Scammers Abuse Shopify Shop Notifications to Deliver Fake Refund Lures
Summary
Scammers use Shopify’s Shop notifications to send fake order alerts with callback numbers, leading victims into refund scams. Huntress advises users to avoid unfamiliar contact details in orders and report suspicious purchases.
Key points
- From May to August 2026, Huntress employees and other users reported fake invoice alerts delivered through Shopify’s legitimate Shop app notification system.
- Scammers likely create fake Shopify accounts or compromise real ones, then trigger notifications by placing orders addressed to targets.
- Fake receipts include callback numbers and may use shipping-status updates to make the order seem legitimate and create urgency.
- Callers may be pressured to install remote-access tools, log into bank accounts, or return a fabricated overpayment using gift cards or wire transfers.
- The campaign adapts Living off Trusted Sites: it abuses a platform’s own notification pipeline rather than directing victims to an attacker-controlled page.
- Shopify has acknowledged the scam. Users should avoid unfamiliar phone numbers, email addresses, or links in orders, contact Shop Support if concerned, and check whether they were actually charged.
Article Details
- Attack Vectors
- Fake or compromised Shopify accounts are likely used to create fraudulent orders addressed to targets by phone number or email, triggering native Shop app notifications and push alerts.
- Fraudulent order receipts include callback phone numbers and may use shipping-address text or shipment-status updates to pressure recipients into calling.
- The callback may lead to a refund scam involving remote-access software, bank-account access, deceptive refund displays, or demands for gift cards.
- Defensive Notes
- Do not interact with unrecognized phone numbers, email addresses, or links included in an order.
- Contact Shop Support if concerned about Shop account or personal-data security.
- Check bank accounts for actual charges; if no charge occurred, report the order as “Not my order” in the Shop app.
- Review store and product reviews, and report a shop or product if it appears fake.
People
Vendors
Products
AnyDeskmake a number of moves. They will direct victims to install remote access software like ScreenConnect or AnyDesk. They may also have the victim log into their bank account. Canvalanding page, LoTS involves an email that then leads targets to a legitimate trusted site (like Dropbox, Canva, or Docusign), before then taking them to the malicious site. This avoids many of the red flags that wouldDocuSignLoTS involves an email that then leads targets to a legitimate trusted site (like Dropbox, Canva, or Docusign), before then taking them to the malicious site. This avoids many of the red flags that would raiseDropbox DocSendlanding page, LoTS involves an email that then leads targets to a legitimate trusted site (like Dropbox, Canva, or Docusign), before then taking them to the malicious site. This avoids many of the red flagsGoogle Playface other consequences unless they return the money. They direct victims to buy gift cards (usually Google Play cards) and give them the card details (which attackers then redeem quickly for cash or resell).PaypalAt Huntress, we have seen other similar attacks over the past year, including a popular one involving PayPal. In this attack, scammers open real PayPal accounts and send actual PayPal invoices with fake callback numbersScreenConnecttypically make a number of moves. They will direct victims to install remote access software like ScreenConnect or AnyDesk. They may also have the victim log into their bank account. ShopScammers are abusing Shopify's legitimate Shop notification pipeline to send fake order and invoice alerts directly within the app. The notifications appear native to Shopify and may even arrive as push alerts, making