Why admin logins are the prize
A store’s admin area controls prices, products, customer data, payment settings, and often the money itself. Someone who gets in can change where payouts go, redirect orders, export customer lists, add malicious code to the checkout or simply delete things. Staff accounts, the owner’s email, the domain registrar and the payment dashboard are all part of this picture, since control of any one can lead to the others.
Passwords alone are a weak lock. They can be guessed, reused across sites, leaked in breaches, captured by fake login pages or stolen by malware. The phishing scams that target sellers exist largely to collect them. Two-factor authentication, often abbreviated 2FA, adds a second check so that a stolen password alone is not enough.
What “two factors” means
Authentication factors generally come in three kinds:
- Something you know, such as a password or PIN.
- Something you have, such as a phone, a hardware key or a code generator.
- Something you are, such as a fingerprint or face scan.
Two-factor authentication requires two different kinds. Logging in with a password and then a code sent to your phone combines “know” and “have”. Two passwords or two security questions would not count, since both are the same kind.
Kinds of second factor
They differ in convenience and in how much protection they give. Rough ordering from weaker to stronger is below, with caveats, since real strength also depends on how they are set up.
Text message codes
A code arrives by SMS. This is easy for nearly everyone and better than no second factor. Its weakness is that phone numbers can sometimes be taken over by a criminal who persuades a carrier to move the number to a new SIM, and messages can be intercepted or phished. Treat it as a fallback rather than a first choice for important accounts.
Email codes
A code or link is sent to an email address. This is only as safe as the email account, so the email itself needs strong protection, including its own second factor.
Authenticator app codes
An app on a phone generates a short code that changes every half minute or so. It does not depend on the phone network, and codes cannot be intercepted in transit in the same way as text messages. A well-made fake login page can still trick someone into typing the code in time, so it is not proof against all phishing, but it is a clear step up. Moving to a new phone requires a plan, as noted below.
Push approvals
The service sends a prompt to a trusted device asking you to approve the login. This is convenient, though some people approve prompts without looking, which attackers exploit by sending repeated requests until one is accepted. Check each prompt carefully and deny any that you did not start.
Hardware security keys and passkeys
A small physical key, or a passkey stored on a device and unlocked by a fingerprint, face or PIN, proves your identity cryptographically and is tied to the real site address. A fake site cannot easily fool it, which makes this generally the strongest option against phishing. The costs are the price of keys, the need to register more than one, and varying support across services.
Biometrics on a device
A fingerprint or face unlock is typically used to open a device or a passkey rather than as a stand-alone factor with the website. Useful, but best seen as part of the above.
Where to turn it on first
Rank the accounts by the damage that a takeover would cause:
- The email account used for the store and for password resets. If it falls, everything else can be reset by the attacker.
- The store admin, for the owner and every staff member.
- The payment provider and bank access.
- The domain registrar and DNS. Losing this can take the entire site or email offline or redirect it.
- Hosting accounts, if the store is self-hosted.
- Shipping, advertising, marketplace and accounting accounts, as well as social media pages tied to the brand.
Many platforms let the owner require all staff to use a second factor. Where that is available, using it removes reliance on everyone remembering.
Rolling it out in a small team
- Make it a rule rather than a suggestion, and explain the reason in a sentence or two.
- Give each person their own login. Shared accounts defeat the purpose, since no one can tell who did what, and a shared second factor device is awkward.
- Give each user only the permissions needed for their job, and remove accounts for people who have left. This matters as much as the second factor.
- Prefer an authenticator app or a security key to text messages for the owner and any account with financial or settings access.
- Offer a short how-to, with screenshots if helpful, so setup does not become a hurdle.
Plan for lost devices
The most common 2FA headache is being locked out. Prepare for it before it happens.
- Save the recovery codes that many services provide when you set up 2FA. Store them offline or in a password manager, not in the same place as the device.
- Register more than one method, such as an authenticator app and a security key, or two keys, with one kept safely away from the main one.
- Know the recovery process of each service. Some take days and need identity checks.
- When changing phones, move authenticator accounts properly before wiping the old one. Check how your app handles transfers.
- Make sure at least one other trusted person can regain access to critical accounts in an emergency, in a controlled way.
Limits to keep in mind
Two-factor authentication reduces risk a great deal but is not magic. A person who is tricked into approving a login, a stolen session on an infected computer, and weaknesses in the store software itself can all still cause harm. It is one part of wider practice, alongside unique passwords in a password manager, software updates and good store backups for the day something does go wrong. These measures are part of any sound set of cybersecurity basics, and the options available depend on the platform you use.