I woke up this morning to an email which had been submitted via my "Contact Us" page on the website. This email claimed to be from a swedish store who wanted to purchase some items from my store to re-sell.
A few quiet alarm bells went off in my head (and, I was tired.. so didn't want to deal with it just yet) so I left it alone for a bit. The things that made me go "Hmmmm.. I don't know about this.." were:
(1) The return email address (which was mentioned a couple of times in the email, but was consistent) was a hotmail address. Any "business" operating without their own domain name worries me;
(2) The english didn't feel "right" - I have dealt ALOT with people from the netherlands, sweden, etc at work over the last couple of years and their english is always pretty good. I can accept some grammar/spelling/word choice issues, but this one seemed "off;"
(3) Im not a wholesaler. What retailer is reaching out to other retailers to buy items they can easily get wholesale? I sell beard oils, balms, etc and these products are readily available from wholesalers all over the world. Perhaps not the same brands that I sell, but certainly equivelant. Even if they specifically wanted my brands they could reach out directly to my suppliers with a quick google search;
(4) A google search of the email address, their name, etc turned up nothing at all. In this day and age, that is a rarity;
(5) The email asked if I accepted credit cards and if I shipped internationally. Nothing else. No mention of discounts. Minimum orders. Shipping cost. Further information. All they wanted to know was if I would accept credit card payment (an odd question, I think) and if I would ship internationally (which is covered on my FAQ page) in which case they were happy to go ahead with an order.
While none of these was a really big red flag.. Together they just gave me some pause and I decided I would wait until later in the day (when I was awake properly haha) to respond with a few more questions to ascertain the legitimacy of the request. When I got to work I decided one quick check I could do to help at least confirm that they were from sweden was check my google analytics to see if I'd had any visitors from sweden overnight.
Turns out... I'd only had one visitor overnight.
I think it's pretty safe to say that this was a scam. I don't know how it would have worked, but I am glad to have avoided it either way. This leads me to a question though: How frequently does this kind of thing happen? Is this something I should be constantly wary of and looking out for?
It is something to be weary of Dave. Someone posted in the forums a while back of a similar tale, but a Google search lead him to see a trace of other stores with the same email.
Scammers operate in probably every industry!
You are certainly right to be cautious in this scenario. And going forward should on order be placed on your store you see that the order is flagged as even "medium risk" by Shopify's built-in Risk Analysis feature it is completely your prerogative on whether you want to fulfil an order based on the information provided upon a Risk review of this order. If you are in any way uncomfortable about the order or you feel something is up, and perhaps the customer is not responding to your follow up correspondence, it is completely your right to refrain from fulfilling the items in the order in question.
I would certainly recommend that you take a look at our guide on our Risk Analysis system, which offers best practice in situations like I described above and what to look for when an order is flagged as "high" or "medium" risk: https://docs.shopify.com/manual/orders/risk-analysis-and-chargebacks
Furthermore, I would also recommend that you make use of our free Fraud Filter app which gives you greater control over preventing potentially fraudulent orders from processing in your store. You can set up some simple rules which will filter or block orders that match the rules set by you: https://docs.shopify.com/manual/apps/apps-by-shopify/fraud-filter
Hope this helps!
This person used the Contact form in my store to send a scam/spam message. I can't find any way to even get to the contact form or to report to Shopify that people are using their platform to proliferate scams. There seems to be no way to block a person from accessing my contact form, either.