How to report a Shopify phishing store

Handle an active threat safely

Do not sign in, pay, submit a form, or reuse a customer's compromised device to investigate. Record the link as text, the referring message, visible brand claim, requested information, and capture time. If you can collect headers or screenshots without opening an unsafe attachment, preserve them in a restricted case file.

Document the path to the deceptive page

• The sender address, message timestamp, and full destination URL.
• Redirects, look-alike domain spelling, page title, and the brand being impersonated.
• Whether the page requests a password, payment, recovery code, wallet phrase, or file download.
• The legitimate brand URL that helps a reviewer understand the deception.

Respond to compromised accounts

Anyone who entered information should contact the relevant provider, reset credentials from a trusted device, revoke sessions, enable strong multi-factor authentication, and alert a financial institution when payment data was exposed. Follow the affected organization's official security guidance rather than links in the suspicious message.

Report through the current official channel

Use Shopify's official merchant-report tool and select phishing when the conduct matches that category. Also consider the domain registrar, browser safe-browsing service, mail provider, or hosting abuse contact when their systems are part of the attack. Give each recipient only the evidence it needs and keep all ticket identifiers.

Preserve changes over time

Phishing pages can disappear or rotate quickly. Treat each observation as a dated capture with its resolved URL and status. Never describe a page as Shopify-hosted solely because it resembles a Shopify checkout; verify public infrastructure signals and report uncertainty explicitly.