How to Protect Against Unauthorised Account Access
This guide is designed to help sellers avoid platform violations. Please keep in mind that the policies and examples provided here are not exhaustive. TikTok Shop's policies may change periodically, so for the most up-to-date information, please visit the TikTok Shop Policy Center
What is an Account Takeover?
An Account Takeover occurs when a TikTok Shop account is compromised due to unauthorised access. Any attempt to gain access to an account without permission is a violation of our platform policies.📍To learn more, visit TikTok Shop Unauthorised Account Access Policy
Important Reminders to Users
TikTok Shop will never ask for login information or credentials. Users should not disclose such information, even if someone claims to be a TikTok Shop employee.How to prevent account takeover?
To enhance account security, sellers are encouraged to take the following non-exhaustive steps:
Ensure that login information remains confidential
Always keep login details and credentials private; they should be known only to the owner of the TikTok Shop account. Do not share sensitive account information, such as usernames, passwords, One-Time Passwords (OTPs), PINs, or any other credentials with anyone. Sharing this information could result in unauthorised access to and control of the Shop Account.
Use Strong and Secure Passwords
Passwords are essential for protecting the seller's Shop Account. As the first line of defense against unauthorised access, passwords should be unique and known only to the sellers. To help keep online accounts and personal information secure, consider the following tips:
✅ Use a combination of at least eight characters, including letters, numbers, and symbols. The longer the password and the more varied the characters it includes, the harder it will be to guess. For example, "aR@1nY6#y" (which stands for "a rainy day") is a unique combination of upper and lower case letters, numbers, and symbols that is still easy to remember
✅ Be cautious of phishing emails, texts, or calls. If you are unsure about the identity of the person contacting you, do not respond or provide any personal information. Phishing is a fraudulent practice that encourages individuals to reveal personal information, such as passwords and credit card numbers.
❌ Avoid using sequential numbers or letters in your password. For instance, do not use combinations like "abcd," "3456," "qwerty," or "jhgf"
❌ Do not include your birth year, birth month, or birthday in your password. Remember, unauthorised individuals can easily find this information through public social media accounts
❌ Never reuse your passwords. Each device, application, website, and piece of software should have a unique and strong password or PIN. Reusing passwords increases the risk of multiple accounts being compromised simultaneously
❌ Do not share your passwords. This applies to colleagues, support teams, or anyone whose identity you cannot verify. You can assign sub-accounts to employees to control their access to the main shop account. To learn more, see the section below regarding how to manage shop admin and sub-account permissions
✅ Use a combination of at least eight characters, including letters, numbers, and symbols. The longer the password and the more varied the characters it includes, the harder it will be to guess. For example, "aR@1nY6#y" (which stands for "a rainy day") is a unique combination of upper and lower case letters, numbers, and symbols that is still easy to remember
✅ Be cautious of phishing emails, texts, or calls. If you are unsure about the identity of the person contacting you, do not respond or provide any personal information. Phishing is a fraudulent practice that encourages individuals to reveal personal information, such as passwords and credit card numbers.
❌ Avoid using sequential numbers or letters in your password. For instance, do not use combinations like "abcd," "3456," "qwerty," or "jhgf"
❌ Do not include your birth year, birth month, or birthday in your password. Remember, unauthorised individuals can easily find this information through public social media accounts
❌ Never reuse your passwords. Each device, application, website, and piece of software should have a unique and strong password or PIN. Reusing passwords increases the risk of multiple accounts being compromised simultaneously
❌ Do not share your passwords. This applies to colleagues, support teams, or anyone whose identity you cannot verify. You can assign sub-accounts to employees to control their access to the main shop account. To learn more, see the section below regarding how to manage shop admin and sub-account permissions
Activate 2-Step Verification
TikTok Shop allows users to enhance their account security by enabling two-step verification (2SV). This additional verification is required each time you log in. To set up two-step verification, sellers should follow these steps:
📍 What is an Authenticator App?
The Authenticator App is a mobile security application that generates a two-factor login code. This app allows users to create a unique code, making it more challenging for hackers to gain unauthorised access to their devices. It is important for users to ensure that their authentication app is installed on a secure device that only they can access.
Authenticator apps such as 'Google Authenticator' are suitable for this use. Microsoft Authenticator is available for Apple and Android users as well.
- Log in to your Seller Center and access the Seller Profile under My Account
- Click on the "Account Information" tab and scroll down to the "Account Security" section
- Choose your preferred verification method under the "Two-step verification" section
The Authenticator App is a mobile security application that generates a two-factor login code. This app allows users to create a unique code, making it more challenging for hackers to gain unauthorised access to their devices. It is important for users to ensure that their authentication app is installed on a secure device that only they can access.
Authenticator apps such as 'Google Authenticator' are suitable for this use. Microsoft Authenticator is available for Apple and Android users as well.
Avoid Clicking on Suspicious Links and Downloading Unknown Files
✅ Always ignore links or attachments sent by non-verified or unknown sources
❌ Never provide your TikTok Shop account information, such as your username, password, OTP, or PIN, on online forms or websites
❌ Do not download any files or attachments from unknown sources, external parties, or unverified senders
❌ Avoid clicking on links or downloading files from suspicious sources, as they may direct you to phishing sites attempting to acquire your login details
📍To verify the authenticity of the sender, sellers can contact Seller Support Service
❌ Never provide your TikTok Shop account information, such as your username, password, OTP, or PIN, on online forms or websites
❌ Do not download any files or attachments from unknown sources, external parties, or unverified senders
❌ Avoid clicking on links or downloading files from suspicious sources, as they may direct you to phishing sites attempting to acquire your login details
📍To verify the authenticity of the sender, sellers can contact Seller Support Service
Beware of third parties that offer shop services or prizes
Be cautious of third parties that offer account services or prizes in exchange for seller's TikTok Shop account details. It's essential to protect the seller's account by keeping this information confidential. Never share login details and credentials; they should be known only to users, the owner of the TikTok Shop account.
How to manage Shop's Administrative and User Permissions?
The primary account with administrative access will have permission to manage all seller settings and full control over the various permissions on TikTok Shop. Sub-accounts, on the other hand, can be assigned different levels of permission. To manage new users or sub-accounts, sellers should navigate to the Seller Center, click on "My Account," and select User ManagementSellers can assign specific roles to newly added users, such as:Role | Permissions |
Main Administrator | Main administrators have the ability to edit and view any module, including products, orders, finance, and marketing, but they cannot manage sub-accounts. |
Affiliate Manager | Affiliate managers can view and create various affiliate plans, communicate with creators, and analyze affiliate performance data. |
Finance Specialist | Finance specialists have access to the financial module, allowing them to view bill details and export finance reports. |
Advertising Manager | Advertising managers can utilize the advertising options available in the Seller Center as well as the TikTok for Business advertising platform. They can create advertising plans and monitor advertising data. |
Marketing Specialist | Marketing specialists can view and edit all pages within the marketing module. They also have the capability to create, modify, and terminate promotional campaigns. |
Customer Service Agents | Customer service specialists can access the TikTok Shop messenger service, respond to consumer inquiries, and provide after-sales support. |
Order Fulfilment Specialist | Order specialists can navigate the order management page, organize deliveries, track logistics, and process returns and refunds. |
Product Management Specialist | Product specialists are responsible for managing the product management page, which includes activating, managing, and delisting products. |
- Only invite individuals from your own company
- Ensure that each member has their own individual user account, and avoid sharing passwords with others
What to do if a seller's account has been compromised?
If a seller is unable to sign in to their TikTok Shop account and no longer has access to the registered email or mobile phone number, they should contact our Seller Support Service for assistance.To protect the account from unauthorised access, it will first be frozen. The TikTok Shop owner will then be required to upload documents to verify their ownership of the account. Once TikTok Shop has verified the submitted documents and completed a further investigation, the seller will be informed about the next steps to regain access to their account.