Shopify Store Security at Scale: Staff Permissions, Two-Step Login and Fraud Controls

When a Shopify store is small, security usually means one owner with a strong password. As the business grows, the picture changes: a dozen staff accounts, an agency with collaborator access, thirty installed apps, a freelancer who left last year and still has a login, and fraudsters testing stolen cards at checkout. Shopify store security at scale is less about hacking and more about access hygiene and fraud discipline. Shopify handles the platform security (servers, payment card data, the checkout itself). You are responsible for who can get in, what they can touch, and how you respond to risky orders.

This guide is written for growing and Shopify Plus merchants who want a practical system rather than a one-off cleanup.

Who Is Responsible for What in Shopify Store Security

Shopify is responsible for: hosting, platform patches, PCI compliance for its checkout and Shopify Payments, SSL certificates on your domains, and infrastructure-level protection.

You are responsible for: staff and collaborator accounts, the permissions they hold, the apps you install and the data they can reach, your theme code and any third-party scripts, and decisions about which orders to fulfill.

Almost every real incident we see falls into the second list: a reused password, an ex-employee account, an over-permissioned app, or fraudulent orders shipped because nobody reviewed them.

Staff Roles and Least Privilege

The principle of least privilege means each person gets the access they need for their job and nothing more. Shopify's staff permissions are granular enough to do this properly.

Map roles before creating accounts

A typical mid-size store might map roles like this:

• Customer service: orders (view and edit), customers, refunds up to their authority level. No access to settings, apps, themes or payouts.
• Fulfillment and warehouse: orders and fulfillment, inventory. No customers' marketing data, no finances.
• Marketing: discounts, marketing, online store content (pages, blog), analytics. No payments or staff settings.
• Merchandising: products, collections, inventory. Possibly themes if they manage homepage content.
• Finance: reports, finances, payouts, billing.
• Admins: a very small number of people with full access.

At the time of writing, Shopify lets you save reusable roles on many plans, so you assign "Customer service" instead of ticking boxes for each new hire. Check your admin's staff settings, since the exact options vary by plan.

Permissions worth treating as sensitive

Some permissions carry more risk than they look:

• Apps and channels (install and manage). Anyone who can install apps can grant a third party access to your customer and order data.
• Themes (edit code). Theme code can load any external script on every page, including checkout-adjacent pages.
• Staff management. Whoever can create accounts can create more access.
• Payment settings and payouts. Changing bank details is a classic fraud target.
• Export customers. Bulk exports are how customer data walks out the door.
• Refunds and gift card issuing. These move money directly.

Keep these limited to named, trusted people, and route app installs through an admin.

Watch the store owner account

The store owner account has powers no other account has, including transferring ownership and some billing actions. It should belong to a real decision-maker, use a unique email address the company controls (not a personal one of a former employee), and have two-step authentication enabled.

Collaborator Accounts for Agencies and Freelancers

Agencies, developers and freelancers should use collaborator accounts, not staff seats. Collaborators come from a Shopify Partner account, do not count against your staff limit, and receive only the permissions you approve.

Good practice:

• Require a collaborator request code. Shopify lets you set a code in your admin that partners must enter to request access. Share it only when you are actually engaging someone.
• Approve the minimum permissions. A developer fixing a product page template needs themes and maybe products. They do not need payouts or customer exports.
• Remove access when the project ends. Collaborators can remain for years if nobody cleans up. Put a calendar reminder at the end of each engagement.
• Know who is behind each account. If an agency staff member leaves the agency, their collaborator access may still point at your store. Ask your agencies to tell you when their team changes.

Two-Step Authentication for Every Login

Two-step authentication (2FA) is the single most effective protection against stolen or reused passwords. Shopify supports it through authenticator apps, security keys and (depending on region and settings) text messages.

Make it mandatory, not optional

On many plans you can require two-step authentication for staff, so accounts cannot sign in until they set it up. On Shopify Plus, the organization admin gives you central control over users across stores, and at the time of writing Plus merchants can also connect single sign-on through a SAML identity provider (such as the one your company already uses for email). Check Shopify's current help documentation for exact settings, because these controls have been evolving.

Prefer stronger methods

• Security keys or authenticator apps are stronger than text messages, which can be intercepted through SIM swap attacks.
• Store recovery codes in your company password manager.
• No shared logins. One login used by three people defeats 2FA. Everyone gets their own account.

Reviewing App Permissions

Every app you install asks for access scopes, such as read orders, write products or read customers. Over time, stores accumulate apps that were tried once and forgotten, many of which still have access to customer data.

A quarterly app review

Once a quarter, go through installed apps and ask:

1. Is it still used? If not, uninstall. Uninstalling generally revokes its access, though you should check whether it left theme code behind.
2. Do its permissions match its job? A countdown timer should not need access to customer data. If the scopes look excessive, contact the developer or replace the app.
3. Who is the developer? Prefer apps with a track record, clear privacy policies and responsive support.
4. Has anything changed? Apps can request new permissions after updates. Read these requests before approving.

Custom apps and API tokens

If your store uses custom apps (for integrations with an ERP, warehouse or internal tools), treat their access tokens like passwords:

• Store tokens in a secrets manager, not in spreadsheets or chat messages.
• Give each integration only the scopes it needs.
• Rotate or revoke tokens when a vendor relationship ends.
• Document which system uses which app.

Tightening integration access is often part of the Shopify integrations work we do, since a well-built integration asks only for what it uses.

Fraud Controls: Analysis, Holds and Chargebacks

Fraud is where security costs real money. A fraudulent order means lost product, lost shipping, a chargeback fee and sometimes a hit to your standing with your payment processor.

Use Shopify's fraud analysis

Shopify shows a fraud analysis on each order when using Shopify Payments and some other gateways, flagging indicators like mismatched billing and shipping countries, many attempts with different cards, or a high-risk IP address. It gives a recommendation to fulfill, investigate or cancel. Treat "investigate" as a real instruction, not a label.

Depending on your region and payment setup, Shopify may also offer protection programs covering certain fraudulent chargebacks on eligible orders (for example, Shopify Protect for some Shop Pay orders in the United States at the time of writing). Check eligibility in your admin, since coverage varies.

Build a review process

• Auto-hold risky orders. Use Shopify Flow or a fraud app to put high-risk orders on hold so they cannot be fulfilled by accident. Flow is available beyond Plus on many plans now, but check your plan.
• Define who reviews and how fast. For example, customer service reviews held orders within four business hours.
• Set clear rules. Verify by email or phone, check the address for known freight forwarders, look at order history. Decide what evidence releases an order.
• Cancel and refund cleanly. If you cancel a suspected fraud order, refund before a chargeback arrives. A refunded order generally cannot become a chargeback for the same amount.

Handling chargebacks

When a chargeback arrives, respond with evidence: order details, tracking with delivery confirmation, customer communications and your policies. Shopify's dispute tools let you submit this from the admin for Shopify Payments orders.

Dedicated fraud apps suit stores with higher volume or high-risk products. Many offer chargeback guarantees and typically charge from a fraction of a percent to around 1 percent of screened revenue, so compare current offers carefully.

Bots and Card Testing

Card testing is when fraudsters use your checkout to test whether stolen card numbers work, usually with many small orders or failed payment attempts in a short time. Even if few payments succeed, you can face processor fees, a spike in declines and risk flags on your merchant account.

Warning signs include bursts of failed payments, many tiny orders from new customers with random names, and traffic spikes to a cheap product or gift card. Responses:

• Enable bot protection. Shopify includes protections such as challenges on some forms and checkout. Review the settings available in your admin (for example CAPTCHA on customer account and contact forms).
• Protect cheap products. Card testers love low-priced items. Consider minimum order values or removing ultra-cheap test products from sale.
• Watch gift card products. Gift cards are attractive to fraudsters because they are instantly transferable. Hold gift card orders that look risky before they are delivered.

A Staff and Vendor Offboarding Checklist

Offboarding is where most access problems start. When someone leaves your team or a vendor engagement ends, run the same checklist every time:

1. Remove or deactivate their Shopify staff account (or collaborator access) on the day they leave.
2. If they had admin access, review recent changes to staff, apps, payment and payout settings.
3. Transfer ownership of anything they created, such as saved reports, Flow workflows or app accounts registered under their email.
4. Revoke their access to connected tools: email platform, helpdesk, analytics, ad accounts, the domain registrar and the password manager.
5. Rotate any shared credentials they knew, including API tokens for custom apps.
6. If they were the store owner, transfer ownership before they leave, not after.
7. Log the date and who performed each step.

For multi-store Plus setups, managing users from the organization admin makes this much faster, since you can remove a person across stores in one place.

Building a Simple Security Routine

Security at scale works best as a routine rather than a project:

• Monthly: review flagged orders and any unexpected new staff accounts.
• Quarterly: permission, collaborator and app review, plus a 2FA check.
• Annually: confirm who holds the owner account, payout settings and domain access.

Budget-wise, most of this costs staff time rather than money. Where outside help makes sense is in setting up roles, SSO and automated fraud holds properly the first time. In our experience that setup typically takes 1 to 3 weeks for a growing store, more for multi-store organizations. If you are on Plus or moving there, our Shopify Plus services cover organization structure, user management and automation as part of the same engagement.

FAQ

Can I require two-step authentication for all Shopify staff?

In many cases, yes. Shopify offers a setting to require two-step authentication for staff, and Plus stores can manage users centrally and connect a SAML single sign-on provider. Check current settings in your admin, since options vary by plan.

Should my agency use a staff account or a collaborator account?

A collaborator account. It does not use a staff seat, it is tied to the agency's Shopify Partner account, and you approve exactly which permissions it gets. Remove it when the work ends.

How do I know if my store is being card tested?

Look for a sudden burst of failed payments, many small orders from new customers, or traffic spikes to cheap products or gift cards. Contact Shopify support and your payment provider quickly, and hold suspicious orders.

Does uninstalling an app remove its access to my data?

Uninstalling generally revokes the app's API access. It does not always remove code the app added to your theme, and data the app already copied to its own systems is governed by its privacy policy.

If you would like a review of your store's access and fraud setup, book a free 1-hour strategy call through our contact page.