Scammers exploit Shopify's app to fake refunds

The scam starts with a notification in the Shop app — Shopify's official mobile app — that looks like a legitimate refund alert, complete with the platform's branding. But these alerts are part of a targeted fraud campaign that security researchers at Huntress have been tracking, one that abuses Shopify's own infrastructure to lend a fake refund scheme an air of authenticity.

Fake refunds, real notifications

According to a report from Huntress, the attackers set up their own Shopify store or take over a compromised one. In the case the researchers observed, the store was named "My Store" and was deleted before it could be examined further. The scammers then place a fake order, using the victim's phone number or email address as the recipient details — information that is readily available from data breaches and leaked databases.

When the order is placed, a notification appears in the victim's Shop app, delivered through Shopify's infrastructure. For users who've enabled push notifications, the alert shows up on their phone's lock screen with the Shopify logo, indistinguishable from any other legitimate notification until it's opened.

A shipping address that gives it away

The key twist in this campaign is how the attackers get victims to take the bait. Rather than calling or messaging the victim directly, they embed their contact information in the shipping address field, hoping the victim will notice the refund notification, panic, and reach out on their own.

In one example documented by Huntress, the shipping address read:

Owen Nolan "2856 If You Didnt Place This Order Call Us at 1_888_690_3420-", Albany NY United States 1_888_690_3420.

The all-caps text, grammatical errors, and out-of-place phone number are immediate red flags, but the scam banks on victims being rushed, distracted, or frightened enough to overlook them.

How the scam unfolds

Once the victim receives the refund notification, the scammers' goal is to convince them to "return" the money. They may call or mail the victim, posing as representatives of the company that supposedly issued the erroneous refund. The refund amount can range from a few hundred to a few thousand dollars, according to Huntress.

If the victim complies and sends the money back, they are actually transferring their own funds to the scammers — the original refund never actually happened. In some cases, the attackers may make a real initial transaction but cancel it, while in others they create spoofed pages that show the transactions, tricking less cautious victims.

Protecting yourself from refund scams

Huntress advises users to never interact with phone numbers, email addresses, or links contained in an order that aren't recognizable. If someone is concerned about the security of their Shop account or personal data, they should contact support directly.

It's also important to check your bank account to confirm whether you were actually charged. If no charge was made, the order can be reported as "Not my order" in the Shop app.

When purchasing from a store on Shop, users should review the store and its product reviews to learn about other customers' experiences. If a store or product seems suspicious, it can be reported easily. Many of the shops involved in this scam were brand-new, some using a "coming soon" description.

Why this matters

This campaign highlights the risk that comes with trusting app notifications at face value. Even a notification from a well-known platform like Shopify can be a vector for fraud, because the scam is built on abusing the platform's own features. For consumers, the lesson is to verify any unexpected refund or charge directly through your bank or the official support channels, rather than responding to information embedded in the notification itself. And for Shopify store owners, it's a reminder that the platform can be turned against their customers if attackers gain access to their store credentials.