What Depop does with your bank information

Depop is a peer-to-peer marketplace app where people buy and sell used clothing and items. When you list something for sale or buy from another user, Depop needs a way to move money between accounts. The app itself does not hold your bank details. Instead, it uses Stripe or PayPal as the payment processor — the same companies that handle payments for thousands of other apps and websites.

When you sell an item on Depop, the buyer's payment goes to Depop first. Depop takes a 10% fee, then sends the remainder to whichever payment method you connected — usually a bank account linked through Stripe or PayPal. You never give Depop your actual bank account number, routing number, or login credentials. You give those details to Stripe or PayPal instead, which are separate companies with their own security standards.

The same separation applies when you buy. Your payment information goes to the processor, not to Depop directly. This is the standard setup for most marketplace apps, including Poshmark, Vinted, and Mercari.

Key Takeaways

  • Depop does not store your bank account number or login details — those go to Stripe or PayPal, which are the actual payment processors.
  • Depop takes a 10% fee from sales and passes the rest to your connected bank account or payment method within a few business days.
  • Your security depends partly on how strong your Depop password is and whether you use two-factor authentication, which Depop offers.
  • Fraudulent transactions and unauthorized access are possible on any app that handles money, but Depop and its processors offer dispute resolution if something goes wrong.
  • The biggest risk on Depop is not the app itself but user-to-user fraud — selling items that never arrive or receiving counterfeit goods.

How your bank data moves through the system

When you first connect a bank account to Depop, you are actually connecting it through Stripe or PayPal's interface. Depop shows you the login screen, but you are entering your credentials into Stripe or PayPal's find servers, not Depop's. This is called OAuth — a standard method that lets apps request access without ever seeing your password.

Once connected, Depop can instruct Stripe or PayPal to move money, but it cannot see your full account number or change your password. If you later revoke access in your Depop settings, the connection breaks and Depop loses the ability to move money to that account. Your bank account itself remains untouched.

Money from sales typically arrives in your bank account within 2 to 5 business days. Depop batches payouts — it does not send each sale individually — so timing depends on when Depop processes the batch and how fast your bank processes the incoming transfer. Some banks are slower than others.

What can go wrong and how Depop handles it

The most common problem is not a security breach but a chargeback — when a buyer disputes a transaction with their bank or credit card company. If a buyer claims they never received an item or that it was not as described, their bank may reverse the charge. Depop then deducts that amount from your account, sometimes weeks after the sale. This is why Depop requires photos and tracking numbers for shipped items.

A second risk is account takeover. If someone gains access to your Depop login, they can change your payment method to their own bank account and start selling your items or listing fake listings. This happens when passwords are weak, reused across multiple apps, or shared. Depop offers two-factor authentication (2FA) — a second verification step when you log in from a new device — which makes takeover much harder.

A third risk is phishing. Scammers send fake emails or texts that look like they are from Depop, asking you to "verify your account" or "confirm your payment method." Clicking these links takes you to a fake login page where they capture your credentials. Depop will never ask for your password via email or text. If you receive a suspicious message, go directly to the Depop app instead of clicking any link.

Depop's security features and their limits

Depop uses SSL encryption for data in transit — the same technology that protects your bank's website. This means data traveling between your phone and Depop's servers is scrambled and unreadable to anyone intercepting it. However, encryption only protects data while it is moving. It does not prevent Depop employees from accessing data once it arrives, nor does it prevent a data breach if Depop's servers are compromised.

Depop also offers two-factor authentication, which you can enable in your account settings. When 2FA is on, logging in from a new device requires a code sent to your phone or email. This stops someone with your password from accessing your account unless they also have your phone or email. Turning on 2FA is the single most effective thing you can do to protect your Depop account.

What Depop does not offer is purchase protection for buyers in the way that eBay or Amazon does. If you buy something and it never arrives or is counterfeit, you can open a dispute through Depop, but Depop does not may provide a refund. Your recourse depends on whether the seller responds and whether Depop's review of the evidence favors you. This is a limitation of the platform, not a security flaw, but it is worth knowing.

Comparing Depop to other payment methods

Depop is safer than giving your bank details directly to a stranger, which is what you would do if you sold items through a private sale. It is also safer than using an unsecured payment app like Venmo for large transactions, because Venmo is designed for friends and offers limited dispute resolution.

Depop is roughly equivalent in security to Poshmark, Vinted, and Mercari — all use third-party processors and offer similar protections. PayPal, which Depop integrates with, has been processing payments for over 20 years and maintains its own fraud detection. Stripe, the other processor Depop uses, is newer but is backed by major investors and handles payments for companies like Amazon and Google.

The trade-off is that using a marketplace app means trusting both Depop and the processor with your information. If you want to avoid that entirely, you would need to sell items in person for cash, which eliminates the convenience of shipping and the ability to reach buyers outside your area.

Steps to find your Depop account

Start by creating a strong, unique password — one you do not use on any other app or website. If one service is breached, a unique password means attackers cannot use that password to access your other accounts. Use a mix of uppercase and lowercase letters, numbers, and symbols.

Next, turn on two-factor authentication in your Depop settings. Choose whether you want codes sent to your email or phone number, and save your backup codes in a safe place. If you lose access to your phone or email, those codes let you regain access to your account.

Third, review your connected payment methods regularly. Go to your Depop settings and check which bank account or PayPal account is linked. If you see a payment method you do not recognize, disconnect it when ready and change your Depop password.

Finally, never click links in emails or texts claiming to be from Depop. If you receive a suspicious message, open the Depop app directly and check your account. Real notifications from Depop appear in the app itself.

What happens if your account is compromised

If you notice unauthorized transactions or a payment method you did not add, change your password when ready and contact Depop support through the app. Depop can freeze your account while they investigate and may reverse fraudulent transactions. However, response times vary — Depop support is not 24/7 and can take days to reply.

If money was transferred to a bank account that is not yours, contact your bank or the processor (Stripe or PayPal) directly. Banks can sometimes reverse transfers if you report them quickly, though success depends on how much time has passed and whether the receiving account is still active.

If your bank account itself was compromised — meaning someone accessed your actual bank login, not just your Depop account — contact your bank when ready. Your bank can freeze the account, issue a new debit card, and investigate unauthorized transactions. Banks are required by law to reverse most fraudulent charges within a certain timeframe.

Frequently Asked Questions

Can Depop see my full bank account number?

No. Depop never sees your full account number or login credentials. Those details go to Stripe or PayPal, which are separate companies. Depop only receives permission to move money to or from the account you connected.

Is it safe to use a debit card instead of a bank account on Depop?

Yes, but a bank account is slightly safer. Debit cards offer less fraud protection than credit cards, and if your debit card is compromised, the thief has direct access to your money. A bank account connected through Stripe or PayPal adds a layer of separation. Either way, use two-factor authentication on your Depop account.

What if I sell something and the buyer claims they never received it?

This is why Depop requires tracking numbers for shipped items. If a buyer opens a dispute, Depop asks for proof of delivery. If you shipped with tracking and the package shows delivered, you usually win the dispute. If you shipped without tracking, Depop typically sides with the buyer and reverses the charge.

Can someone sell items using my Depop account without my password?

Not easily. They would need your Depop login credentials. However, if you use the same password on multiple apps and one of those apps is breached, attackers might try that password on Depop. This is why a unique, strong password and two-factor authentication matter.

Does Depop report my sales to the IRS?

Depop does not automatically report sales to the IRS, but you are legally required to report income from selling items. If you sell regularly, keep records of your sales and report them on your tax return. The IRS can also request records from Depop if they audit you.