Fake Refund Scam Hits Shopify Shop App Users

Scammers are abusing Shopify's legitimate Shop notification pipeline to send fake order and invoice alerts directly within the app. The notifications appear native to Shopify and may even arrive as push alerts, making them feel more credible than a traditional phishing email.

The campaign likely relies on fake or compromised Shopify accounts that generate fake orders, then embed a callback number in the receipt, as a play on the classic fake refund scam. During fake refund scams, victims are typically pressured into calling a number owned by scammers to discuss a refund. During these calls, scammers usually convince victims to grant remote access, share their bank logins, or "return" a fake overpayment via gift cards or a wire transfer (draining real money in the process).

This Shopify attack is a twist on a known phishing technique called Living Off Trusted Sites. Rather than linking to a trusted service, however, attackers are abusing Shopify's own notification infrastructure. Shopify users should avoid interacting with any phone numbers, email addresses, or links contained in an order that aren't recognizable.

Special thanks to Justin Cook and Matt Poto for their contributions to this investigation and writeup. 

Scammers are reimagining the classic fake refund scam with a new spin: they're sending people phony invoice notifications for ecommerce software vendor Shopify within the application's own popular Shop platform. 

Between May 2026 and August 2026, several Huntress employees reported receiving these types of scam messages. It's also been reported more widely in 2026, including by researchers at Gen Digital and by Shopify users on Reddit.

Many scams come outside of the platform or brand they're trying to impersonate, immediately setting off alarm bells. However, attackers are increasingly trying to manipulate legitimate service offerings in order to send more realistic lures and pass email validation measures.