Fake receipts in Shopify's Shop app fuel callback phishing

Here's a clever twist on callback phishing. Rather than blasting out dodgy invoice emails and hoping someone panics, scammers are planting fake purchase receipts directly inside Shopify's Shop app, where millions of people already go to track legitimate orders.

Researchers at Gen Digital have spotted bogus orders appearing alongside real ones, dressed up as charges from Norton, McAfee, Apple and PayPal. Each fake receipt comes with a helpful phone number for disputing the charge. Call it and you reach a scammer playing support agent, ready to talk you through handing over card details, account logins and one-time codes. In some cases the call ends with the victim installing remote access software on their own device.

Why this one lands

The Shop app has 50 million downloads on Google Play and 7 million ratings in Apple's store. People trust what they see in it, because it's where their real orders live. A fake invoice sitting in that environment carries far more weight than the same scam dropped into an inbox alongside a hundred other suspicious emails.

The grammar in the fake receipts is often clumsy. That usually wouldn't matter, but a panicked glance at a several-hundred-dollar charge tends to override the proofreader instinct. By the time the victim is on the phone, the scammer has already won the hardest part: getting them to engage.

Nobody knows how the fakes are getting in

This is the awkward bit. Shop populates order history from a mix of sources: email parsing, linked accounts and merchant workflows. Any of those could in theory be the entry point, but Gen Digital says there's no evidence Shopify or any of the impersonated brands have been compromised. Shopify hadn't responded to questions at the time of reporting.

That leaves users in an uncomfortable spot. The usual phishing advice, things like 'check the sender domain' or 'hover over the link', doesn't apply when the lure is sitting inside an app you've actively chosen to install and trust.

What to do if a strange receipt shows up

• Ignore the number on the invoice. That's the scam. Ring your bank directly using the number on the back of your card.
• Don't install anything anyone on a 'support' call asks you to install. Legitimate support staff will never need remote access to your device to refund a charge.
• If you've already engaged, reset the passwords for anything you mentioned on the call, cancel the card, and assume any one-time codes you read out were used.

Callback phishing works because it borrows the credibility of a real brand and a real channel. Moving the lure inside a trusted app is just the latest version of that trick. The Shop app won't be the last place we see it.