Hello, it seems we’re not able to perform identity verification.
This change provides 0 benefit to end users, and we’ll now need to ask end users to create an account for us under “https://admin.shopify.com/store/STORE/settings/organization-account/new” instead.
This change also expose partners to an eventual data breach of personal information.
Please remove this requirement.
Hey @David_Arbias Can you share more on where you see this potentially leading to a data breach?
For context, here’s more details on how this is designed to protect merchants: Identity verification for Shopify Partners starts today - Shopify developer changelog
We also have some troubleshooting resources here for the errors you’re seeing. https://help.shopify.com/en/partners/manage-account/verifying-your-identity#troubleshooting-identity-verification
Not @David_Arbias but they might be referring to the countless data breaches associated with unnecessary collecting and storing of PII and government issued ids. Ya know, like this one: FBI Probes Service Selling 153M+ Drivers Licenses – Krebs on Security
This is a tremendously bad idea. There were plenty of convenient authentication methods prior to these invasive identity verification systems. Unsurprisingly, developers are pushing back.
I’m familiar with the standard excuses companies give as to why this is necessary and the resulting statements issued: “It doesn’t take that long.”, “What’s the big deal?”, “What have you got to hide?” And I feel like nobody should have to tell a company this but… I don’t want you to collect more data than you need on me. I don’t trust you to keep my data safe. I don’t want you to have a copy of my official identification because see the previous 2 points. I don’t want you to share my data with 3rd parties. NO ONE DOES!!!
They let 1000s of garbage apps from new people onto the app store over past year and now are very concerned about partner scams. The poor decisions made by Shopify management are endless. One poor decision begets another headache for devs.
Our concern isn’t that Shopify or Stripe are acting maliciously, or that Stripe is an untrusted provider. The concern is the security architecture created by making government-ID and selfie verification mandatory for every Partner who needs to request collaborator access.
This changes the threat model substantially. Instead of protecting a Shopify account with revocable credentials such as passwords, MFA/passkeys, access scopes and merchant approval, Partners are now required to submit a government ID plus facial data to another system. Shopify’s announcement confirms that this is processed through Stripe. Stripe’s own Identity terms contemplate retention of submitted verification data rather than a system in which the ID simply disappears immediately after verification.
“It’s handled by a trusted third party” is not an answer to the breach concern. Third-party identity and verification systems have themselves been compromised. In November 2025, Veriff—an identity-verification provider—experienced an incident in which a Total Wireless customer notice says an unauthorized party obtained images of government-issued IDs, and potentially addresses and dates of birth, directly from Veriff’s systems.
In 2025, Discord disclosed that compromise of a third-party customer-service provider potentially exposed government-ID photos for approximately 70,000 users. Discord explicitly emphasized that its own systems were not breached—the problem was the trusted third party.
Also in 2025, the Tea app disclosed a breach involving approximately 13,000 verification selfies and photo IDs. This is particularly relevant because Tea had told users that verification selfies were deleted after review. The existence of old verification images in the breach is a good illustration of why a deletion promise does not eliminate the underlying architectural risk.
Coinbase disclosed another variation of the same problem in 2025: criminals recruited or bribed support personnel who had legitimate access to internal systems. The compromised information included government-ID images such as passports and driver’s licences. Encryption at rest does not solve an attack where an authorized person or compromised service account can legitimately retrieve the data.
And this is not merely historical. In September 2026, IDScan.net—whose business is ID scanning and identity verification—reported unauthorized access to customer information in its cloud environment, including names and government-issued identification numbers. Its investigation is still ongoing, so I would not speculate about the ultimate scope, but it is another current example showing that specialized identity providers are not outside the normal threat model.
So I would not claim that a Shopify/Stripe breach is inevitable. The point is simpler: collecting a copy of an ID and facial data creates a high-value dataset that did not previously need to exist for this workflow, and once it exists there is a non-zero probability of compromise through software vulnerabilities, credential theft, insiders, support systems, subprocessors, misconfiguration or human error.
The downside is unusually severe because these are not ordinary credentials. I can change a password, rotate an API key and revoke a session. I cannot issue myself a new face, date of birth or identity history after those attributes are leaked.
This is particularly difficult to justify for collaborator access because the merchant still has to approve the collaborator request. Shopify therefore should explain what measurable abuse this universal identity check prevents that cannot be addressed with less invasive controls such as strong MFA/passkeys, organization verification, risk-based step-up verification, short-lived and granular access permissions, merchant confirmation, anomaly detection, access expiry and audit logging.
The verification itself may reduce one category of fraud while simultaneously creating a new category of concentrated identity-data risk. The question is whether that trade-off is necessary and proportionate—not whether Stripe is a reputable company.
Just message support around 5 times, and after scalating the issue all they recommend is taking a picture of your passport, which is probably your most sensitive piece of document.
Did you know only 17% of Japanese have passport? Would that mean Shopify is discriminating against the Japanese?
What about stateless people?
anybody dealing with this arbitrary policy, the quality of the ID doesn’t matter as much as your first and last name matches.
We are refusing to do it and asking shops to create an account directly.
With all the vibe-coded issues we’re observing at Shopify recently, I just started to get reluctant to let them access my ID.
