Skip to content

Back to the catalog

Fake Refund Scam Hits Shopify Shop App Users
huntress.comwriteup

Fake Refund Scam Hits Shopify Shop App Users

Huntress documents a fake refund scam in which attackers create or compromise Shopify seller accounts, set up fake orders targeting victims by phone/email, and trigger legitimate Shop app push notifications and "out for delivery" status updates containing phony invoices and support phone numbers. Victims who call are directed into classic refund scams involving remote access tools (ScreenConnect, AnyDesk), fake bank transaction edits, and gift-card cash-out, a technique the authors frame as a variant of Living off Trusted Sites (LoTS) since the lure is delivered through Shopify's own trusted infrastructure rather than a spoofed domain, drawing a parallel to a similar PayPal invoice abuse campaign.

TL;DR Scammers abuse Shopify's Shop app notification system itself to deliver fake refund/invoice lures that funnel victims into phone-based refund scams using ScreenConnect/AnyDesk and gift-card cash-out.
Open original ↗
Document

How it works

The lure is native, not spoofed. Attackers stand up (or compromise) a real Shopify store, then create a fake order that names the victim by phone number or email as recipient. Because the notification is generated by Shopify's own Shop-app infrastructure, it arrives as a push notification and renders as a legitimate in-app receipt — bypassing the domain/email red flags that normally give phishing away. The scam text is smuggled into fields the platform trusts: one Aug 7 example was a $339.96 "premium PC protection plan" receipt with a fake support number repeated in the description and again in the shipping address, which read "2856 If You Didnt Place This Order / Call Us at 1888690__3420", Albany NY. Some variants also drive the Shop app's "out for delivery" shipment tracker to add time pressure.

Detection indicators

Things the summary does not spell out that distinguish this from a generic refund scam:

  • A support/callback phone number appearing inside a Shopify shipping address field, or repeated across description and address.
  • Shop receipts for products a user never bought (PC protection plans, etc.), sometimes with an active tracking/"out for delivery" status.
  • The refund-call playbook once a victim dials: install ScreenConnect or AnyDesk → log into bank → attacker obscures screen and shuffles funds between accounts to fake a transaction, or edits the transaction's HTML to fake a refund. A common trick is having the victim type a refund figure, then adding a digit so it looks like an over-refund, followed by coercion to "return" the difference via Google Play gift cards. Some variants use cmd.exe or PowerShell to "connect to a secure banking server."

What to do

Do not call, email, or click anything embedded in the receipt or notification. Shopify has acknowledged this scam type in its Help Center; treat the store name as disposable — the "My Store" storefront in the report was removed before it could be investigated, so takedown is not a reliable control.

Caveats

The store-creation-vs-compromise mechanism and the exact order-setup flow are stated as "likely" by Huntress, not confirmed. The refund-call steps are generalized from prior refund-scam observations, not proven for every instance of this campaign. Reported window is May–August 2026, corroborated by Gen Digital and Reddit reports; the page's "What to do" list is truncated in the fetched text.

Organisations named here

  • Gen Digital

Technologies named here

  • ScreenConnect
  • Shopify Shop app
  • AnyDesk
  • PayPal
  • Command Prompt
  • PowerShell
  • Huntress

Techniques named here

  • Living off Trusted Sites
  • Fake refund scam via abused native app notifications
  • Phone-based refund scam social engineering

Threat actors named here

  • Unnamed Shopify refund scam operators
  • Unnamed PayPal invoice scam operators

Related in Threat Intel