Mailchimp Security: Account Access, Integrations and Phishing Abuse

A Mailchimp account combines your audience lists with the ability to send trusted email in your brand's name, which makes its logins, API keys and connected apps valuable to anyone running a phishing or spam campaign. Most Mailchimp risk sits on the customer side of the shared responsibility line: who holds Owner and Admin, whether every user has two-factor authentication, how many API keys exist and who owns them, and which apps have been authorised. This guide explains Mailchimp's user levels, how to protect sign-in against credential phishing, how to manage API keys and OAuth apps as non-human identities, what evidence is available for monitoring, and a hardening baseline covering domain authentication and contact data. It is written for marketing operations teams, account owners, and the security and privacy staff who support them.

This is an independent guide from NHI Mgmt Group, based on Mailchimp's public documentation as of November 2026. It is not sponsored or reviewed by Mailchimp. Product features change, so confirm settings against Mailchimp's current documentation.

Key takeaways

• Admin equals Owner. Mailchimp gives Admin the same permissions as Owner, including billing, exports and user management, so keep both to a small, named group.
• Turn on 2FA for every user. Mailchimp supports one-time passcodes by authenticator app or SMS, and account verification by SMS when sign-in looks unusual; prefer the authenticator app.
• An API key is full account access. Mailchimp says to protect keys like passwords; give each integration its own named key, rotate at least yearly, and note that keys created on or after 22 June 2026 expire after one year.
• Review connected apps. Integrations > Manage > Other connections lists authorised apps; removing one revokes access immediately, but any API key the integration holds must be revoked separately.
• Authenticate your sending domain. Two DKIM CNAME records and a DMARC record protect recipients and your brand, and Gmail and Yahoo require them for bulk senders.

How identity and access work in Mailchimp

Each Mailchimp account has one Owner and any number of invited users, each assigned a user level. Every person signs in with their own username and password, and each user turns on two-factor authentication in their own profile. As of November 2026 Mailchimp's public help centre describes sign-in with Mailchimp credentials plus 2FA, so the controls in this guide are applied inside the account and through each user's profile.

User levels

Two capabilities carry the most risk. Exporting audiences is limited to Owner and Admin, so anyone at those levels can take your full contact list. Creating API keys is available to Owner, Admin and Manager, and each key acts with full account access. Assign Author to content creators and Viewer to stakeholders who only need results.

Authentication

• Two-factor authentication: each user enables 2FA with an authenticator app or SMS. Make it a condition of being invited, and confirm it at every access review. Authenticator apps also remove exposure to SIM swap attacks. See the Phishing-Resistant MFA Guide.
• Account verification: once 2FA is set up, enable Account verification under Profile > Account > Settings > Security. Mailchimp then texts a code at the next sign-in when it sees unusual activity.
• Unique passwords: Mailchimp advises a password not used anywhere else; store it in a password manager so users can spot look-alike sign-in pages that the manager will not autofill.
• Recovery details: keep the primary contact phone number and the profile's legal name and address current, since Mailchimp may use them to confirm ownership during a lockout.

Admin roles and privileged access

• Use a role-based Owner: the account must always have an Owner. Hold it on a named senior person with a strong password and 2FA, and document the ownership transfer procedure: an Owner or Admin can transfer ownership, after which the previous Owner becomes Admin and can be removed.
• Keep two Admin-level people: one Owner plus one Admin avoids a single point of failure without spreading export and billing rights widely. See the Break-Glass Account Guide.
• Prefer Manager for operators: on Premium, Manager lets senior marketers send and import without exporting audiences or changing billing.
• Never share logins: agencies and freelancers get their own invited user at the lowest level that works, so their access can be removed alone and their actions are attributable.
• Remove leavers promptly: revoking a user's access also removes the API keys that user created, so check which integrations depend on their keys before removal and re-issue keys under an owned account first. See the Joiner-Mover-Leaver Guide.

Integrations, API tokens and service accounts

Mailchimp has two kinds of non-human access: API keys, created by a user and used by your own scripts or integrations, and authorised applications, third-party apps connected through OAuth 2.

API key practice

1. One key per integration: name each key after the app that uses it, so one can be revoked without breaking others.
2. Copy once, store safely: the full key is shown only at creation; afterwards Mailchimp shows only the name and first four digits. Put it straight into a secrets manager. See the Secrets Management Guide.
3. Keep keys server-side: Mailchimp directs that API keys stay out of client-side code (CORS requests) and mobile apps; route calls through your back end.
4. Never email or screenshot keys: Mailchimp warns that blurring is not always enough; remove keys from videos and help documents entirely.
5. Rotate at least yearly: generate the new key, update the integration, confirm it works, then revoke the old key. Track expiry for keys created on or after 22 June 2026, which expire one year after creation.
6. Create keys under an owned account: because keys are removed with their creator, issue integration keys from a long-lived Admin or Manager account owned by the team, not from an individual who may leave.

For key lifecycle practice, see the API Key Management Guide and the Generic API Key Detection Guide for secret scanning patterns.

Connected apps

Connected apps inherit the level of the user who authorised them, which is a good reason to have Author users connect content tools and reserve Admin connections for apps that need them. Review Integrations > Manage > Other connections each quarter and remove anything unused. If a device with a connected app is lost, Mailchimp advises disabling the app on the API keys page. Before connecting a new app, check what it asks for and who in your organisation will own it. See the Consent Phishing and Illicit OAuth Grants Guide.

Logging and detection

Mailchimp describes activity notifications and automatic suspension for suspicious logins as platform controls. Build your own monitoring around them.

Phishing that targets Mailchimp users

Mailchimp states it will never call, email or text you to ask for your password or one-time passcode. Teach marketing staff that rule directly, since fake "account suspended" or "billing failed" messages are aimed at people who hold sending rights. Map scenarios to MITRE ATT&CK T1566.002 (Spearphishing Link) for credential theft and T1078.004 (Cloud Accounts) for use of stolen sign-ins. See the Phishing Guide and the Phishing Incident Response Playbook.

Reporting abuse

Report abusive email sent through Mailchimp, or messages impersonating Mailchimp, using the form on Mailchimp's abuse page or by forwarding the message with full headers to [email protected].

Metrics

• 2FA coverage: share of users with 2FA on, target 100%.
• Owner plus Admin count: target two or three.
• API keys mapped to an owner and integration: target 100%, with none older than 12 months.
• Unrecognised connected apps found at review: target zero.
• Sending domains authenticated: every from-domain shows Authenticated on the Domains page.

Hardening baseline

Domain authentication

Verify your email domain, then go to Account & billing > Domains > Start authentication. Mailchimp asks for two DKIM CNAME records and a DMARC TXT record at _dmarc; most validate within minutes but it can take up to 48 hours. Mailchimp notes that Gmail and Yahoo require custom authentication, and a published DMARC record for senders of more than 5,000 messages a day to their addresses. Move your DMARC policy towards enforcement once reports show legitimate sources aligned. See the DMARC, SPF and DKIM Guide.

Contact data and privacy

• Delete, do not just archive, on request: Mailchimp states that archiving is not a legal substitute for deletion, and that EU contacts who ask for removal must be permanently deleted from every audience holding their data.
• Limit exports: only Owner and Admin can export audiences; keep those levels small and record why each export was made.
• Minimise fields: collect only the merge fields you use. See Data Minimisation.
• Review data use settings: Account > Settings > Manage my data holds opt-outs for Mailchimp data analytics projects and personalised advertising; decide on them with your privacy team.

Phased rollout

1. Inventory (week 1): list users and levels, API keys, connected apps, sending domains and audiences.
2. Sign-in (week 1 to 2): require 2FA from every user, starting with Owner and Admin, then enable account verification. Confirm recovery details first so no one is locked out.
3. Levels (week 2): move users down to Manager, Author or Viewer where possible; keep a record of previous levels so you can restore one quickly if work is blocked.
4. Keys and apps (weeks 2 to 4): re-issue each integration a named key under a team-owned account, test, then revoke old keys. Remove unused connected apps.
5. Domains (weeks 3 to 6): authenticate every sending domain, publish DMARC at monitoring, then move to enforcement.
6. Ongoing: quarterly review of users, keys and apps.

Choosing between options

• API key versus OAuth app: use an API key for your own account's back-end integrations; use OAuth when you build a tool that acts for other Mailchimp users.
• Authenticator app versus SMS: choose the app wherever users can install one; keep SMS for account verification.
• Small teams: on plans without Manager, Author and Viewer, keep Admin to one other trusted person and rely on 2FA, key hygiene and regular reviews.

Common misconfigurations

• Everyone is Admin: gives every user export and billing rights. Use the lowest level that works.
• One API key shared by several tools: revoking it breaks everything at once, so it never gets rotated.
• Integration keys created by a person who then leaves: removing the user deletes the key and integrations fail. Issue keys from a team-owned account.
• Keys in front-end code or shared documents: exposes full account access. Keep keys on the server.
• Connected apps never reviewed: trial tools keep access long after use stops.
• Sending from an unauthenticated domain: hurts delivery and makes spoofed messages harder for recipients to tell apart.

Framework mapping

Practitioner checklist

• Confirm every user has 2FA on, starting with the Owner and Admins, and enable account verification.
• Keep Owner plus Admin to two or three named people, with an agreed ownership transfer procedure.
• Move operators to Manager, creators to Author and stakeholders to Viewer where your plan allows.
• Give each integration its own named API key, created under a team-owned account and stored in a secrets manager.
• Rotate API keys at least yearly and track expiry for keys created on or after 22 June 2026.
• Review Integrations > Manage > Other connections quarterly and remove unused apps.
• Authenticate every sending domain with DKIM and DMARC and move DMARC towards enforcement.
• Teach users that Mailchimp never asks for passwords or passcodes, and report impersonation to [email protected].
• Permanently delete contacts on valid erasure requests rather than archiving them.

Standards and references

• Mailchimp: Manage User Levels in Your Account
• Mailchimp: About API Keys
• Mailchimp: Set Account Security Options
• Mailchimp: Best Practices for Account Security
• Mailchimp: Remove an Application from Your Account
• Mailchimp: Set Up Email Domain Authentication
• Mailchimp Developer: Access Data on Behalf of Other Users with OAuth 2
• Mailchimp: Report Abuse

Related NHI Mgmt Group resources: SaaS Security Guide · Email Authentication Checklist · Service Account Security Guide · Phishing-Resistant MFA Guide