Identity for Retail & E-commerce

The job identity does in retail and e-commerce

In retail, identity is a conversion lever and a fraud control at the same time. Every extra step at signup and checkout costs revenue, yet weak identity invites account takeover, bot abuse and payment fraud. Behind the storefront sits a second identity estate: store and warehouse staff, seasonal workers, delivery partners, outsourced service desks and the cloud data platforms that hold customer and applicant records.

Retail and e-commerce account for 8 of the 123 incidents in the Identity Breach Database (6.5%), and the count is rising: 1 in 2021-2022, 3 in 2023-2024 and 4 in 2025-2026, per the Identity Breach Report 2026. All 8 abused a human account. None of them needed a software exploit.

The identity threat picture, from the incident record

Credential stuffing against stored value. 2 of the 8 were credential stuffing against the same loyalty program. From December 2022 to February 2023 attackers took over 71,473 Chick-fil-A One accounts with passwords reused from other breaches, exposing partial card numbers and reward balances. In June 2026 it happened again, this time 13,322 accounts with stored credit balances and mobile pay numbers. Loyalty points and stored payment methods turn a reused password into cash.

Data platforms behind a single password. 2 of the 8 were retailers in the Snowflake campaign, where infostealer-harvested credentials opened accounts that had no MFA. Advance Auto Parts notified 2,316,591 job applicants and employees whose Social Security and driver's license numbers may have been taken, and expected about $3 million in costs for the quarter. Neiman Marcus notified 64,472 people. The technique is infostealer credential harvesting.

Tricked staff and impersonated vendors. The other 4 began with a person. DoorDash lost customer and driver data in 2022 through phished credentials of a third-party vendor, part of the campaign that also hit Twilio, and again in 2025 after an employee fell for a social engineering scam. At Marks & Spencer, attackers entered on 17 April 2025 through an impersonation of one of the retailer's third-party users; M&S estimated an impact of about GBP 300 million on group operating profit before mitigation and insurance. ASOS said in October 2026 that an impersonated trusted contact obtained an employee's login to customer data on third-party platforms. The M&S pattern is covered in the Scattered Spider help desk teardown and the help desk social engineering technique.

MFA status. In 3 of the 8 the record says MFA was absent on the abused account (the 2023 Chick-fil-A wave and both Snowflake accounts); the other 5 do not say. No retail record shows MFA present and bypassed, which suggests the cheapest attacks still work in this sector.

The regulatory floor

• PCI DSS governs systems that touch card data. Version 4.0's MFA requirement for all access into the cardholder data environment (Requirement 8.4.2) was a best practice until 31 March 2025 and has been mandatory since. See identity controls for PCI DSS.
• GDPR and UK GDPR cover shopper data; both M&S and ASOS are UK retailers. The Data (Use and Access) Act 2025 is now amending the UK regime.
• CCPA/CPRA requires verifying consumers' identity before honoring access or deletion requests. Upcoming dates: risk assessments for existing significant-risk processing by 31 December 2027, and the first cybersecurity audit reports, which assess MFA and access controls, by 1 April 2028 for businesses over $100 million in revenue.
• Other state privacy laws keep tightening: the Delaware DPDPA amendments lower thresholds from 1 January 2027, and the Maryland MODPA cure period ends on 1 April 2027.
• Marketplaces designated as very large online platforms in the EU must accept the EU Digital Identity Wallet under eIDAS 2.0 by 24 December 2027.

The identity controls that matter most

1. Bot detection and breached-password checks at login. Both Chick-fil-A waves were automated logins with known-breached passwords. Rate limits, bot signals and screening against breached credential corpora stop most stuffing runs. See account takeover.
2. Passkeys for shoppers. Passkeys remove the reusable password that stuffing depends on and cut checkout friction. Start with passkeys 101.
3. Step-up before value leaves the account. Step-up authentication when a loyalty balance is redeemed, a payment method is added or a delivery address changes, driven by risk-based authentication.
4. MFA on every data platform and SaaS tenant. The Snowflake accounts were reachable from anywhere with a password. Enforce MFA, network allow lists and conditional access on analytics, CRM and marketing platforms.
5. Verified resets and phishing-resistant MFA for staff and vendors. Outsourced service desks and third-party users need the same reset verification as employees, and resets for privileged accounts should not be satisfiable with personal details. See MFA implementation best practices.
6. Fast joiner-mover-leaver for seasonal staff and partners. User lifecycle management keeps short-term access from lingering.

Vendor categories and named vendors

• Consumer CIAM: Auth0 and Stytch for developer-built storefronts; Transmit Security where fraud signals and passwordless sit in one platform; SAP Customer Data Cloud for consent and profile data in SAP estates. See best passwordless CIAM providers.
• Fraud and risk signals: Sardine, SEON and Persona at signup, login and checkout.
• Breached credential intelligence: SpyCloud for screening logins and staff accounts against infostealer data.
• Workforce MFA and recovery: Okta for store and head office identity, and HYPR for phishing-resistant login with verified recovery against help desk fraud.
• Privileged access and governance: CyberArk (Idira) for cardholder-data admins and SailPoint for access certification.

The fuller shortlist is in best identity tools for retail and e-commerce, with background in identity for retail and e-commerce.

Common pitfalls

• Adding friction uniformly instead of risk-based step-up, which hurts conversion and still misses bots.
• Treating loyalty accounts as low-value until balances are drained, twice.
• Securing the storefront while customer and applicant data sits in a cloud platform behind a password.
• Holding outsourced help desks to a weaker reset standard than in-house staff.

Where it is heading

Passkeys will become the default shopper login at large retailers, fraud and identity signals will keep merging into one decision at login, and the M&S and ASOS cases are pushing retail boards to treat service desk and vendor identity as a business-continuity risk, not an IT detail.

Frequently asked questions

What is the most common identity attack on retailers?

In the database, the 8 retail incidents split between people being tricked (4), credential stuffing (2) and stolen passwords for data platforms without MFA (2). Shopper-facing stuffing is the most visible; staff and vendor social engineering caused the costliest disruption.

Why do attackers target loyalty accounts?

They hold stored value and payment methods but are often protected by a password alone. Chick-fil-A One was stuffed twice, in 2022-2023 and in 2026.

Does PCI DSS require MFA?

Yes. PCI DSS 4.0 requires MFA for all access into the cardholder data environment, mandatory since 31 March 2025. It does not cover loyalty or shopper logins outside that environment, which is where the stuffing incidents happened.