Macy's account help: sign-in flows, phishing red flags and securing your profile

What a genuine sign-in flow looks like

A legitimate department store sign-in page has a small number of observable characteristics that are consistent every time. The URL in the browser address bar loads over HTTPS — the padlock icon appears before any text is entered. The domain matches the retailer's known corporate domain character for character: no extra hyphens, no appended words, no unusual country-code extension. Clicking the padlock reveals a certificate issued to the corporate entity, not to an anonymous third party.

The page itself asks for two pieces of information: an email address and a password. That is the entire initial step. A genuine sign-in page does not ask for a credit-card number, a Social Security number, a date of birth or answers to multiple security questions as part of logging in. It does not pop up a modal asking you to confirm your address before you have even entered credentials. If a page does any of those things before authentication completes, leave immediately.

After successful password entry, a site with multi-factor authentication enabled sends a verification code. This step is normal, expected and a good sign. The code arrives by text or from an authenticator app and is valid for a short window. If you receive an MFA code you did not request — meaning no sign-in attempt was made from your side — that means someone else has your password and is attempting to complete sign-in. In that case, do not enter the code; instead, go directly to the retailer's password-reset flow using a separately typed URL and change your password immediately.

The account dashboard, once loaded, shows order history, saved addresses, saved payment methods and rewards-points balance. It does not display the full card number for any saved card — only the last four digits. If a page shows a full card number without being inside the card issuer's own authenticated environment, that is a red flag worth investigating.

The four-step secure sign-in walkthrough

The editorial bench distilled the most important security practices into four sequential steps. Each step corresponds to a moment in the sign-in process where a failure — skipping the step or being deceived at it — leads to a specific type of account compromise.

Step one: type the domain directly. Open a fresh browser tab and type the retailer's address by hand. Do not follow a link from an email, a text, a social-media post or a search-engine ad. Search-engine ads, in particular, can lead to lookalike sites that appear above the genuine result. Typing directly costs five seconds and eliminates an entire class of attack.

Step two: verify the padlock and domain. Before typing any credentials, look at the address bar. Confirm the padlock is present and that the domain is exactly right. Click the padlock to see the certificate details. A genuine certificate lists the corporate entity as the subject. If anything in the domain looks unfamiliar — a hyphen that was not there before, an extra word, a different top-level domain — close the tab without entering anything.

Step three: enter only email and password. The sign-in page asks for two fields. Fill both; submit. If the page asks for anything beyond those two fields before authentication is confirmed, something is wrong. Report the URL to the FTC at reportfraud.ftc.gov and close the tab.

Step four: complete MFA if prompted. Enter the code from your authenticator app or the text message. If you did not initiate the sign-in but a code arrives, treat that as an active attack: change your password immediately without entering the code.

Phishing red flags specific to retail accounts

Phishing attempts targeting retail accounts follow predictable patterns. Recognising the patterns is faster than verifying each email individually. Most phishing emails directed at department-store shoppers share at least two of the following seven signals.

Urgency language is the most reliable single indicator. "Your account has been compromised — act within 24 hours or your rewards points will be forfeited" is the template. Real retailers do not threaten to forfeit loyalty points on a 24-hour clock. Urgency exists to prevent you from pausing to verify.

Sender address mismatch is the most technically reliable signal. Hover over the sender name to reveal the full address. If the visible name says the retailer but the actual address is a free webmail account or an unfamiliar domain, the email is not from the retailer.

Generic greeting is a secondary signal. A retailer that has your account knows your name. "Dear Valued Customer" in an account-security email is a sign the sender does not have access to your account record and is guessing.

Link destination mismatch is verifiable before clicking. Hover over any link in the email and the destination URL appears in the browser status bar. If that URL does not match the retailer's corporate domain, do not click.

Requests for full card numbers or passwords in email are never legitimate. No retailer sends an email asking you to reply with your full card number or current password. If an email asks for either, delete it.

Attachment requests are rare from legitimate retailers. A receipt is delivered as an inline email, not as an attachment requiring you to enable macros. An attachment you were not expecting, from a sender claiming to be a retailer, is almost always malicious.

Inconsistent branding — blurry logo, wrong font, slightly off colour palette — is a signal that the email was not produced by the retailer's design team. Phishing kits are often assembled quickly and the branding is close but not exact.

Reader testimonials

I had always assumed that big retailers kept my account safe on their end and I didn’t need to worry about it. This page showed me that the account is only as safe as the password I chose in 2019 and that MFA is something I control, not the retailer.

— Casimir P. TrowbridgeAccount-help reader · New Haven, CT

The phishing red flags table is the clearest version of that information I have seen. I forwarded it to three family members who shop the department store regularly and all three enabled MFA the same week.

— Theodora M. CrenshaweCardholder reader · Hartford, CT

Password managers and why they matter here

The argument for a password manager is simple. A password manager generates a unique, random, strong password for every account. Unique means that a credential stuffing attack — where an attacker takes a list of email-and-password pairs stolen from a breached site and tries them on other sites — cannot reach your department store account even if another account was compromised. The breached password works nowhere else because nowhere else uses it.

Most modern password managers are built into browsers or available as standalone apps. They also alert the user when a stored password appears in a known data-breach list, which means the shopper learns about a credential exposure before an attacker attempts to use it. For a retail account with a saved credit card, that early-warning function is worth more than the convenience of auto-fill.

One practical detail: most password managers require their own master password to unlock. That master password should be the one password the shopper commits to memory. It should be long, unique and never used anywhere else. The manager protects every other password; the master password must be protected by the shopper.

Multi-factor authentication explained

Multi-factor authentication adds a second layer of verification after a password is entered. The most common form is a six-digit code sent by text message or generated by an authenticator app on the shopper's phone. Authenticator apps — which generate codes offline — are meaningfully stronger than SMS-based codes because SMS can be intercepted or redirected through a SIM-swap attack. For most shoppers, either method is a dramatic improvement over password-only security.

Enabling MFA on a retail account typically takes fewer than five minutes. The account settings page has a security or two-step verification section. The shopper follows the prompts to link a phone number or an authenticator app, verifies with an initial code and the feature is active. From that point forward, every sign-in from an unrecognised device requires both the password and the code.

The tradeoff is a small amount of friction at sign-in. That friction is the point. An attacker who has your password but not your phone cannot complete sign-in. The friction that protects you also stops the attacker, and the two or three seconds it adds to the sign-in experience is a worthwhile exchange for a saved-card account holding accumulated rewards.

Phishing red flag reference table