The Store Owner Is Rarely the One Who Gets Phished
Most merchant security guides address the owner directly, as if the owner's own login were the entire risk. On any store with more than one person touching the admin, that framing misses where takeovers actually start. A Shopify store login controls the bank account receiving payouts, every customer's name and order history, product pricing, the theme code where card skimmers get quietly injected, and the full email list. And on a real store, several people hold keys to some or all of that: a part time social media manager, a fulfillment contractor, a freelance developer brought in for one project, sometimes an agency with its own rotating staff. The store's actual weak point is whichever of those accounts has the least careful password habits, not the owner's own login.
Store takeovers follow a routine that rarely involves anything sophisticated: a phished or reused password on any staff account, a quiet login during off hours, a payout bank account changed in Settings, and the next settlement lands in the thief's account instead of the merchant's. Owners often only notice when the money simply does not arrive.
Turning On Two-Step Authentication
Shopify calls its 2FA "two-step authentication," and it runs through your Shopify account at accounts.shopify.com rather than the store admin directly:
- Log in to your store admin, click your avatar, and choose Manage account.
- Open the Security section.
- Under Two-step authentication, click Turn on two-step.
- Choose your method: Authenticator app is recommended, with a Security key as a stronger alternative.
- For the app option, scan the QR code with Google Authenticator, Authy, or any TOTP app, then confirm with the six digit code.
- Download the recovery codes Shopify provides immediately and store them somewhere durable, following our backup codes storage guide.
SMS is offered too, but skip it where an alternative exists. Store owners are unusually researchable targets, since a business name and often an associated phone number are public by design, which makes SIM swapping a realistic threat here rather than a theoretical one.
Staff Permissions: Where the Real Exposure Lives
This is the step that prevents actual store takeovers, more than any setting on the owner's own account:
- Send this guide to every staff member and have each one enable two-step authentication on their own login individually.
- Audit Settings > Users and permissions on a recurring schedule, not just once. Remove former employees immediately, since a still-active login from someone who left months ago is the single most common hole found in post-incident reviews.
- Question every account carrying Financial or Full access specifically. Most staff roles, fulfillment, support, marketing, need none of that access to do their jobs, and narrowing permissions limits what a single compromised account can actually reach.
- For agencies and freelance collaborators, grant scoped collaborator access rather than full admin rights, and set an expiration or manually revoke access the moment a project ends rather than leaving it open "in case they're needed again."
- The owner's own account deserves the strongest setup available: an authenticator app or a hardware security key, plus recovery codes stored offline. High volume stores should treat a hardware security key as a justified cost, not a luxury.
Post-mortems of real store takeovers rarely feature clever hacking. They feature an ex-employee's login that nobody deactivated, a password reused from an unrelated breached site, or a staff member who clicked a convincing fake "Shopify billing problem" email. The owner did everything right and the store still got taken, because the store's security was only ever as strong as its least protected staff account.
Protecting Payments and Payouts Specifically
- Shopify Payments and payout schedule awareness: know when payouts are expected, and treat any unexpected delay as a signal worth checking Settings > Payments over immediately, since bank account changes there are exactly what a takeover is engineered to reach.
- Read the change alert emails: Shopify emails the account when payout bank details change. That email is often the only warning a merchant gets before a payout is redirected, so it deserves immediate attention rather than a glance.
- Unique, generated password for the Shopify account itself, never reused from anywhere else, via our password generator. Merchant credentials are a prime target for credential stuffing specifically because a working login has direct financial payoff.
- Harden the email account behind Shopify first, since it is the recovery path for the store account itself, following our Gmail 2FA guide.
- Audit installed apps under Settings > Apps regularly. Every installed app carries API access to store data under an OAuth style grant, and abandoned apps from a past project are a quiet, ongoing access point nobody remembers to close.
- Review theme code periodically for scripts nobody on the team added. Injected checkout skimmers hide inside theme files precisely because merchants rarely look there.
Phishing Built Specifically for Merchants
Merchant-targeted phishing has its own recognizable set of hooks, distinct from generic phishing: a fake "your Shopify payment failed, update billing now" email with a lookalike login link, a bogus "trademark complaint filed against your store" notice demanding an urgent login to resolve, and messages posing as customers asking about an "order problem" through a credential harvesting link disguised as an order page. The universal defense holds here as everywhere: never log into store admin through a link inside an email. Type the admin URL directly or use a saved bookmark. Full recognition training lives in our phishing guide, and it is worth remembering that with two-step authentication enabled, a successfully harvested password alone still leaves the phisher standing outside the account.
Frequently Asked Questions
One of our staff accounts has Financial access but no two-step enabled. How urgent is fixing that?
Treat it as immediate, not scheduled for later. A Financial-access account without 2FA is functionally the same risk as the owner's own login being unprotected, since it can reach payout settings directly. Enable two-step on that account today and review whether it needs Financial access at all.
Can we require two-step authentication for every staff account automatically rather than asking nicely?
Shopify has been rolling out organization-level security requirements on higher plan tiers, so check Settings > Users and permissions for an enforcement toggle on your plan specifically. Where no toggle exists yet, make it explicit written store policy and verify individually, since each user's security page shows their current status.
Does two-step authentication interrupt daily store operations or slow down staff logins?
Barely at all in practice. Trusted browsers and devices stay recognized between sessions, and a code is mainly requested on new or unrecognized devices. Order processing, POS operation, and normal staff workflows continue without added friction.
An ex-employee still has admin access and we just noticed. What is the right sequence?
Remove their access first, immediately, before anything else. Then rotate any shared credentials they might have known (payment gateway logins, app passwords, API keys they had visibility into) and review recent order and settings activity for anything unexplained during the period after they left.
We lost the recovery codes and the phone with the authenticator app. What now?
Shopify support can verify store ownership through business documentation, but expect a deliberately slow, careful process, since account recovery is a known attack vector and Shopify treats it that way on purpose. Registering two separate two-step methods in advance, plus storing recovery codes properly, is what makes this question stop mattering; our lost device guide covers the full prevention checklist.
