Heads up to check your accounts for fraudulent transactions.

[GorgeousFabrics]

I wanted to alert people to something that happened to me today. I logged into my bank account, which is attached to my Shopify Balance account, and saw three pending transactions. Two were deposits for $US 0.20 and $US 0.18. The other was a withdrawal for $US 0.38. All three were attributed to "shopify ACCTVERIFY"

I called Shopify Support and reported it, and they verified that there had not been any activity. So I called my bank, who said they looked like definite fraudulent transactions, and they put a stop to them and also blocked "shopify ACCTVERIFY" from being able to access the account. This happened even though I have very stringent security (double factor authentication, a really tough password, and all the other things we're advised to do). I have no idea where the perpetrators managed to get my banking info, but I was lucky that I logged in and caught it before they were able to drain my account. Here's a screenshot of the three transactions:

I just want to warn people to be hyper vigilant these days. The bad guys are constantly testing to try to get into our accounts. I managed to dodge a bullet today, and hopefully that will help other people.

[Skye · Accepted solution]

Hi, @GorgeousFabrics 

Thank you for your patience while we reviewed this issue.

It came to our attention that on, or shortly after April 26, 2023, some merchants may have unintentionally experienced micro-deposits in their external bank account. Micro-deposits are an industry standard security measure used to verify bank account ownership, in which two small deposits (of less than $1) are made to an account, followed by a single withdrawal in an amount equal to the deposits.

Micro-deposits should always financially resolve in the account holder's favor, as an equal amount is withdrawn as deposited, or the withdrawal may fail, and the account holder can keep the deposits. The account is not impacted in any other way.

Typically, Shopify does not use micro-deposits as a bank account verification method. These micro-deposits were an unintended consequence related to a Shopify update, and only impacted external bank accounts that had transacted with Shopify Balance accounts. The issue has been resolved, and should not impact your accounts moving forward.

We apologize for any inconvenience, and if you have any further questions, please let us know.

[anotherchance91]

SAME HERE! My bank alerted me to these fraudulent transactions that I received last night too. A few small deposits made and a few small debits. 

[JAMES83]

Same here. 

[Kjones864]

Same here!!

[anotherchance91]

IF THE FRAUDSTERS DEPOSITED MONEY INTO YOUR ACCOUNT PLEASE CLOSE YOUR ACCOUNT.

My bank said they were able to deposit into the account bc they have your routing number and bank info. You MUST close the account to prevent any future mishaps with your account.

Clearly someone hacked into Shopify!!! 

[jym]

Just happened to me too

[RoseJannuzzi]

following

[JAMES83]

Same thing here! I'm hoping it's just a glitch, and not something bigger. 

[Zendall]

Do any of your sites use Shopping Gives? Mentions in their FAQs to verify they deposit small amounts to verify the bank account and the depositor is Acctverify - https://faq.shoppinggives.com/hc/en-us/articles/360039753094-Billing

"When entering a new ACH payment method, you will receive 2 micro-deposits in differing amounts to your bank account - the description for the micro-deposits should be listed as ACCTVERIFY, the two amounts will each be less than a dollar, and they can take up to 3 business days to appear."

[anotherchance91]

No - never heard or seen that website before. I have two charges from "SHOPIFY ACCTVERIFY" and then four ACH deposits from "ACH DEP SHOPIFY XXXX8568"

[RoseJannuzzi]

Had this happen to an account I work with and they do not have Shopping Gives installed

[JAMES83]

No, I dont have shopping gives, never have. The scary part of this is that it is a bank account that has never been linked to shopify payments. I did add it a few years ago for shopify balance but deleted it from balance about a year ago. 

[anotherchance91]

Whoa - that is scary.

Shopify is no help at all in regards to this issue - if its indeed a glitch or a hacker...

Pray it is just a glitch. Otherwise the hackers have access to potentially thousands of bank accounts and their routing numbers. Shopify powers the big guys too like Walmart and other big names...

[GorgeousFabrics]

I haven't authorized Shopping Gives, so there should not be any activity. If they are the ones who did this, that would be unauthorized. But I suspect it is someone else. Either way, it's disturbing. I'm checking my account every day. My bank, which is a big one, said I don't need to close the account. But do be sure to contact your bank about any weird transactions. You can't be too careful.

[RoseJannuzzi]

Someone on Reddit posted that Shopify told them it was Stripe processing. The client I work with that has a store in development (no transactions have been processed) as the account has not been launched reached out to Shopify Support that said there was no activity showing for Shopify.  Shopify support advised to contact the bank immediately and block that sender.  The bank statted is was likely a scam / fraud.  Here is the post on reddit.

https://www.reddit.com/r/shopify/comments/130gyfu/just_got_two_shopify_acctverif_deposits_on_my/

[JAMES83]

It’s still doesn’t make sense for my situation. I have never used Stripe. I know Shopify payments, is powered by stripe, however, that bank account in question was never linked to Shopify payments. The only way it was ever linked to anything Shopify, what is the transfer some money to a Shopify balance account about a year ago after the balance was done I deleted the account from Shopify balance. Hopefully Shopify will make make a statement soon. I’m sure it’s just a glitch, hopefully there’s no need to worry. 

[Skye · Accepted solution]

Hi, @GorgeousFabrics 

Thank you for your patience while we reviewed this issue.

It came to our attention that on, or shortly after April 26, 2023, some merchants may have unintentionally experienced micro-deposits in their external bank account. Micro-deposits are an industry standard security measure used to verify bank account ownership, in which two small deposits (of less than $1) are made to an account, followed by a single withdrawal in an amount equal to the deposits.

Micro-deposits should always financially resolve in the account holder's favor, as an equal amount is withdrawn as deposited, or the withdrawal may fail, and the account holder can keep the deposits. The account is not impacted in any other way.

Typically, Shopify does not use micro-deposits as a bank account verification method. These micro-deposits were an unintended consequence related to a Shopify update, and only impacted external bank accounts that had transacted with Shopify Balance accounts. The issue has been resolved, and should not impact your accounts moving forward.

We apologize for any inconvenience, and if you have any further questions, please let us know.

[GorgeousFabrics]

Hi Skye, and thank you for the clarification. However, I would like to note that four things raised REAL alarm bells to me:

First, the lack of a capital "S" in the name Shopify. To me, that implied that the source of the transactions was not the real Shopify, since every other transaction from Shopify has had the correct capitalization/naming standard. Second, I never received any notice from Shopify that these transactions would happen, outside of when I originally linked my bank account to my Shopify account, more than 5 years ago. Third, there was no transaction number associated with the deposits and withdrawal. And fourth, Shopify support knew nothing about these transactions, and said that they did not come from Shopify and that I should contact my bank immediately.

I think, to quote a famous movie line, "What we have here is a failure to communicate." Shopify should have alerted merchants, in advance, that this would take place. Shopify support should have been made aware of the situation in advance. And whoever is in charge of setting up these transactions should follow protocol for the look of these transactions. I find it unacceptable that Shopify should cause this kind of problem. That's what I deem a "rookie mistake" and I expect Shopify to have better processes in place. 

[Skye · Accepted solution]

Hi, @GorgeousFabrics 

Thank you for your feedback. It is greatly appreciated.

I do want to clarify that normally we would absolutely provide warnings of such action. In this situation, however, we were unaware this was going to happen. For lack of a better word, it was a glitch, which is why merchants were not notified. This was an unintended consequence related to a Shopify update. 

Additionally, I apologize that our advisors gave incorrect information. As we were unaware of the issue until many merchants came forward, our advisors were airing on the side of caution, to ensure the safety of your accounts.

Lastly, thank you again for bringing this forward. We apologize for the issue, and concern this caused our faithful merchants such as yourself. 

[MDD]

@Skye can you please double verify that these transactions are not fraudulent and that no action needs to be taken?

Today I logged into my bank account and saw two deposits, one of $0.23 and one of $0.05, then a subsequent withdrawl of $0.28 cents.  I don't want to shut all my accounts down and go through a big hassle, please verify this activity is NOT fraudulent and that no action needs to be taken on my end!  Thank you!

[Kjones864]

Thank you for this update, but is there a reason Shopify has not sent an official email about this transaction/glitch. The thought of potentially having your account information compromised is a big deal.

[ToriH]

Same here.  But these transactions happened on an account NOT linked to Shopify.  2 tiny deposits and then a withdrawal for the same amount.

[dbowman52]

The same thing happened to me last night they took $248 it said autods but I don't have any autods link to my shopify account. I need to know if you give someone a role to get access to your account could this be the case!