Hi Shopify community,
I’ve been exploring the new passwordless Customer Accounts flow and noticed a significant abuse vector that I’d like to raise as a feature request.
The Problem
The current OTP/magic-link flow has no friction on the trigger step. This means anyone who knows (or guesses) a target’s email address can repeatedly request OTP codes to that inbox — with no rate limiting, no CAPTCHA, and no way for the victim to stop it.
The attack is trivial:
-
Attacker enters victim’s email on the store’s login/signup page
-
Shopify sends an OTP to the victim
-
Attacker repeats indefinitely
-
Victim’s inbox is flooded with unsolicited OTP emails from the merchant’s store
No account access is needed. No credentials are compromised. But the damage is real.
Why This Matters
-
Victims associate the spam with the merchant’s brand, not the attacker
-
It’s a phishing amplifier — repeated legitimate OTPs lower victims’ guard
-
The victim has no recourse — they can’t opt out or block it without contacting the merchant directly
-
Merchants have no visibility into this happening on their store
What I’m Requesting
Shopify should add merchant-configurable controls in Customer Accounts settings:
-
CAPTCHA on OTP trigger — human verification before sending a code -
Rate limiting — cap OTP requests per email per time window (e.g., 3/hour), merchant-configurable
-
Cooldown UI — show “too many attempts, try again later” instead of silently sending
-
Admin alerts — flag unusual OTP request volumes per email in the admin dashboard
This Is a Solved Problem
Slack, Auth0, Firebase Auth, and most serious auth providers implement these controls as standard. Shopify’s hosted flow should meet the same baseline security expectations.
Currently there is no workaround available to merchants — the login UI is not customizable enough to add independent protections.
Would love to hear if other merchants have run into this, and please upvote if you’d like to see this addressed! 