Detecting Account Takeover on Shopify Stores

Account takeover (ATO) is fraud that wears a trusted face. Instead of creating a new fake account, the attacker logs into a real customer's account — one with saved payment methods, loyalty points, gift-card balances, and a clean history that sails past risk checks. Because the account is legitimate, ATO fraud is harder to catch than a fresh fraudulent order, and the fallout hits your most valuable customers.

How accounts get taken over

Most ATO starts far from your store:

• Credential stuffing. Attackers take username/password pairs leaked from other breaches and replay them against your login at scale, betting on password reuse. A small hit rate across millions of attempts is still profitable.
• Phishing. Customers are tricked into entering credentials on a fake login page.
• Session hijacking. Stolen session tokens or cookies bypass the password entirely.
• Weak or reused passwords guessed or brute-forced.

Once inside, the attacker changes the shipping address, drains gift-card or store credit, places orders on saved cards, or harvests personal data. The account owner often doesn't notice until the charge appears.

Signals that expose ATO

ATO leaves a trail across login and account-change behavior.

Login signals.

• Credential-stuffing bursts. Many login attempts across many accounts from one IP or ASN, high failure rates, then a few successes. Datacenter or proxy ASNs behind login traffic are a strong tell.
• Impossible travel. A login from a geography far from the account's history, especially one impossible to reach in the elapsed time since the last session.
• New device or fingerprint. A browser, OS, or device fingerprint never seen on this account.
• Velocity. Rapid-fire login attempts no human types by hand.

Post-login signals.

• Rapid detail changes. Email, password, or shipping address changed within minutes of a login from a new device — the classic takeover sequence, since attackers lock out the owner and redirect goods.
• Shipping mismatch. A new shipping address in a different country from the account's history and from the login IP.
• Balance drain. Immediate spending of gift-card or store credit, or an unusually large order on a saved card.
• Contact change before purchase. Email or phone updated right before checkout, cutting off the owner's fraud alerts.

Best control. Score login and account activity together. A new-device login is normal by itself — people buy new phones. A new-device login from a proxy IP, followed within minutes by an email change and a new shipping country, is takeover with high confidence. The combination is the signal, not any single flag.

Layered mitigations

No single defense stops ATO; each layer narrows the gap.

1. Protect the login itself.

• Rate-limit login attempts per IP, per account, and per session to break credential-stuffing volume.
• Block abusive networks. Login traffic from datacenter, VPN, proxy, and Tor ASNs is almost never a real customer signing in — deny or challenge it. Shieldy Fraud Filter classifies this traffic by ASN and blocks the abusive categories via Shopify Functions, which cuts stuffing volume before it reaches your accounts.
• Challenge suspicious logins with a CAPTCHA or step-up verification when device, geo, or velocity looks off.

2. Strengthen authentication.

• Multi-factor authentication is the single most effective ATO control — even valid stolen credentials fail without the second factor.
• Enforce strong, unique passwords and screen against known-breached credentials at signup and reset.

3. Watch account changes.

• Alert and verify on email, password, or shipping-address changes — send a notification to the *old* contact and require confirmation before high-risk changes take effect.
• Add friction to risky sequences. A shipping change plus a large order right after a new-device login should trigger step-up verification, not silent approval.

4. Score the order.

• Even when a login looks clean, the resulting order can betray fraud. Checkout-level scoring on email, phone, name, and address coherence — plus IP-vs-shipping geography — catches takeovers that slipped through the login stage. Shieldy's AI fraud-order scoring weighs these signals together so a compromised-account order still gets flagged before fulfillment.

Avoiding false positives

Legitimate customers change devices, travel, and update addresses. Over-aggressive ATO controls frustrate exactly the loyal buyers you're protecting.

• Baseline per account. Judge changes against that account's own history, not a global rule. A frequent traveler's foreign login is normal for them.
• Prefer step-up over lockout. When a login looks risky, verify (email code, MFA prompt) rather than blocking. Real owners pass; attackers usually can't.
• Reserve hard blocks for high-confidence combinations — abusive ASN plus impossible travel plus immediate detail changes.
• Make recovery easy. A smooth, well-secured account-recovery flow means a rare false positive doesn't cost you the customer.
• Review flagged sessions. Feed outcomes back into your thresholds so precision improves over time.

The bottom line

ATO exploits trust, so your defense has to look past the account's clean history to the behavior of the current session. Protect the login with rate limits and network filtering, layer on MFA, verify sensitive account changes, and score the resulting order — no single control is enough, but together they close the paths an attacker needs. The payoff is protecting your best customers and the lifetime value they represent.

Want to shut down credential-stuffing traffic and score risky orders in one place? Start with Shieldy Fraud Filter and pick a plan on the pricing page.