Scammers Abuse Shop App Order Histories for Callback Phishing
Summary
Gen Digital reports that scammers are planting fake receipts in Shop order histories to lure users into calling fraudulent support numbers and disclosing credentials, payment details, and OTPs; some are also pushed to install remote access software.
Key points
- Fake receipts impersonating brands including Norton, McAfee, Apple, and PayPal appear alongside legitimate orders in Shop.
- The receipts list phone numbers that connect users to scammers posing as support agents.
- Scammers seek account credentials, payment card details, and temporary authentication codes; some victims are tricked into installing remote access software.
- Researchers could not determine how the fraudulent receipts are added to Shop; possible order-population channels were not confirmed.
- Gen Digital found no evidence that Shop, Shopify, or the impersonated companies were compromised.
- Users should verify unexpected charges with their bank rather than call numbers on suspicious receipts; those who shared sensitive information should reset passwords and contact their card issuer.
Article Details
- Event Type
- Callback phishing using fake purchase receipts inserted into the Shop app’s order histories
- Impact
- Scammers impersonate well-known brands and direct users to call fraudulent support numbers, where they try to steal account credentials, payment-card details, and one-time passcodes. Some victims are also tricked into installing remote-access software. Gen Digital reported no evidence that Shop, Shopify, or the impersonated companies were compromised; how the fake receipts are inserted remains unclear.