From the studio to the web: Password protection for artists with their own online shop

The email arrives on a Sunday evening, shortly after the last sale of the week. It confirms that the bank details for payouts have just been changed. You yourself haven't touched anything in your account settings. Anyone receiving such a message usually already has an uninvited guest in their seller account. They're not interested in your etchings or ceramic bowls; they're after the money that will flow from your orders in the coming days.

For painters, photographers, and craftspeople who sell their work via Etsy, Shopify , or their own website , the seller account is more than just a login. It contains customer addresses, order history, painstakingly collected reviews, and the entire payment process. Below, you'll learn how to secure this access against unauthorized access without significant time investment.

A shop window with many back doors

Hardly any art shop can manage with just one account. The shop system is joined by the payment service, the Instagram profile where new series first appear, and the email inbox through which every password reset is processed. Then there's the cloud folder containing the high-resolution print data of your artwork, often also the domain, newsletter tool, and shipping provider. Anyone who keeps two or three favorite passwords in their head for all of this is already creating a problem. No one can remember fifteen random strings of characters, so this task belongs in the hands of software.

A password manager generates a unique, random string of characters for each service, stores it encrypted, and automatically fills in the password when you log in. You only need to remember the main password, which can be a complete sentence. Before entrusting your entire login list to a program, you should test it thoroughly: transfer three or four accounts and check if the autofill works smoothly on your laptop and mobile phone.

If your partner packs parcels and answers customer emails, a family plan with a shared vault is probably the best option. For 1Password , one of the most popular password managers, the Cybernews team compiles the individual and family plans on a regularly updated page of their website . The page also lists the 14-day trial period and any current discount coupons.

An often overlooked side effect concerns fake login pages. The password manager checks the web address before filling it in. On a copy of the Etsy login page from a different domain, the field will therefore remain empty, and this silence should raise your suspicions.

How strangers gain access to seller accounts

The easiest way for criminals to steal data is by exploiting stolen information already obtained elsewhere. After a data breach at a forum, a photo service, or any online shop, email addresses and passwords end up in lists traded online. Programs then automatically test these pairs on hundreds of other services. In technical jargon, this is called credential stuffing, meaning the mass testing of stolen login credentials. Anyone who uses their old password from the painting forum for the online shop is essentially handing over the key along with it.

The prevalence of this tactic is demonstrated by Verizon 's 2025 Data Breach Investigations Report . Stolen login credentials were the most frequent entry point, leading to 22 percent of all data breaches investigated. A supplementary analysis by the company revealed that, in the average scenario, only 49 percent of a person's passwords across all services actually differed.

The second method is called phishing, which refers to fake messages designed to steal login credentials or payments. A case from Switzerland offers an instructive example for artists. In January 2024, the Swiss Federal Cyber ​​Security Agency reported that newly opened Etsy shops were being contacted via the platform's messaging system, seemingly by support staff.

Shop owners are required to verify a payment method before their shop is activated. In a test conducted by the authorities, only about 30 minutes passed between shop opening and initial contact. Etsy emphasizes in its help documentation that support will never request account or personal information via message, email, or social media.

If the takeover succeeds, it will quickly become expensive. Shopify explicitly mentions misdirected payouts as a possible consequence of poorly protected accounts. Added to this is the damage to your reputation if dubious giveaways are suddenly sent to collectors via your hijacked Instagram profile.

The second key for the shop and mailbox

A stolen password alone is of little use to attackers once additional verification is required for login. Etsy calls this process two-step verification. According Etsy mandatory for newly opened shops. Existing sellers must activate it themselves in their account settings. The code is requested when logging in on a new device or via a previously unknown browser, and again every 30 days. Shopify makes two-factor authentication mandatory as soon as you process payments through Shopify Payments.

The method you choose makes a noticeable difference. From the most robust to the weakest option, the ranking looks like this:

• Passkey or security key: Login is tied to your device or a small USB stick and cannot be intercepted via a fake website. Shopify supports both.
• Authenticator app: The smartphone generates new verification codes every second, even without a mobile network connection. Etsy and Shopify offer this method.
• SMS or phone call: Better than no second security measure at all, but more vulnerable because fraudsters sometimes redirect phone numbers to their own SIM cards. Shopify therefore no longer accepts SMS as a newly configured method.

Start with your email account. Almost all other passwords can be reset via this address. Whoever controls it also controls the shop and payment service. Next, check your seller account, payment provider, social media profiles, and the cloud storage containing your image files.

If the mobile phone falls off the table in the studio

Those who activate the additional protection on most platforms receive backup codes, each valid only once. Etsy explicitly advises keeping these codes safe so you can access your account even without your phone. A printout in your work folder or a separate entry in your password manager is sufficient. Storing these codes solely on your phone is not recommended, as you'll be missing that device in an emergency.

If you're working with an assistant, photographer, or agency, assign them separate employee accounts. With Shopify , each person sets up the additional security prompt for their own access. Sharing the account owner's password via messenger creates a security vulnerability whose consequences are difficult to trace later.

A free afternoon is all it takes to change the passwords for your crucial accounts and add a second layer of security. Work your way from your inbox outwards, securely store your backup codes, and occasionally check your shop's login history, which Etsy, , displays in your account settings. Once the overview of logins seems familiar, you can focus on what really matters: the next task on your easel.

Joachim Rodriguez y Romero

Owner and Managing Director of Kunstplaza . Publicist, editor, and passionate blogger in the fields of art, design, and creativity since 2011. Graduated with a degree in web design from university (2008). Further developed creative techniques through courses in freehand drawing, expressive painting, and theatre/acting. Profound knowledge of the art market gained through years of journalistic research and numerous collaborations with key players and institutions in the arts and culture sector.

www.kunstplaza.de