The Shop app has become a hotspot for scammers who are inserting fake orders into user histories as part of a callback phishing campaign.
Users are seeing fake invoices in addition to real purchases in their order tracking history, with fraudulent receipts claiming that a charge has been processed, an order has been prepared, or a subscription has been renewed.
The goal of these scammers is to trick customers into handing over personal information like login credentials, credit card information, or authentication codes, or even download malware that lets them remotely access your device.
Despite some obvious red flags, such as poor grammar and spelling, users have little reason to suspect a scam and may be more likely to call a support line or engage with a receipt in some way due to the app's widespread use and trusted reputation.
The Shop app tracks orders paid for with Shop Pay and purchased from stores that use Shopify, and also pulls tracking information from Gmail and Outlook by scanning messages for keywords like "tracking number" and "track your package."
However, it's unclear exactly how threat actors are inserting fake orders into user histories, and there's no evidence that Shop, Shopify, or any companies being impersonated have been breached.
Shop has simply said that they are implementing "new controls" to mitigate the issue.
If you see a Shop purchase you don't recognize, don't automatically assume the receipt is legitimate.
Check your bank or credit card statements as well as your account history with the listed vendor to see if there's a purchase that matches.
If you don't find one, the invoice itself is almost certainly a scam, and you should not engage with it.
Don't call the number, send an email, or click any links, and if you've already done so, change your password and keep an eye on any suspicious login attempts or unfamiliar charges on your accounts.
