How can merchants avoid Shopify admin scams?

Merchants can avoid Shopify Admin scams by being cautious with unexpected messages, login requests, apps, and requests for sensitive information.

Key precautions include:

• Use Shopify’s official website or admin login rather than clicking unfamiliar login links.
• Never share passwords, authentication codes, or API credentials with someone claiming to be Shopify Support.
• Verify emails and messages before taking action, especially those involving payments, account suspension, or urgent security issues.
• Review staff accounts and permissions regularly and remove access that is no longer needed.
• Install apps only from trusted sources and review their requested permissions.
• Be cautious of unexpected collaborator or staff-access requests.
• Enable two-step authentication to add protection to Shopify accounts.
• If something seems suspicious, contact Shopify Support through official Shopify channels rather than using contact details supplied in the suspicious message.

The key principle is: don’t let urgency or threats pressure you into giving someone access to your Shopify account or store data.