The main issue I noticed is that a Shopify account can be created using an email address without verifying that the person actually owns that email. The user can then access the Shopify Admin directly.
This could create some potential security and trust issues:
- Someone could create an account using another person’s email address.
- They could potentially use the account for several days before the real owner notices.
- Someone could use a celebrity, company, or well-known person’s email address and claim they are managing that person’s Shopify store.
- They could use an unverified account to approach clients and falsely claim to manage a Shopify store.
- It could potentially make scams, impersonation, or other deceptive activities easier.
- Since Shopify is a large and trusted platform, users may assume that an account has been properly verified.
I understand that Shopify already has two-step verification and other security features. My suggestion is specifically about verifying email ownership during account creation.
A simple solution could be requiring an email OTP or confirmation link before allowing full Shopify Admin access.
I’m not reporting this as a bug. I’m just sharing it as a security suggestion that could help improve account verification and user trust.
I’ve attached a screenshot of the Shopify Admin from an account I created for testing. I only provided an email address, password, and the required basic details, and I was able to access the Admin without verifying ownership of the email.
My main concern is the potential for misuse. For example, someone could use a well-known influencer’s or company’s email address and then show clients the Shopify Admin as “proof” that they are managing that person’s store.
I’m not reporting a bug—just suggesting that email verification could help prevent this type of impersonation and misuse.
Hi @testing12
I agree that email ownership should be verified before giving full Admin access. A practical approach could be to send an OTP or verification link during signup and keep the account in a limited-access state until the email is confirmed.
Shopify could also allow basic store setup before verification, but restrict sensitive actions like managing users, payments, or store settings. That would keep onboarding smooth while adding an extra layer of protection against impersonation and misuse.
Hi, @KynaatJohn Thanks for Replay 
I agree that keeping the onboarding experience smooth is important. I’m also new to Shopify, so I don’t have deep knowledge of how the platform works internally. I’m only sharing this based on what I noticed during testing and from a safety/trust perspective.
Just to clarify, I understand that Shopify is giving basic Admin access first, not full Admin access. My concern is that even basic Admin access can potentially be used to create a false impression that someone is legitimately managing a company’s or influencer’s store.
For example, someone could use a well-known company’s or influencer’s publicly available email address, create a Shopify account, and then show the basic Admin access to a non-technical person as “proof” that they manage that store. They could then make claims like, “I can arrange a collaboration with this company for $X,” and potentially use that trust to scam someone.
I understand the likelihood of this happening may be very low, and there may be other safeguards I’m not aware of. I’m not saying this is a major vulnerability or a bug. I just noticed the possibility and thought it was worth pointing out from a safety and trust perspective.
Even if the probability is low, verifying email ownership before allowing even basic Admin access could help reduce the possibility of this kind of impersonation or misuse.
Creating an Shopify account with abc123@test.com doesn’t do anything, and it won’t “prove” anything. The homepage, or any page, is going to have nothing in it. No sales, no visitors, nothing. The only identification of the store is the store name, and anyone can put anything. You really can’t do anything without email access. And you can’t show anything of substance without actually having substance to show. So you’re worried about nothing.
Can they put an OTP for signup? Sure! But it’s a multi-billion dollar company. Don’t you think that’s already been thought through? Maybe they had this years ago and people starting complaining, or maybe they have better metrics this way. Who knows… What I can tell you is that your scenario isn’t really worth writing about.
But if you do feel strongly about this, you should bring it to Shopify themselves. Help chat with human and tell them.
I understand the main concern is not necessarily a major issue, but with Shopify’s new 3-day trial, there is a higher possibility of people creating multiple trial accounts using email addresses they don’t own.
There is also a less likely security concern. For example, if Mr. ABC, who has 40–50M followers on Instagram, publicly lists an email address in his bio, someone else could use that email to create or access a Shopify account and present the Shopify dashboard as “proof” that they manage Mr. ABC’s account. Since Shopify is a large and trusted company, a non-technical person might believe the claim and pay that person $X for a collaboration or another service. I know this is rare, but for a company as large as Shopify, even small security gaps are worth addressing.
