New Shopify Stores Get Flooded With Spam Immediately
37 posts across 16 communities in the last 30 days; 43% from r/shopify.
“I've gotten about one email a day just like this one. It says it's from "creatoriq" and I am signed up with creator collective, but I never give my bank info to anyone through a link, so I went to creator collective directly and signed in, but it didn't show anything like this?…”
“most likely what happened is you either have a completely different email on the store with the active subscription or you have a couple of stores - so when you log-in you're logged on a different store. you can try going here: https://accounts.shopify.com/recovery/stores and…”
“The “it feels like spam” feedback would worry me more than the $19 price. It sounds like the real product isn’t the alert. It’s confidence that the alert is worth acting on. I’d test that manually before changing pricing: take a few trial users and send them only 3–5 extremely…”
New Shopify store owners are experiencing a surge of unsolicited emails and contact requests, often seemingly random and intrusive. This stems from their store's presence on the Shopify platform and potentially from data sharing or inaccurate contact information being associated with their stores. The problem is compounded by a lack of control over who has their store owner's contact details.
SOURCES (60)
“I've gotten about one email a day just like this one. It says it's from "creatoriq" and I am signed up with creator collective, but I never give my bank info to anyone through a link, so I went to creator collective directly and signed…”
“most likely what happened is you either have a completely different email on the store with the active subscription or you have a couple of stores - so when you log-in you're logged on a different store. you can try going here: https://accounts.shopify.com/recovery/stores and just put w/e email u use and see whichever email has an active store, and most likely than not the active store is the one being charged [re: Am I just dumb?? How do I CANCEL THIS SUBSCRIPTION!?!? 😫]”
“The “it feels like spam” feedback would worry me more than the $19 price. It sounds like the real product isn’t the alert. It’s confidence that the alert is worth acting on. I’d test that manually before changing pricing: take a few trial users and send them only 3–5 extremely high-confidence opportunities instead of 50+ alerts. Then see if they actually reply, start a conversation, or get a lead. If that works, you know the problem is signal quality. If they still don’t act, then the issue is p”
“Yeah I know lot of agencies trying to fix your store. I set up a store and saw the same. Of course ignore them if you are not interested [re: WTF about spotify? Hundreds spam emails]”
“I build Shopify stores for a living and this comes up more often than you'd think. I'd check in this order: Settings > Notifications > Staff notifications. Make sure the recipient is still listed and enabled. If the store email changed recently, the staff recipient can get dropped quietly and you have to re-add it and confirm it. Spam and inbox filters. Search for "New order" or "[Shopify]". Gmail and Outlook got stricter this year, especially if you set a custo”
“Before you buy anything, one cheap step that helps a lot with a shared hello@ inbox: decide what goes in each pile once, and let AI apply your rules. Use four piles: Urgent (customer blocked or deadline within 48h), Reply Today (someone waiting / new lead / quote reply), Later , Ignore . Put those definitions, plus your key customers and standard facts (lead times, payment terms), into a shared ChatGPT or Claude Project. Each morning, whoever's on inbox duty pastes the new emails and gets ba”
“lol the gmail address is giving major scam energy. also who invites food trucks with a corporate email template like that [re: Tis the season]”
“This post/message has been determined to be spam. [re: Update to my previous situation]”
“Hello, I am not sure what to do. I am running a small custom order product website. Mother owned, and it's intention was to provide professional sound equipment that is easily accessible as we are as less expensive as we can be. I had a customer who has gone on calls with me to help her design her set, non stop texts to help her and when she received her items she said she prefers another brand that is 10x the price. She filed a visa dispute 80 days after she recieved them and went public ba”
“Your form is blocking them from what they want to see to make a decision. They see it, they make their decision, you get junk emails. WIN LOSE LOSE lol [re: Why people submit contact form and don't reply even once]”
“Paid directory emails that show up this early are almost always pay-to-list. I'd only say yes to cross-promo if they show you real referral numbers first. [re: My site has been live for 10 days and I'm already getting "partnership" emails.]”
“Recently i used my visa on unikeyboards do this happened across on sites [re: Shopify shops with "HulkApps" installed could be phishing customers (ongoing)]”
“I get 2 cold e-mails per day most days. I send them straight to spam and report them as spam. Good luck! [re: Buy Bookkeeping Business]”
“that's actually a good idea, report every single one that isn't yours. might take a while but eventually the system should catch on that something's messed up with your account. had similar thing happen with my email getting flooded by someone else's receipts, took few weeks of marking as spam but it stopped”
“im scared that some jealous might see my shop and copyright to lower the competetion or mass report my shop pls tell me what should i do submitted by /u/Late-Dark5415 [link] [comments]”
“My shop has had someone testing credit cards for the past week. Always one low price item, started with the email address (name and 4 numbers) matching the ship name, now all orders have various email addresses but ship to john smith. Ordes come from various countries, always different from the shipping address. Our system is set up to immediately cancel high risk fraud and I've cancelled a couple medium risk, so I'm not concerned about us being scammed. I am wondering if I can report th”
Yes, I was contacted about "Marseille." I marked it as spam.
“It looks like my e-commerce store was hit by the September spam update. I am really worried. On October 2 and 3, the store got only 7 and 5 impressions from Google, respectively. Screenshots of search console are added in comments View Poll submitted by /u/Possible-Cockroach17 [link] [comments]”
“Hey r/shopify community, I am curious how you are handling incoming emails from customers if there is a bunch of them that is exceeding your daily capabilities. Do you have a team/partner/friends who look at and deal with them? Do you use AI functions? Or do you mostly not get such an amount of emails? Existing AI agent providers charge IMO heavily, so I am thinking of designing my own agent to categorize and help with emails from customers - or do you have any recommendations besides Gorgias, A”
“I use our cyber insurance policy to push back - our cyber insurance requires that all inbound emails go through a scanning service which is where the non-compliant emails are dropped, whitelisting bypasses this service which makes us non-compliant with our cyber insurance. A lot of higher ups may not care much about IT security, but when they see the $$ risk they care.”
“Hello. In the last 2 days i have received 3 orders from what seems 3 different accounts (2 of them are guests), all 3 use the same email, all 3 bought the item after clicking on an ad. If i click the purchase history, every "account" only shows that specific order from them. All 3 bought the same item, all the have the exact same Name, Address, Zip code and country except for the latest order. That one still has all the same details (Name, Address etc) but to a different country. The f”
“I'm trying to manage a pile of spam messages from random places that have similar text, but only for specific people. My rule says if it is for person A or person B AND contains Text 1 or Text 2 or Text 3, then delete without notification. For some reason, I am getting an approval requested email for seemingly every one of these despite confirming I do not want to test it, and move forward with the delete and don't ask. Also, some others were Blocked by the user, but I still get approval”
“That’s what they do, probably send emails to every small ecom site they find to sell their services. There job is to try and get you to pay for their services. In my experience in ecom, I never not once used any single person that emailed me ever. You get hundreds of these emails over time. I just delete them.”
“Some people from edgepathconsulting and js a bunch of consulting mail provider addresses along with some people asking if I can ship my products (though my site has reported only 17 sessions in the last week) to them... is this a scam bc I feel like it is a scam bc the only way you can even get to the address they're contacting (in the first place) is only seen at the very end of the privacy policy notice page. so is this a scam? plz and ty submitted by /u/r0bust- [link] [c”
“The constant “You’re approved for a loan” card that keeps reappearing on my dashboard is particularly annoying. They’re clearly trying to peddle their loans and using the recommendation cards to push it onto people.”
“If a company called me at all like hey, why didn't you complete checkout, be it human or AI, I'd immediately boycott them and make the added effort to leave a 1* review warning others. I am not supplying my details at checkout to get harassed.”
“As an email marketer and an ecommerce operator, mainly in the B2B space, I would get lynched just sending a basket reminder email. I personally hate it as a tactic - dont mind so much if theres a freebie involved, but just a "hey saw you were on our site" email makes me recoil and go elsewhere. Personally what works for us is having a slickest checkout possible, offering the bonuses up front when they qualify. The idea of AI phone calls give me the ick too. TBH you just have to accept”
“I've just recieved two emails asking me to complete checkouts from an unfinished cart on "Dear Hayden" and "This is Knit". I logged in (which required 2FA and I haven't recieved any 2FA codes to my email lately so I'm not sure how they logged in) to see that some American called James has made an account with my outlook email. I've reset my Microsoft account password and signed out of all devices, but I'm still not sure how they made an account in the firs”
“I didn’t say they’re creating accounts, but fake contacts. It’s a completely different thing. I use Omnisend, which was full of new contacts with the same email addresses as the abandoned checkouts, so I know they’re coming from the bots. Armex is not a classic blocker, but a WAF, which is why it works. I have no reason to lie. Try it yourself, they have a free trial. I’m not affiliated with them in any way. I was just trying to help because I had the same problem and was losing my mind over it”
“I’ve wondered this myself. Are you the shop owner? There are emails that go to whatever email address is listed as your primary account holder that I find helpful.”
“yeah theres no version of this where the distributor is acting in good faith imo”
“Your bank info was already fine and nothing in your admin shows a change needed, so those emails are likely phishing. Open your browser and go directly to your Shopify payout page yourself instead of clicking any link in the message to confirm.”
“The ID/video verification part wouldn’t automatically scare me if it’s clearly coming through the company’s official support flow, but I’d still verify the domain and privacy policy before sending anything sensitive. Bigger issue for me is the fulfillment model itself, especially if orders can arrive in marketplace-branded packaging or get flagged because you’re automating retail purchases. If this is for one specific customer/product, I’d keep it manual rather than committing to a whole stack y”
“Glad I'm not the only one who shipped a global flag and called it abuse control. Hadn't come across Doppel, will look into it. Brand impersonation was the whole payload here, so checking outbound content against known brands is probably worth doing even at my scale. Out of curiosity, what limits did you settle on for new accounts?”
“This is a great example of why abuse prevention needs to be designed alongside the product, not added after you start getting customers. The “one gate for every send path” lesson is especially important. It’s easy to add checks independently to the UI, queue worker, API, sequences, etc., and then eventually discover that one path bypasses everything. I also really like the point about the admin tooling itself becoming a potential bottleneck. Security and abuse controls are only useful if you can”
Thanks for another example to link to when people want to host email.
“Compromised accounts are the real vector here — DKIM/DMARC being green just means your domain won't get dinged, it does nothing once the attacker is inside a legit account. The switch you didn't have is outbound throttling: cap sent volume per campaign and per rolling hour, and flag when a subscriber's sending pattern jumps like this. Lots of these come from credential stuffing on reused passwords, so force 2FA on anyone touching send.”
“normal. you will get tons of spam / scams as a website / business owner. always check the sent from address. usually not from the actual company's domain.”
“I received 2 more today. I checked and they are all from different gmail addresses!”
One easy thing to miss with a list that size: authenticate your sending domain before the launch email. Without it Shopify rewrites your from address to something like store+123@shopifyemail.com , and since…
“typical shopify problem, they always say they do not leak your email, there are redditors/forum post protecting shopify (probably a developer trying to sell their app on shopify) but the FACT is that shopify IS leaking emails, the moment you open a shopify mail you ALWAYS get flooded with spam. even if the store is not running. The policies have emails inside them, i have deleted them but still getting emails. This is post nr 46854968056 and Shopify will NEVER acknowledge this and delete answers”
“Hi, I received my P1 email on Sept 14th &16th. I replied to both and explained in my second email I received it twice. Do I need to do anything further such as submit a webform? Has this happened to anyone else? submitted by /u/Iphonefour13 [link] [comments]”
“I have set up a new more private/secure email through Apple/icloud email and Etsy will not change it. Apple does use a geographic blocker and hides your identity, which is exactly why I am trying to set this up. Could this be the issue? I have tried three times and it keeps reverting back to my old email even though I received a new email verification and clicked it from my new email address in Apple. I keep getting an error at the top of my shop saying that they are unable to change my address.”
“My company recently crossed some credit worthiness threshold and literally every single day I get five to ten emails that are one to two sentences offering a business loan. The emails themselves are laughable in how they approach sales but the volume of them is unbearable. What can I do to stop or filter these? I'm concerned about creating too broad of an email filter that will capture customer emails. Anybody done anything to make it stop?? submitted by /u/ManyThingsLittleTime [”
“I really don’t understand what the point of the emails are, my only guess is that it is like a foreign nation tactic to disrupt e-commerce in western countries. My website just has “Coming Soon”, I stripped everything else from it. But still I get all kinds of emails as if the website was selling something.”
“Curious how other stores pick the post-purchase sequence without it feeling spammy. Weve tried a few combos (order confirm + shipping + review ask + cross-sell) and some just get ignored or feel pushy depending on the product. What actually earns its keep for you: review request timing, replenishment, winback, education? And what do you deliberately skip? submitted by /u/missuncleben [link] [comments]”
“I would not buy anything from a .shop domain unless it was a very big brand and I knew they use .shop domain.”
“Do you all use a marketing app that charges you by how many customer accounts you have? I'd dump that app to see if it stops. I used one app years ago that I'd swear created fake accounts to inflate my customer count to charge me more. I stopped using them; it went away. Sorry, don't remember the app name now - It was years ago, but it's worth checking if you use a tier-based app.”
“Yes!!! This asshole keeps buying a digital product of ours 😭I think I’ve cancelled three orders What are people doing about this? He always uses a different IP and email but always James Anderson as the name”
“Yep, I had a few months where I had new customers created using James Anderson and a variety of other fake names. Same 10 over and over every day. They were creating customer accounts (as opposed to just signing up to the mailing list), so I investigated all sorts of ways to prevent this including changing the URL for the account creation page. They were all unique email addresses, so I was maxing out my mailing list teir. Every day I'd have a clean up, delete them all and then they'd be”
“Shopify itself usually isn’t the sender of those marketing emails, so I’d first check the store’s installed apps and any forms or popups that were enabled during setup. Also rotate the mailbox password, review forwarding rules, and confirm SPF, DKIM, and DMARC for the domain. If the messages are unrelated to your store, save a few full headers and ask the app or vendor what address list they touched.”
“In my case, I accidentally doxed myself with the automated privacy policy. It added the phone number and email I gave shopify on setup to the policy.”
“yeah that's a classic shopify welcome package, spam edition. your email probably got scraped from whois or some public record the second the store went live, happens way more than you'd think. changing the email on the account won't stop it now, the bots already have it, best bet is setting up some aggressive filters and riding it out”
“The spam I have received in the past 2 days to my email after setting up my website with Shopify on Sunday is insane. I even deleted the form and changed my email address associated with the Shopify account but I have received 20+ emails just today that are all the same crap. It is pretty pathetic for this company that once I set up a website with them I get inundated with spam. Shopify is either selling the information or has really bad information security. Btw the domain is almost 2 months ol”