Scammers plant fake receipts in Shopify's Shop app to push support-call fraud
Scammers have been inserting fake purchase receipts into Shop, the order-tracking app run by Ottawa-based Shopify, to trick people into calling fraudulent support lines, researchers at Gen Digital reported in late June.
The tactic is more convincing than an e-mail because the bogus receipt shows up inside an app the victim already uses and trusts, CyberInsider reported on June 25.
How the scam works
Gen's researchers found the activity after Norton customers reported fake subscription invoices in the app. Public reports suggest the same approach impersonates Apple, McAfee, PayPal and other brands. The receipts often list a generic merchant such as "My Store" and claim the user bought or renewed something expensive, such as an iPhone, a MacBook, Apple gift cards or a security subscription. A phone number appears in the invoice body, product description or delivery address field.
People who call reach someone posing as billing or technical support, who tries to obtain card details, account passwords or one-time codes, or to get the victim to install remote access software.
Gen said there was no evidence that Shopify, Shop or any of the impersonated companies had been compromised, and that it was not clear how the fake orders were getting into the app. Shop imports purchase data through several legitimate routes.
A Shopify spokesperson told Punto Informatico, citing comments first given to BleepingComputer, that the company had identified people misusing its platform to generate fake order notifications and had added new controls that significantly reduced the activity.
Why merchants should care
For legitimate Shopify sellers, the abuse risks eroding trust in order notifications that customers rely on. Merchants who receive calls or complaints about orders they never processed should treat them as a sign their brand or the platform is being misused, and report them through Shopify's channels.
What to do
- Never call a phone number printed on an unexpected receipt. Check charges through your bank or the company's official app or website.
- Report suspicious orders through Shop or Shopify's phishing reporting channels.
- If you already called, contact your bank, change any passwords you shared and uninstall any remote access software the caller had you install.
- Report losses to the Canadian Anti-Fraud Centre.
