Ownership is not assumed. It must be verified.
In this episode of Client Horror Stories, host Morgan Friedman sits down with Kathryn Smith, a custom web developer, to unpack one of the most jaw-dropping cautionary tales in freelance history — a months-long engagement that turned out to be built entirely on a false premise. The story is not just entertaining; it is a masterclass in recognizing red flags, understanding the often-overlooked concept of digital ownership, and why a solid contract is not optional — it is survival gear.
Setting the Stage
Kathryn’s business specializes in custom web development. When she first launched her company, she worked primarily with solopreneurs – individual business owners who needed help building, updating, redesigning, or migrating their websites. She describes this type of work as generally manageable. With a single decision-maker at the helm, the process tends to be clean: the client says what they need, you deliver, and you move on.
But this particular story begins the way many freelance disasters do — with a referral and a frustrated client.
The woman who came to Kathryn had a Shopify website that wasn’t working. It looked bad, it wasn’t finished, and the developer who had been working on it had vanished without warning. This is a scenario Kathryn had seen before. Clients arriving after being “ghosted” by a previous developer is practically a freelance rite of passage. In her experience, these situations are messy, but recoverable. Shopify, in particular, is a more structured platform than something like WordPress — fewer surprises, cleaner architecture, easier to step into and fix. So Kathryn agreed to take it on.
Then she asked for the login credentials.
Red Flag One: A Business Owner Who Can’t Access Her Own Website
The client didn’t know how to log into her own website.
Morgan Friedman pauses on this moment during the conversation — rightly so. Because while this sounds extraordinary, Kathryn explains that it is actually more common than most people would believe. Business owners, especially those who rely heavily on third-party developers or agencies, often hand over complete control of their digital presence without ever retaining a copy of the access details for themselves.
It’s a staggering vulnerability, and Kathryn frames it using an analogy that makes it impossible to dismiss: imagine handing your house keys to a contractor and never making a copy for yourself. No one would do this with a physical building. But with websites — with digital assets that store financial data, customer information, payment systems, and years of business activity — people do it constantly.
So Kathryn did what she could. She began coaching the client through Shopify’s support process, guiding her on what to say, what to verify, and how to regain access. But the process was unusually slow. The client didn’t have the information typically needed to verify her identity — another sign that her connection to this website was thinner than it should have been.
Eventually, the client looped Kathryn into an email thread with Shopify support. This was unusual. Shopify’s support normally resolves things quickly through live chat. The fact that this was being handled over email, slowly, with repeated back-and-forth, was another subtle warning signal.
Red Flag Two: Access That Requires a Third Party to Approve
The next step was for Kathryn to request partner-level access through Shopify’s official system — the standard way a developer gains working access to a client’s store. But the client couldn’t approve the request herself. She explained that her previous developer had set everything up and would need to be the one to approve it.
This is where the story begins to shift from frustrating to genuinely alarming. A business owner who cannot grant access to her own store is not fully in control of that store. Still, Kathryn pressed on. They kept pushing with Shopify support, explaining the situation, advocating for access — and eventually, they got it.
Or so it seemed.
The Breakthrough That Revealed the Real Problem
When Kathryn finally got in, she discovered she had only limited permissions. She couldn’t see billing. She couldn’t modify the themes. She couldn’t do the actual work she had been hired to do. By this point, they were already several months into the engagement. The client had paid a deposit and ongoing fees. She hadn’t received any tangible deliverables — because none were possible in the access vacuum they’d been trapped in.
The client’s frustration boiled over. She sent a strongly worded email: fix this or give me my money back. She issued a 30-day notice.
Kathryn dug in. She escalated with Shopify support, explained the full picture, and pushed harder. And eventually — finally — she got full access to the account.
That’s when everything fell apart.
The Revelation: The Website Was Never the Client’s
What Kathryn found when she logged in with full access was not just a broken or unfinished website. It was a website that categorically did not belong to her client.
The billing card on file was registered in the previous developer’s name. The domain was owned by the previous developer. The entire Shopify account — the account itself — was registered under the previous developer’s name and details.
Legally, financially, structurally: the website belonged to someone else.
Kathryn explains that this also answered the mystery of why Shopify had been so cautious and slow throughout the process. From their perspective, they were dealing with a third party trying to gain access to an account that didn’t belong to them. They were doing exactly what a platform should do — protecting the account holder. The problem was that the account holder was not the client.
The implications rippled further. If the store had been generating sales during any of this time, the revenue would have gone directly to the developer — not to the business owner who believed she was running the store.
The Moment of Clarity — and the Decision to Walk Away
Kathryn laid everything out plainly for her client. “This is not your website.” She explained what it meant in practical and legal terms. She made it clear that there was nothing she could do to fix something her client did not own.
Remarkably, the client still wanted her to continue. Perhaps she didn’t fully understand the implications. Perhaps she was hoping there was some workaround. But Kathryn recognized that there wasn’t — and more importantly, she recognized that continuing the engagement would be impossible to defend professionally or legally.
She terminated the contract.
And here is where the final, crucial pillar of the story stands tall: her contract. Because it had been written clearly, with explicit conditions around access requirements and project milestones, Kathryn was protected. The contract documented what she had agreed to do, what she needed from the client to do it, and what would happen if those conditions weren’t met. It gave her a clean, defensible exit from a situation that was entirely outside her control.
The Lessons That Every Freelancer & Business Owner Needs to Hear
This episode is dense with hard-won wisdom, and both Kathryn and Morgan distill it with clarity.
Verify ownership before you sign anything. Kathryn’s new standard is simple: if a prospective client can’t log into their own accounts and demonstrate access, it is a serious red flag — not a minor inconvenience to work around. Seeing is believing, and in digital work, proof of access is proof of ownership.
Understand what “owning a website” actually means. It’s not enough to have a website built for you. You need to own the account it sits on, the domain it runs under, and the billing information attached to it. All of these elements, in your name, with your credentials. Anything less means someone else holds the keys to your digital business.
Your contract is your last line of defense. Kathryn’s contract is what ultimately protected her financially and reputationally. Without it, she would have had no defensible position when the client demanded a refund for a situation that was never her fault. A contract isn’t pessimism — it is professionalism.
Digital security deserves the same instincts as physical security. Morgan’s analogy is the most memorable takeaway: you lock your store, you protect your cash register, you keep a copy of your own keys. Apply that same logic to your website, your domain, your e-commerce platform. Because in the digital world, the consequences of carelessness are just as real.
This story is extraordinary in its specifics, but universal in what it reveals: in freelance work, and in business generally, assumptions are the enemy. Verify everything. Document everything. And never begin a job without confirming, clearly, that the person you’re working for actually owns what they’re asking you to fix.
