Red flags
- Urgent threats like “your store will be closed in 24 hours.”
- Sender addresses that don’t end in @shopify.com, or that misspell it.
- Links that go to unfamiliar websites when you hover over them.
- Requests for your password, payment details, or a login code.
- “Copyright” or “policy violation” notices with attachments.
- Offers from “marketers” promising guaranteed sales for an upfront fee.
What to do
- 1Don’t click any links or open attachments.
- 2Open a new browser tab and go to your Shopify admin directly.
- 3Check your notifications there. If it’s real, you’ll see it.
- 4Delete the email or mark it as spam.
Protect your accounts
- Turn on two-step authentication for Shopify, your email, and your supplier accounts.
- Use a different strong password for each account.
- Never share login codes with anyone, even if they say they’re from support.
Launch tip
Shopify will never ask for your password by email or message. If anyone does, it’s a scam, no matter how official it looks.