A customer record can arrive in Shopify while the person behind it loses access to orders, consent history, returns, B2B pricing, or support verification. The import succeeds because a row exists. The relationship fails because the links do not.
Account migration is an identity change with operational consequences. Decide who the customer is, how they prove it, which history follows them, and how support restores trust when any link breaks.
An account migration is an identity change
Shopify's current customer accounts allow login with a one-time six-digit code sent by email. A password is not required. Legacy customer accounts use passwords. Shopify also documents that passwords encrypted outside Shopify cannot be migrated through customer CSV.
That creates a design choice, not just an import limitation. A store can adopt code-based customer accounts, retain legacy accounts for a period, or build a more specialized identity architecture when plan and requirements support it. Each choice changes login copy, support scripts, account extensions, B2B behavior, and the customer invitation strategy.
Keep five records separate
Use distinct records:
| Record | Example fields | Authority question |
|---|---|---|
| Profile | Name, email, phone, addresses | Which source is most current? |
| Authentication | Login method, identity-provider subject | How does the person prove access? |
| Marketing consent | State, timestamp, source, channel | What evidence permits each use? |
| Commerce relationship | Customer ID, company, market, price access | Which entitlements follow identity? |
| Service history | Orders, returns, credits, tickets | What must staff and customers see? |
Do not infer marketing consent from account existence or order history. Preserve the source and timestamp needed to explain the state. Decide how conflicts are resolved before import.
Write an authority rule for each field
The migration contract should map the source customer identifier to the Shopify customer identifier and any external CRM, loyalty, helpdesk, ERP, or identity-provider identifier.
For every field, record type, required transformation, null behavior, uniqueness rule, owner, and validation. Email normalization deserves special care. Shared inboxes, changed addresses, duplicate profiles, guest orders, and phone-only checkout can create identity collisions.
Shopify's customer CSV does not import order information, Total Spent, or Total Orders from another platform. If these values matter to segmentation or service, design their destination explicitly rather than assuming the customer import reconstructs them.
Prove order links in the dark
Test representative histories before opening access:
- a customer with one current email and several historical orders;
- a customer whose email changed;
- duplicate profiles sharing an email or phone;
- guest orders later associated with an account;
- refunded, partially fulfilled, returned, and subscription orders;
- B2B contacts and location administrators;
- customers across multiple markets and languages.
Shopify states that customer accounts can display orders across markets. That does not prove an imported source order was associated with the intended customer. Validate the link by source identifier, Shopify identifier, visible account history, and staff view.
Returns need equal attention. Self-serve returns depend on customer account access and order eligibility. A customer who can log in but cannot see the expected order still has a failed service journey.
Invite cohorts by recoverability
Start with employees, support testers, and selected low-risk customer cohorts. Record delivery of verification emails, successful login, account load, order visibility, return entry, market and language behavior, and support recovery.
Prepare customer communication for the actual model. Do not tell customers to "reset" a password when the new account uses an emailed code. Explain the email address to use, expected code delivery, what history should appear, and how to get help.
Support needs a safe identity-verification process and an escalation path for missing history. It should never merge or reassign sensitive account data from weak evidence.
Choose another model when identity cannot converge
Current customer accounts might not fit a legacy Single Sign-On assumption without redesign. Shopify documents that Multipass is not supported on customer accounts. Headless and specialized identity scenarios should be evaluated against the Customer Account API and supported identity-provider options before the migration promise is made.
Run the support desk rehearsal
Select 25 customers representing duplicates, changed emails, guest checkout, multiple markets, refunds, returns, B2B, and high-value history. Build an identity and order-link receipt for each. Do not schedule the first invitation until every failed link has an owner and a safe support response.
Sources
- Shopify Help Center, Importing and exporting customer lists, accessed August 24, 2026
- Shopify Help Center, Customer accounts, accessed August 24, 2026
- Shopify developer documentation, Customer Account API, accessed August 24, 2026
- Shopify Help Center, Self-serve returns and cancellations, accessed August 24, 2026
