Scammers Exploit Shopify’s Own Notification System in New ‘Fake Refund’ Scam

A phishing campaign identified by cybersecurity firm Huntress abuses Shopify's own Shop app notification pipeline to send victims real-looking push notifications and receipts for orders they never placed. Fraudulent or hijacked seller accounts generate bogus orders against victims' phone numbers or emails, with the shipping address or order description field repurposed to display a phone number urging the recipient to call about an unauthorized charge. Callers are talked into installing remote access tools like ScreenConnect or AnyDesk, or logging into online banking, then manipulated into believing they were overpaid and pressured to send back the difference via gift cards. Huntress calls this a Living off Trusted Sites (LoTS) technique, similar to past abuse of PayPal invoices, since routing scams through legitimate platforms avoids the red flags of fake domains. Shopify has acknowledged the scam and advises users to ignore unfamiliar contact details in orders and flag suspicious orders as 'Not my order.'

Source: https://www.itsecurityguru.org/2026/08/13/scammers-exploit-shopifys-own-notification-system-in-new-fake-refund-scam. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.