Does a password reset actually revoke eBay session tokens?
For weeks, my account's Recently Viewed and Recent Searches lists have been showing activity I didn't generate — mostly a sustained browsing session around vintage/collectible cell phones (StarTAC, Nokia N-Gage, old Samsung flip phones), plus a handful of unrelated items and a couple of Spanish-language search terms (I don't speak Spanish). No purchases, no payment method or address changes, no linked third-party apps or social logins, and no possibility of household/physical device access (I live alone and don't hand my phone to anyone) — so I've ruled out the usual mundane explanations.
On 9/8 I changed to a random 64-character password and switched 2FA from SMS/email to Authy TOTP. That did not end it - there has been continued unexplained “Recently Searched” activity, including after manually clearing history.
What I suspect, and what I'd like someone who actually knows eBay's backend to confirm or rule out: that a password change invalidates future password-based logins but doesn't revoke already-issued session tokens. If that's accurate, anyone with a live session before 9/8 would simply still be in, unaffected by the reset, which would explain the timeline above exactly.
What support told me (paraphrasing, not verbatim): that revoking active session tokens would also disable account breach-notification emails, and that keeping an unknown session alive was described to me as "an extra layer of security." That doesn't match how session tokens work anywhere else I'm aware of, and support wasn't able to explain the mechanism further or route me to anyone who could.
Has anyone else run into this? Specifically:
Does eBay's password-reset flow revoke existing session tokens, or only block new logins?
Is there a way, as a user, to force-expire all sessions short of what I've already tried (password change, 2FA change, manually removing all other devices from account settings)?
Is there an actual escalation path to someone technical, or is phone support the ceiling?
Happy to share more detail (I have a fairly complete timeline and the two support call transcripts) if it's useful to anyone digging into this.