New Shopify Stores Get Flooded With Spam Immediately
New Shopify store owners are experiencing a surge of unsolicited emails and contact requests, often seemingly random and intrusive. This stems from their store's presence on the Shopify platform and potentially from data sharing or inaccurate contact information being associated with their stores. The problem is compounded by a lack of control over who has their store owner's contact details.
SOURCES (60)
“Thanks, I have reCaptcha at checkout, but the bots have figured out how to get past that.”
“The store doesn’t exist, based on my research. I’ll try again. But, the last thing I want is for them to have my email address. Hmmm, maybe I can create a new email account somewhere.”
“You need to speak to the actual store itself. Not the Shop app or Shopify. Think of them like the mall owners / mall security - if H&M was charging you, you would talk to H&M to get it resolved and not Jim the security guard. He’s nice but can’t do shit for you. It sounds like you subscribed to a subscription somewhere. Whatever email you get, follow it to the site. Login / “forgot my password” and update the subscription. Or email them and tell them to cancel. Also if there are mods in”
“Hi, Since March of this year I’ve received notifications legitimately from Shop telling me that my ‘order’ that I never placed with MY STORE is either en route or delivered each so called purchase I neither ordered nor received. I submitted complaints to Shop whose customer service is 100% nonexistent telling them that I never ordered nor received anything from MY STORE. I submitted my complaint to Shop via their website, via Facebook Messenger and on the app itself. Never received a reply. So,”
“And if the “official” Shopify Mail has “Gmail.com” in the mail handle, then you should immediately know that it is a scam as well and just ignore it too”
“This. It’s important to make sure to never reply any of those mails and to be extra safe, don’t even click on any of the links on them.”
“You cannot send emails from a unique marketing email address if u use messaging by shopify as i understand it. All transactional and marketing have ti be the same exact email. Also i dont think there is a way for agents to make and ship emails. Its not yet agent friendly so no cli or mcp or skills. Am i outdated in my thinking on that”
“I have WHOIS on private almost immediately after I purchased my domain. It’s been weeks and I haven’t received calls or emails up until this week. I haven’t really been using second party stuff other than Shopify’s apps to include Facebook&instagram … I really don’t understand what information I put in for it to be released. I obviously don’t want these emails and can try to retrace my steps Any solutions? Emails look like a name with the subject being no subject and a question about my stor”
“Can’t you create a discount code for the email subscribers segment and send this code in the welcome email?”
25+ DMs. not opening them. thanks for the help mate. .i will be cautious
“Store went live last night, received over 200 spam emails today to my business email that's also only been open a week. Like hi? Is this store open? Do you ship to USA? Are you doing Halloween offers? Just useless crap from random names like Moo Moo and Abdul Doo. Like eff. I'm so mad. Shopify should protect us.”
“You are not missing anything, that is working as designed. Flow's send marketing email action only delivers to customers whose email marketing consent is set to subscribed, so 0 out of 100 is exactly what you would expect from a checkout where nobody ticked the box. The fix is that Shopify already has a separate abandoned checkout email that does not need marketing consent, because it is tied to the checkout the customer started rather than to marketing. Turn it on in Settings, Checkout, und”
“Hey everyone hope you’re well. For about a week now I been receiving weird emails , such as “hello do you accept cash”. What kind of email is that on a website lol and the email name itself looks like a scam. This morning I received an email from Shopify saying “ malicious threat from your store due to API conflicts and Unauthorized Script Injection”. I then received an email from a company saying we can help resolved this issue. The issue was apparently I updated my website and still have basic”
“How are you collecting their emails in the first place? You might just have it misconfigured. If it's through a pop-up like most stores use, the user consents when they provide their email address”
“Ditto... unknowns are swept into a catchall and it's my domain name for the username, along with 4 random alphanumeric characters. Hasn't been too many, unless you consider 8-10 per day too many. Email rule works since they all have the same subject and sender (and I'm a normal human being so TikTok is not something I care about). :)”
“I've received 6 so far, hours apart. Each was addressed to mydomainXXXX @ mydomain.com, where XXXX is a random string. I don't recall anytime "mydomain @ mydomain.com" has been used before (let alone leaked, as speculated above), but it's possible.”
“I'm getting several as well. They are using my catch-all on my hostname, <random>@<mydomain.com>. The emails do seem legit: they're passing SPF permitted sender checks, coming from TikTok's own servers. Assuming there's no rate-limiting, that would permit the creation of some accounts. I attempted to do a reset password on some of the spam I gotten, and the site says the email isn't registered to an account. So, it looks like it's an attempt to create an accou”
“I’ve had at least 100 of these now across a handful of domains. Very weird that they’ve not shut down whatever it is that’s doing it yet.”
“Seeing same issue on my personal domain email. Should we notify TikTok to add a mitigation for spam account creation?”
“I dunno, it works fine for me. You set it up in the settings to require an email. Then when an unknown user tries to initiate a chat it requires they give you an email and name when they hit send.”
“Last post for tonight.. I’ve been getting a bunch of promo pages dming me on site. Are they worth it or is it a scam? submitted by /u/FairyHoneyDew_ [link] [comments]”
“They did though, the problem is that customers have to log in through Shop or it won’t leave an email with the request to it is impossible to respond.”
“your email and address is showing on one of the legal pages on ur site - about us or policy one.”
“I don't even understand the goal here tbh. I get daily emails like "Hey storeXYZ, if I can boost your orders by 50 a day, will you be willing to pay 10% commission?". And I am just like, hell yeah, I wish it wasn't spam because if somebody could genuiely make me that offer, I'd be so down for it!”
I had them like crazy for first 2 months. Now I get like 2-3 per month.
“You're on the list now lol. I know this all too well. I scambait them now because I found that nobody ever talked about the scams. They just said "block and ignore" which really isn't helpful if you respond to them and aren't sure. I have a fake store where I let them access and then see what they will do. I have Gmail, so their messages go to spam. I probably get 10-15 a day. Check your privacy policy. Shopify will automatically publish your email to the page. I think most”
“all good advices, also in the contact page you have a form with a text box where users can enter their emails, and their messages instead of you putting your email.”
“Any suggestions? https://imgur.com/a/RKRanBP submitted by /u/Skyshaard [link] [comments]”
I just launched my site too and as soon as I connected my mailbox, I received an email about problems with my site... I was pretty shocked too like how do these…
“It’s most likely that your email address was scraped by a bot rather than Shopify selling your information. Bots constantly crawl websites looking for email addresses, phone numbers and other contact information. Once an email address gets picked up, it can end up on spam lists and get shared or sold between different groups pretty quickly. That’s why the timing can make it seem like Shopify gave your information out when, in reality, launching a public website may have simply made the address e”
“Is there any way to stop them? They come in all languages and are very weird. I even removed my e-mail address from the Contact page hoping that it would stop but they still keep coming. Where are they getting the e-mail address from? Why is Shopify selling our personal details? submitted by /u/Ok_Physics_4154 [link] [comments]”
“The reason is almost always that the shipping company treats you as a customer, not as a system — they send a human-readable email and stop there. Shopify never hears about it. Two ways out, and which one you pick depends on the company: if they have any kind of API or portal export, you pull the tracking numbers from there and push them into Shopify's fulfillment endpoint on a schedule. If they don't, you parse the emails, which works but breaks whenever they redesign the template. So i”
“Completely by accident. Was testing a few changes on his app, sent myself a test email, it landed in spam. I thought that was weird. Did some more digging and turned out that Outlook and Hotmail addresses in particular were mostly landing in spam.”
“I would try to report it to the it.com domain service. My guess is that if it's fraudulent, it's mimicking and probably not even on the Shopify Platform. I tried to go to checkout, but the button isn't working. How did you see it's using shopify as its processing site? At the bottom of the it.com site, there is a button for 'Report Abuse'. I would also consider emailing the company directly to let them know.”
“why would it be a Shopify conversion issue if the site hasn't changed? all the emails are different. hard to say if it is the emails themselves without knowing more. are the products seasonal, etc. we don't know. maybe a competitor has better pricing or newer versions have came out and people no longer want yours. these are questions only you can answer.”
“I reset my phone and just redownloaded the Shop app because I received an email about a PC protection plan that I know nothing about. The email address seemed fradulent but sure enough when I opened the app, it did show the order. Nothing has been charged to my card yet so I deleted my credit card from the app. However, what is going on? This makes me exceptionally unlikely to keep using the app. https://imgur.com/a/xlIKqt1 submitted by /u/IgnoreMyName [link] [comments]”
“Seems like there hasn't been any discussion around Toolsy, I need some insight. What is it? Is it an AI tool? Can I get rid of it? submitted by /u/lightennight [link] [comments]”
I’d separate by access and type of sending , not create a paid mailbox for every address. owner@brand.com : private real mailbox, only for Shopify ownership/billing. Never give this to VAs. Use…
“Hi I’m getting fake orders everyday from the name James Anderson. Shopify cancels it out but it’s so annoying. Fake email addresses multiple times a day. Any solutions? submitted by /u/nikkismithhair [link] [comments]”
“I know it’s not really a big deal, but it’s kind of weird 🧐 I was curious if this was happening to anyone else ? Even on my app it says the same thing for about half of my shop notifications submitted by /u/Resident_Call_4477 [link] [comments]”
“Like I said, a name and then numbers is a common scam pattern. Especially if the name matches the ship to name, rather than the bill to name.”
“Ooo okay good to know! What’s an example of a scam email pattern? I’m not sure if I have one trying to scam me rn. It is a last name and a set of 6 numbers.”
Just collecting their names & emails for marketing efforts later on
“got this weird email after making a sale today, within 10 mins of the sale. it comes from a gitlab.com email address and the order code mentioned in the title is different to the one in the body of the email. im just really confused how a scammer would know that i made a sale?? the details in it are my own and the 'payout' link leads to a google.share address so im not gna open it. just kind of baffled because usually Etsy scams are very unintuitive if that's what this is. also why w”
“how is this possible when my only orders of the day where pincodes and I only ever went straight frim the store to the address submitted by /u/funnydoggy420 [link] [comments]”