The dashboard controls real money: refunds are issued there, payout details are changed there and API keys are created there. A password is the only barrier, and a second factor turns a stolen password from a disaster into an inconvenience.
What the second factor protects
- Payout details: swapping the bank account is the fastest way to divert a merchant money.
- API keys: with them one can create payments and read operation data.
- Refunds: mass refunds to someone else cards look like ordinary store activity.
Why a password is not enough
- Passwords leak together with any other service where they were reused.
- A phishing page collects a password just as easily as the real login form.
- An infected employee computer hands the password over without their involvement.
What to do today
- Turn on two-factor authentication in the account settings.
- Give employees individual accounts instead of one shared password.
- Assign roles by task: an accountant needs no API keys, a developer needs no payouts.
How to handle API keys safely is covered separately.
