiced monthly and is never collected in a conversation.
• Ask you to continue the sale on another app, or to pay a maker anywhere other than through checkout on peppaca.com.
• Press you to act within minutes. Urgency is the oldest tool in this trade; a real message from us can always wait until you have checked it.

We do send you links, and you are meant to use them. Confirming your email address and resetting your password both work by clicking a link we email you — that is normal, and it is us. So “never click a link” is not the rule. This is:

1. The sender address ends in @peppaca.com. We write to you from support@peppaca.com, and our community forum writes from noreply@peppaca.com. Read the address itself, not the name shown beside it — a display name is as free to invent in email as it is in a shop.
2. Every link we send goes to peppaca.com. Every one, without exception — sign-in, verification, password reset, your orders, your messages. A link that lands anywhere else is not ours, whatever the words in the link say.

Reading a web address is a skill worth two minutes. Look at the part before the first single slash, and read the END of it, not the start: peppaca.com/verify-email is us. Something like peppaca.example.shop is a .shop website that has put our name at the front — where your eye lands first, which is exactly why they put it there. It is not us.

One place we take links out: when someone messages you, we email a short preview of what they wrote, with anything clickable removed first. If you see that a link was removed, that is us — the sender put a link where a link had no business being, and the message is worth reporting.

If a message has photos or a video, our email tells you how many. It never shows them and never carries their address. You open attachments on peppaca.com, in the thread, where you can see who sent them.

And if you would rather not check at all, you never have to: close the email, type peppaca.com yourself, and sign in. Anything real that an email can tell you is waiting for you there.

We may contact you in your inbox — about your shop, an order, or a policy change. Those messages carry the badge. A message about your shop that has no badge did not come from us, no matter how much it sounds like it did. You are never obliged to reply, and nothing bad happens to your shop because you took a day to check.

Seller guide

Peppaca does not send you in-app messages at all. Every conversation in a buyer’s inbox is with a shop — that is the only kind of conversation that exists on your side. So if something in your inbox presents itself as Peppaca, it is a shop account choosing that name, and you can report it. Anything genuine from us reaches you by email, from peppaca.com.

Buyer Protection

Trust the feeling. You do not need to be sure, and you do not owe the sender a reply.

1. Do not click anything in it, and do not reply.
2. Open the conversation and press Report. That flags the whole thread to us with the messages intact.
3. Press Block if you would rather not hear from that account again.
4. If you want to tell us more than the button can, email support@peppaca.com.

We read every report, and one report protects more than one shop: the same account rarely stops at one.

It happens to careful people. What matters now is the next few minutes, not how it happened.

1. Change your Peppaca password straight away, from your account page.
2. If you entered the same password anywhere else, change it there too. That is usually the bigger exposure.
3. If you gave card or bank details, contact your bank or PayPal now — they can act on it in a way we cannot.
4. Then tell us at support@peppaca.com. You are not in trouble, and what you tell us is often what lets us stop the same account reaching somebody else.

Ask us. Forward it, screenshot it, or just describe it — there is no such thing as a waste of our time here. We would far rather answer a message that turns out to be genuine than hear about one that turned out not to be. support@peppaca.com