How to Protect Your Shopping Accounts: Passwords, 2FA and Alerts

Your shopping accounts hold more than an order history. They often store your home address, phone number, saved cards, gift card balances and access to payment apps. If a criminal gets in, they can place orders, drain balances, change your delivery address or use your details for other scams. The good news is that a few simple steps block most account takeovers.

How shopping accounts get taken over

• Reused passwords: when one site is breached, criminals try the same email and password on many others. This is called credential stuffing.
• Phishing: fake emails and texts that look like they come from a store, delivery company or payment service lead you to a fake login page.
• Fake support: scammers pose as customer service and ask for your login code or for remote access to your device.
• Weak passwords: short or common passwords can be guessed.
• Malware or shared devices: saved logins on an infected or shared computer can be misused.

Step 1: Use a unique, strong password for every account

Reusing passwords is the single biggest risk. If one site is breached, every account with the same password is exposed. Each important account needs its own password.

• Use a password manager to create and store long, random passwords. Most browsers and phones include one, and dedicated password managers are also available.
• Make passwords long. Length matters more than clever substitutions. A long passphrase of several random words is much stronger than a short, complex password.
• Start with your email account. Whoever controls your email can reset the passwords for almost everything else, so protect it first.

Step 2: Turn on two-factor authentication

Two-factor authentication (2FA), also called multi-factor authentication or two-step verification, asks for a second proof of identity in addition to your password. Even if someone steals your password, they cannot log in without the second factor. The FTC explains this in its guide to using two-factor authentication, and the US Cybersecurity and Infrastructure Security Agency recommends it in its turn on MFA guidance.

Method	How it works	Strength
Text message or email code	A one-time code is sent to your phone or inbox	Much better than a password alone, but codes can be phished or intercepted
Authenticator app	An app on your phone generates codes that change every few seconds	Stronger than text messages, and works without phone signal
Passkeys and security keys	Your device or a physical key proves who you are, often with a fingerprint, face scan or PIN	Strongest against phishing, because they only work on the real website

Any of these is far better than nothing. Turn on 2FA first for your email, password manager, main marketplace accounts, PayPal and other payment services, and your bank. Save the backup or recovery codes the site gives you somewhere safe in case you lose your phone.

Step 3: Consider passkeys

Many large shopping and payment sites now support passkeys. A passkey replaces your password with a secure credential stored on your phone, computer or password manager, unlocked with your fingerprint, face or device PIN. Because a passkey only works on the genuine site, it resists phishing. If a site you use offers passkeys, setting one up is worth considering. Keep at least one recovery method current.

Step 4: Tidy up saved details

• Remove old saved cards and addresses you no longer use.
• Close accounts on shops you no longer use, so a future breach there exposes less.
• Use virtual card numbers where your bank offers them, especially for unfamiliar stores.
• Review connected devices and apps in your account settings, and sign out of devices you do not recognize.
• Avoid saving logins on shared computers, and sign out when you finish.

Step 5: Turn on alerts

Alerts help you spot problems quickly:

• Order confirmation and shipping notifications from shopping sites.
• Login and password change alerts, if offered.
• Transaction alerts from your bank and card issuer, ideally for every online purchase.

Check alerts by opening the app or typing the website address yourself, not by clicking links in messages. Our guide to online shopping scams shows what fake delivery and account messages look like.

Step 6: Keep devices and connections safe

Account security also depends on the device you shop from. Keep your phone, computer and browser updated, since updates fix security holes that criminals exploit. Install apps only from official app stores, and be cautious with browser extensions that ask to read all the sites you visit. On public Wi-Fi, avoid logging in to shopping or banking accounts unless you are confident the connection is secure; using your phone's mobile data is a simple alternative.

If you think an account was hacked

1. Change the password from a device you trust, and change it on any other account that used the same password.
2. Turn on 2FA if it was not already on, and check that the recovery email and phone number are still yours.
3. Review recent orders, addresses and saved payment methods. Cancel unauthorized orders and remove unfamiliar addresses.
4. Contact the company through its official website or app.
5. Contact your bank or card issuer about unauthorized charges. Our guide to the safest ways to pay online explains how card disputes work.
6. Secure your email, since that is often how attackers get in.
7. Report identity theft at IdentityTheft.gov if your personal information has been misused beyond the account.

Quick checklist

• Unique password for every account, stored in a password manager.
• 2FA on email, marketplaces, payment services and bank.
• Passkeys set up where offered.
• Old cards, addresses and accounts removed.
• Purchase and login alerts turned on.
• Never share login codes with anyone.