Resolving unauthorized use of your email on Shopify

If you suspect that your email has been used without your consent to open a Shopify store, then you can refer to the steps on this page to regain control of your information and close the account.

For detailed guidance on reporting issues with a Shopify store or merchant, including problems with orders, intellectual property infringement, or violations of Shopify's Acceptable Use Policy, refer to Report an issue with a Shopify store or merchant.

Self-service resolution

Having your email associated with a Shopify store without your consent requires reclaiming access to the account and then shutting it down. This will only take a few steps to complete.

Steps:

Use the reset your password option to regain control of any account(s) opened using your email.
After you have reset your password, log in to the Shopify account.
After logging in, follow the steps to deactivate the unauthorized store.

What happens after deactivation?

After you deactivate the Shopify store, it will become inactive and inaccessible, effectively closing all operations and transactions on the account. If you have any concerns that additional personal information was submitted in the creation of the unauthorized account, then you could also submit a data erasure request.

Handling multi-factor authentication (MFA) on the account

After resetting the password and attempting to log in, you may encounter a two-step authentication (2FA) process that you cannot complete, particularly if these extra security measures were not initially configured by you.

In these scenarios, you need to reset your password and complete the login issue form. A member of our Account Security team will verify your identity and review your request to remove the existing security feature.

Steps to bypass MFA:

Reset your password.
Complete the login issue form to submit a ticket for MFA removal. You will need to provide an explanation of your issue in the message field before submitting.
The issue will be escalated to the Account Security team to verify your request, and a team member will contact you with further instructions.

Dealing with accounts marked as inactive

If your login attempt shows that the account is inactive and access is restricted, then no further action is required to close the account as it’s already considered deactivated.