--- title: Fake Refund Scam Hits Shopify Shop App Users | daily.dev description: A refund scam is exploiting Shopify's Shop app by abusing the platform's own legitimate notification infrastructure. Scammers create fake or compromised... canonical: https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake Refund Scam Hits Shopify Shop App Users | daily.dev og:description: A refund scam is exploiting Shopify's Shop app by abusing the platform's own legitimate notification infrastructure. Scammers create fake or compromised... og:url: https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm og:image: https://api.daily.dev/og/posts/5mZd7UjQm.png og:image:alt: Fake Refund Scam Hits Shopify Shop App Users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake Refund Scam Hits Shopify Shop App Users **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary A refund scam is exploiting Shopify's Shop app by abusing the platform's own legitimate notification infrastructure. Scammers create fake or compromised Shopify stores, place bogus orders targeting victims' phone numbers or emails, and trigger native push notifications and receipts that appear inside the Shop app itself rather than via spoofed emails. The fake receipts include phony support numbers embedded in shipping addresses or descriptions, urging victims to call about an unauthorized purchase. Callers are then run through a classic refund scam: installing remote access tools like AnyDesk or ScreenConnect, logging into bank accounts, manipulating displayed refund amounts, and pressuring victims into buying gift cards to 'return' overpaid funds. This is characterized as a twist on Living off Trusted Sites (LoTS), similar to a prior PayPal invoice scam, since it abuses a trusted vendor's real infrastructure to bypass spam filters and suspicion. Shopify has acknowledged the scam and recommends verifying charges, reporting suspicious orders as 'Not my order,' and avoiding unrecognized contact details. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How are scammers sending fake Shopify order notifications that look completely legitimate? Scammers create fake or compromised Shopify accounts, set up bogus orders on their own shop, and list a victim's phone number or email as the recipient, which triggers a genuine Shop app push notification and receipt. Because the notification comes through Shopify's real infrastructure, it bypasses the red flags of typical spoofed emails and appears native to the app. _Security teams tracking abuse of trusted platforms like Shopify can follow emerging scam patterns on daily.dev._ ### What happens after someone calls the fake support number on a scam Shopify order notification? Victims are routed into a standard refund scam phone call where scammers direct them to install remote access software such as ScreenConnect or AnyDesk, log into their bank account, and sometimes use Command Prompt or PowerShell to connect to a fake 'secure banking server.' Scammers then manipulate the displayed refund amount and pressure victims into buying Google Play gift cards to repay a fabricated overpayment. _Anyone researching remote-access refund scams can keep up with fraud tactics like this via daily.dev._ ### What is Living off Trusted Sites (LoTS) and how does this Shopify scam relate to it? Living off Trusted Sites is a phishing technique where an email leads victims through a legitimate trusted site, like Dropbox, Canva, or Docusign, before redirecting them to a malicious destination, avoiding suspicion because messages appear to come from a high-authority vendor. This Shopify scam is a variant that skips the link entirely, instead abusing the platform's own notification pipeline to generate content that looks native, similar to a prior scam abusing real PayPal invoices. _Developers building on platforms with trusted notification systems can track LoTS-style abuse patterns on daily.dev._ ## Similar posts on daily.dev - [Order-tracking app Shop abused to push callback phishing attacks](https://daily.dev/posts/order-tracking-app-shop-abused-to-push-callback-phishing-attacks-asga46zq4) · BleepingComputer · 0 upvotes · 0 comments - [SMS Phishers Pivot to Points, Taxes, Fake Retailers – Krebs on Security](https://daily.dev/posts/sms-phishers-pivot-to-points-taxes-fake-retailers-krebs-on-security-jnzq3dswu) · Krebs on Security · 1 upvotes · 0 comments - [Scammers have virtual smartphones on speed dial for fraud](https://daily.dev/posts/scammers-have-virtual-smartphones-on-speed-dial-for-fraud-r7qsbsewz) · The Register · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ecommerce](https://daily.dev/tags/ecommerce), [#phishing](https://daily.dev/tags/phishing), [#shopify](https://daily.dev/tags/shopify) [View this post on daily.dev](https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake Refund Scam Hits Shopify Shop App Users","url":"https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm"},"datePublished":"2026-08-18T16:16:32.182Z","dateModified":"2026-08-18T16:49:02.392Z","description":"A refund scam is exploiting Shopify's Shop app by abusing the platform's own legitimate notification infrastructure. Scammers create fake or compromised...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79f6e3063497513969ea8a87b9acd30b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79f6e3063497513969ea8a87b9acd30b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ecommerce,phishing,shopify","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Fake Refund Scam Hits Shopify Shop App Users"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fake-refund-scam-hits-shopify-shop-app-users-5mzd7ujqm#faq","mainEntity":[{"@type":"Question","name":"How are scammers sending fake Shopify order notifications that look completely legitimate?","acceptedAnswer":{"@type":"Answer","text":"Scammers create fake or compromised Shopify accounts, set up bogus orders on their own shop, and list a victim's phone number or email as the recipient, which triggers a genuine Shop app push notification and receipt. Because the notification comes through Shopify's real infrastructure, it bypasses the red flags of typical spoofed emails and appears native to the app. Security teams tracking abuse of trusted platforms like Shopify can follow emerging scam patterns on daily.dev."}},{"@type":"Question","name":"What happens after someone calls the fake support number on a scam Shopify order notification?","acceptedAnswer":{"@type":"Answer","text":"Victims are routed into a standard refund scam phone call where scammers direct them to install remote access software such as ScreenConnect or AnyDesk, log into their bank account, and sometimes use Command Prompt or PowerShell to connect to a fake 'secure banking server.' Scammers then manipulate the displayed refund amount and pressure victims into buying Google Play gift cards to repay a fabricated overpayment. Anyone researching remote-access refund scams can keep up with fraud tactics like this via daily.dev."}},{"@type":"Question","name":"What is Living off Trusted Sites (LoTS) and how does this Shopify scam relate to it?","acceptedAnswer":{"@type":"Answer","text":"Living off Trusted Sites is a phishing technique where an email leads victims through a legitimate trusted site, like Dropbox, Canva, or Docusign, before redirecting them to a malicious destination, avoiding suspicion because messages appear to come from a high-authority vendor. This Shopify scam is a variant that skips the link entirely, instead abusing the platform's own notification pipeline to generate content that looks native, similar to a prior scam abusing real PayPal invoices. Developers building on platforms with trusted notification systems can track LoTS-style abuse patterns on daily.dev."}}]} ```