Running an online store means dealing with important messages about payments, business verification, account security, and compliance. Unfortunately, scammers know this too.
An email that appears to come from a commerce platform can feel urgent, especially when it threatens to close your store. That pressure can make an otherwise careful business owner click before checking the details.
We recently received an email claiming that additional business information was required to keep our store active. It looked like a routine account verification notice, but several details made it highly suspicious.
We’re sharing what stood out, how to check similar messages, and what to do if you receive one.
What the email claimed
The message used the subject line “Store Status Update: Information Needed” and opened with “Urgent: Account Verification Required.”
It claimed that previously requested business information had not been received. It then asked for documents that could include business registration certificates, tax identification numbers, proof of address, government-issued identification, and bank statements.
The message included a “Submit your documents” button and warned:
“If we don’t receive the requested documents within 1 day, we may terminate your store.”
It also included elements that could make it appear credible: a ticket number, a business address, a merchant trust team signature, and a suggested review time.
But professional formatting is not proof that a message is genuine.
The biggest warning sign: the sender’s domain
The sender’s display name was “Merchant Support.” That name alone tells you very little about who actually sent an email.
In the PDF copy we reviewed, the sender address appeared as:
support@notifications-shoplfy.com
Look closely at shoplfy: it uses an “l” where a reader might expect the “i” in Shopify.
This is a lookalike domain. The familiar brand name appears close enough to the real one that someone scanning quickly could miss the difference.
Even an address such as support@notifications-shopify.com, with “Shopify” spelled correctly, would still use a separate domain from shopify.com. Adding a familiar brand name to a domain does not make it official.
Shopify’s security guidance identifies official sender domains such as:
@shopify.com@email.shopify.com@em.shopify.com@shopify-billpay.melio.com
The practical lesson is to inspect the full sender address, not just the display name or a familiar word within it. A sender address is an important check, but it should not be your only check.
Other warning signs in the message
1. A threat designed to rush a decision
The email gave a one-day deadline and threatened store termination.
Urgency alone does not prove fraud. Real business requests can have deadlines. However, a short deadline combined with a suspicious sender and a request for sensitive information is a strong reason to stop and verify independently.
The safest response to pressure is not to move faster. It is to pause.
2. A request for highly sensitive documents
Business registration documents, identity documents, and bank statements can contain information that would be valuable to an attacker.
Real verification processes may require sensitive documents. The important question is not simply whether the documents sound relevant, but whether the request and upload destination are authentic.
Shopify’s guidance states that sensitive documents should be submitted through its secure upload process, not sent directly as an email reply or attachment.
Do not upload documents through an unexpected email’s button until you have independently verified the request.
3. Vague references to earlier requests
The email said that previously requested information had not been received, without clearly explaining the earlier request.
This wording can make recipients doubt themselves: “Perhaps I missed something.”
Rather than assuming the message is genuine, check your account directly or contact support through a trusted channel.
4. Official-looking details that are easy to imitate
A ticket ID, street address, branded language, and a team signature can all make an email look convincing.
None of these elements independently proves who sent it. Scammers can copy public business information and reproduce the style of legitimate messages.
Judge the message by verifiable details, not how polished it looks.
How to check a suspicious email safely
Inspect the sender
Expand the sender details in your email app and read the full address. Watch for substituted letters, extra words, hyphens, and unfamiliar domains.
Avoid the email’s links and attachments
Do not click a button just to see where it goes. Do not download an attachment to investigate it.
If you know how to inspect a link without opening it, check the actual destination rather than relying on the button text. If you are unsure, leave it alone.
Open your account independently
Use your usual bookmark or manually enter the address you normally use to access your Shopify admin. Check for relevant account notices there.
If you cannot confirm the request, contact Shopify Support through an official channel, not through the suspicious message.
Report the original email
Forward suspected Shopify phishing emails to:
phishing@shopify.com
After reporting the message, mark it as phishing in your email service.
What if you already clicked or shared information?
What you should do next depends on what happened.
If you clicked a suspicious link, Shopify recommends changing your Shopify password, activating two-step authentication, and contacting Shopify Support to check for unauthorized account access.
If you entered a password that you also use elsewhere, change it on those other accounts too. Use a different password for each account.
If you shared identity documents or financial information, explain exactly what you submitted when seeking help. Contact your bank if banking or payment details were exposed, and consult the relevant government guidance on identity theft for your country.
Do not post exposed documents, passwords, or login codes publicly while asking for advice.
What this email teaches us
This message combined several persuasive elements: a familiar platform name, formal business language, an apparent verification process, and a threat to store continuity.
The sender address and the pressure to submit sensitive information were the key reasons to treat it as suspected phishing.
We have not independently established who sent the message or what the submission button would do. There is no need to click through to investigate before taking the safer option: report it and verify the request separately.
For store owners and their teams, the rule is simple:
An email demanding urgent action is a reason to verify, not a reason to skip verification.
Share that rule with anyone who handles your store’s support inbox, account access, or business documents. A short pause can prevent a serious problem.
Source: