Short answer: Sign in and go to Profile → Settings → Security, then enable two-factor authentication with an authenticator app. Mailchimp offers a monthly account credit as an incentive, which is unusual and worth taking. Then review users, API keys and connected integrations — because your subscriber list is the asset, and it can leave through an API key without anyone logging in.
Why email marketing platforms are attacked
Two reasons, and both are worse than they first appear.
The list itself. Thousands of email addresses, often with names, locations, purchase history and engagement data. That is valuable to sell, and it is personal data you are legally responsible for under GDPR and similar regimes. A breach is a notification obligation, not just an embarrassment.
The ability to send as you. This is the more damaging one. An attacker with your account can email your entire subscriber base from your verified domain, with your branding, to people who trust you. Phishing sent through a legitimate marketing platform bypasses spam filters and reader scepticism simultaneously.
There is precedent. Mailchimp has been targeted repeatedly through social engineering of its own staff and through customer account compromises, with attackers going after crypto and finance audiences specifically.
Step 1: Enable two-factor authentication
- Sign in to Mailchimp.
- Click your profile icon → Profile.
- Open Settings → Security (sometimes shown as Two-factor authentication).
- Click to enable, and choose your method.
Mailchimp supports authenticator apps and SMS. Choose the app. Text codes are exposed to SIM swapping, and a marketing account with a large list is worth targeted effort — see SMS vs authenticator apps.
Scan the QR code with Google Authenticator, Aegis, 2FAS, Microsoft Authenticator or a password manager. New to it? What is an authenticator app. If the code will not scan, use manual key entry. If you would rather keep codes on the machine you work from, weigh up desktop and browser authenticators first.
Do not screenshot the QR code — what’s inside a 2FA QR code.
Step 2: Claim the discount, save the codes
Mailchimp has long offered a monthly account credit to users with 2FA enabled — a rare case of security paying for itself. Check your billing settings after enabling.
More importantly, save the backup codes Mailchimp provides. Store them offline or in a password manager, not in a draft campaign. See where to store backup codes safely.
Step 3: Enforce it for your team
Under Account → Settings → Users:
- Review every user. Agencies, freelancers, former marketing staff. Each has access to your list.
- Assign the narrowest role — Author or Viewer rather than Admin, unless the person genuinely needs Manager or Owner rights.
- Enable the account-level requirement for two-factor authentication where your plan supports it, so nobody is opted out by inaction.
- Remove people promptly when engagements end. The pattern is in 2FA for small teams.
A common gap: the agency that built your last campaign still has Manager access two years later, and their own account security is unknown to you. The same applies to the shared workspace where campaign plans live — see how to set up 2FA on Notion.
Step 4: API keys — how lists actually leak
An API key authenticates without any 2FA prompt. It can read your entire audience, export it, and send campaigns.
- Review every key under Account → Extras → API keys. Revoke anything you cannot identify.
- Delete keys created for tools you no longer use — old form plugins, abandoned CRM integrations, a developer’s test key.
- Rotate keys that have been in a shared document, a WordPress plugin config, or a contractor’s laptop.
- Check connected integrations under Integrations. Each holds access, and a breach at any of them is a breach of your list.
If your site runs WordPress, remember the Mailchimp API key sits in that site’s database — so your site’s security is part of your list’s security. The same holds for any storefront you sell through, such as two-factor authentication on Etsy. See 2FA on WordPress.
Step 5: Domain and sending reputation
Two settings that protect your subscribers as much as your account:
- Domain authentication (SPF, DKIM, DMARC). Properly configured DMARC makes it much harder for anyone to spoof your domain — worth doing regardless of Mailchimp. Your DNS provider is the place to configure it: Cloudflare.
- Notifications. Turn on alerts for logins, user changes and campaign sends. An unexpected campaign notification is your fastest warning that something is wrong.
The phishing aimed at list owners
- “Your account has been flagged for review” or “unusual sending activity” — leading to a fake login page that relays your credentials in real time (can 2FA be hacked?).
- Fake compliance or abuse complaints, designed to create urgency.
- Billing failure notices asking you to update card details.
- Malicious files from “subscribers” or “partners”, carrying infostealer malware that takes session cookies (session hijacking).
Rule: never sign in from an email link. Type mailchimp.com yourself.
Frequently asked questions
Does Mailchimp really discount for 2FA?
It has offered a monthly account credit for users with two-factor authentication enabled. Check your current billing page — programme details change, but it has been a long-running incentive.
Which authenticator app works?
Any standard TOTP app — Mailchimp uses the normal algorithm. See how TOTP codes work.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time — why 2FA codes get rejected.
What if I lose my phone?
Use a backup code, or Mailchimp support with identity verification. On a team account, an Owner may be able to help. See recovering accounts after losing your 2FA phone.
Does 2FA protect my subscribers’ data?
It protects account access. API keys, integrations and user permissions are separate paths to the same data — which is why the audit steps matter as much as the login.
My account sent a campaign I did not create. What now?
Pause any scheduled sends, change your password and end sessions, revoke all API keys, review users, and contact Mailchimp support. Then notify your subscribers — a short, honest message limits the damage from anything they received.
The bottom line
Enable the app-based 2FA, take the credit, save the backup codes, then do the less obvious work: users pruned, API keys revoked, integrations reviewed, DMARC configured. Your subscriber list is a liability as well as an asset, and it can walk out through an API key belonging to a plugin you forgot you installed.
Securing the rest of your marketing stack? See Shopify, Canva and WordPress. If social channels drive your sign-ups, add 2FA on Pinterest to the list.