Threat actors are abusing Shopify’s popular Shop order-tracking app to slip fake purchase receipts into users’ order histories, a tactic designed to trick them into giving up sensitive data or installing remote access software.
The scheme targets a massive audience. Shop has over 50 million downloads on Google Play alone, and most users in North America trust it as a legitimate order-tracking tool. That trust is exactly what the scammers are counting on.
Here’s how it works: attackers impersonate recognizable brands — Norton, McAfee, Apple, PayPal — and add fraudulent orders to the Shop app. Each fake receipt includes a phone number. When victims call, they reach a scammer posing as a support agent who uses social engineering to extract account credentials, payment card numbers, and one-time passcodes. In more aggressive cases, victims are talked into installing remote access software that gives the attacker control of their device.
This method is notably more effective than standard email callback phishing. Users inherently trust an app they use every day, and seeing a receipt for a large purchase doesn’t trigger the same skepticism as an email from an unknown sender.
Cybersecurity firm Gen Digital, which identified the trend, found no evidence that Shop, Shopify, or any of the impersonated brands have been compromised. It’s still unclear exactly how the fake receipts get inserted into the app, since Shop can pull orders from multiple sources.
What should you do? If you see an unexpected receipt in the Shop app, don’t call the listed number. Go directly to your bank or credit card company to verify any charges. That one habit sidesteps the entire scam.
