Exposed: The Shopify scam that tricks merchants with fake support & code injections

It all began with what looked like a harmless email, followed by a glaring red banner warning: "Your store is under review by Shopify." For one unsuspecting merchant, this was the start of a nightmare involving fake Shopify Support emails, a sneaky code injection, and a hefty £2000+ loss to some seriously dodgy scammers.

In this article, we share the victim's story (anonymously, with permission) to help other Shopify merchants recognise and avoid scams like these. This is a sneaky scam involving both social engineering and technical trickery. Here's how it happened and what to look out for.

Let's look at how to spot these red flags and stay one step ahead.

How the scam started - with a fake email from "Shopify Support"

For this Shopify merchant, it all kicked off with an email that looked legit, claiming to be from Shopify Support. It flagged up "critical errors" on their store, and dialled up the urgency with a nail-biting 48-hour deadline.

The email claimed their Dawn theme (version 12.0.0) needed licensing registration, but that this process was being blocked by "malware-related issues" and an improperly configured "CRS file."

Here's the email they received:

We can find several red flags in this message, which could easily be missed with the sense of panic it creates:

The email asked the merchant to contact a "senior expert" who could fix these issues, some for free and others for a fee.

Stage two: The malicious code injection

After engaging with the scammer, the merchant noticed a bright red warning banner had appeared at the top of their Shopify store. The message read:

Below this, a countdown timer showed approximately 2-3 days remaining, creating a false sense of urgency that something terrible would happen when the timer expired.

Here is the code the merchant discovered in their theme.liquid file:

<div id="suspension-warning"> ALERT: This store is under review by Shopify due to technical and security issues involving API and SQL vulnerabilities. <div id="countdown">Countdown: loading...</div> </div>

<script> 
(function () { 
  const countdownElement = document.getElementById("countdown"); 
  const countdownKey = "countdownStartTime"; 
  const countdownDuration = 3 * 24 * 60 * 60 * 1000; // 3 days in milliseconds 

  // Get stored countdown start time or set a new one 
  let startTime = localStorage.getItem(countdownKey); 
  if (!startTime) { 
    startTime = new Date().getTime(); 
    localStorage.setItem(countdownKey, startTime); 
  } else { 
    startTime = parseInt(startTime); 
  } 

  const endTime = startTime + countdownDuration; 

  function updateCountdown() { 
    const now = new Date().getTime(); 
    const distance = endTime - now; 

    if (distance <= 0) { 
      clearInterval(timer); 
      countdownElement.innerHTML = "Countdown expired."; 
      return; 
    } 

    const days = Math.floor(distance / (1000 * 60 * 60 * 24)); 
    const hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); 
    const minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); 
    const seconds = Math.floor((distance % (1000 * 60)) / 1000); 

    countdownElement.innerHTML = "Countdown: " + days + "d " + hours + "h " + minutes + "m " + seconds + "s"; 
  } 

  // Start countdown 
  updateCountdown(); // initial call 
  const timer = setInterval(updateCountdown, 1000); 
})(); 
</script>

This code snippet does several clever (albeit shameful and malicious) things:

1. Creates an alarming red warning banner that looks official
2. Implements a countdown timer that creates panic and urgency
3. Stores the start time in the browser's localStorage, making the timer appear to continue across visits

Most concerning, the banner warns of "API and SQL vulnerabilities" - technical-sounding terms that might confuse merchants who aren't familiar with these technologies.

The payment requests and relationship building

With the fake warning banner splashed across the victim's store, the scammer swooped in, posing as the 'hero' ready to save the day...except this knight's armour came with a hefty price tag.

In an attempt to fix the problem, the merchant ended up forking over cash, including:

1. First through PayPal (somewhat fortunate, as PayPal provides some buyer protection)
2. Later through Payoneer, with the payment request stating "I work on Fiverr" despite no actual Fiverr involvement
3. Eventually through Remitly, after the scammer claimed that there were issues with previous payment methods

The scammer was crafty, using sneaky social engineering tricks to build trust and squeeze out more cash:

• Calling the merchant "friend" right from the start
• Prying into personal life with questions about family and hobbies
• Acting like they were in it for the long haul, building a fake sense of trust
• Attempting to get more money by suggesting other services, like TikTok shop integration

How to protect yourself from similar scams

If you encounter any suspicious banner on your Shopify store or receive emails about theme licensing or security issues, here's what you need to do:

1. Verify all communications directly with Shopify

Legitimate Shopify communications will:

• Come from an @shopify.com email address, never Gmail or other free email services
• Be accessible in your Shopify admin panel under "Notifications"
• Not request direct payments outside of Shopify's billing system
• Be clearly written without major grammatical errors

When in doubt, contact Shopify support directly through your admin panel or via the official website.

2. Check your theme code for unauthorised changes

• Go to your Shopify admin panel → Online Store → Themes
• Click "Actions" → "Edit code" on your active theme
• Check the theme.liquid file for any unusual code like the example above
• Look particularly at the beginning and end of the file

3. Never make payments outside official channels

• Legitimate Shopify theme charges appear in your Shopify billing
• Theme developers sell through the Shopify Theme Store or their official websites
• Be wary of requests for payment via Payoneer, Western Union, cryptocurrency, or direct bank transfers

4. Be suspicious of urgency tactics

• Countdowns and warnings of imminent store suspension are classic pressure tactics
• Shopify would never put a countdown timer on your storefront like this
• Take time to research and verify before making any payments

5. Ensure theme updates are handled properly

• Shopify's Dawn theme is free and official - it never requires licensing
• Theme updates are handled through the Shopify admin panel
• If you need help with theme customisation, use Shopify Experts or verified developers

What to do if you've already been scammed

If in the unfortunate event that you've fallen victim to this (or a similar scam):

1. Contact your payment provider immediately to try to reverse the charges
2. Report the incident to the police, especially if substantial amounts were lost
3. Remove any malicious code from your theme (or restore from a backup)
4. Change all passwords associated with your Shopify store and email
5. Enable two-factor authentication on your Shopify admin account
6. Contact Shopify support to report the scam and get guidance

Stay vigilant and protect your business

Thanks to the Shopify merchant who shared their experience with us, we've been able to shed light on this devious scam. Together, we hope to expose these criminals and protect the wider e-commerce community.

E-commerce scams are getting sneakier by the day, preying on busy store owners and threatening their livelihoods. These scams are no joke - they use slick visuals, technical trickery, and crafty social engineering to trip up even the savviest merchants.

We'll keep you informed about these tactics, but in the meantime, remain sceptical about unexpected warnings. Legitimate service providers won't use scare tactics or demand unusual payment methods from you.

If you encounter anything suspicious on your Shopify store, take a moment to step back, verify through official channels, and remember you're not alone. If you're in doubt, drop me a message at hello@redeagle.tech and I'll be happy to help you determine whether what you're seeing is legitimate or cause for concern.