HUGE SCAM LOOPHOLE with Shop Pay Installments w/ Affirm - Alternate Ship to Address SCAM LOOPHOLE

[404]

Hello Everyone, 

So I'm usually a "stay in my lane" type of guy.  I only voice my opinions when I truly think it matters. 

We started using Shop Pay Installments and even recently opted in for the extended version beta.  There is a HUGE flaw in the Shopify / Affirm link though that I'm seeing being used a loop hole.  NO red flags, NO warnings from any system.

I just got off the phone with support, and it seemed brushed off again (2nd time I've called in).  Here is the example Order

Higher Dollar Purchase

Checks out with Shop Pay Installments. 

Changes the "Ship To" address AFTER just being approved for a loan using other information

Adds Phone Number AFTER the order is already placed. 

- MAKES MY SMALL RETAIL BUSINESS GUT SCREAM AT ME -

This guy was just APPROVED FOR CREDIT by a third party, giving all of his information to them (Affirm) and then (Shopify) allows then to CHANGE IT ALL.  No flags because no card involved.  The two addresses...how to put this nicely... one is multi million dollar home and the other might as well be torn down (Just being real).  

My issue here is that I should not have to sit here and think about what to email the customer. What do you ask for, ID? Affirm Copies. No this is not acceptable and Shopify should NOT allow it. 

Think about it - If you check out with Paypal - You have to use the Paypal account address.  You can't change it!  That is money someone already has.  This is BORROWED money and they allow it to be changed and guess who will be holding the chargeback bill?  NOT Affirm, NOT Shopify, YOU the small business owner. 

Help me voice these concerns. It is for the greater good of small business owners like US.  I want to keep Installments. It helps recover what would have been "Lost Sales".  But we need to weed out the scammers. 

Shopify Shop Pay Team - Feel free to call me - I'll be your guinea pig. 

- 404

[Shay]

Hi @404 

Thank you very much for reaching out about this issue. I can definitely understand your concern about this. I did touch base with our financial support team to see if they had any additional insight into this and they definitely expressed an interest in reviewing some of the orders you may have on your store where this took place. 

You mentioned you have reached out to our live support about this already and that you didn't feel you received the appropriate response from them. While I can't review tickets myself, I can definitely bring the ticket to my internal teams for a review. Would you please share the ticket number(s) you have in regards to the live conversations you had with our support team? From there, I will see if I can get our financial team to reach out directly about this. 

[404]

There were a few but the most current ticket is *29002636*

[404]

Hello Shay, I replied in the email with my most recent Case number.

I appreciate your willingness to look into the matter.  The support with shopify has always been great. I think this matter is just two steps ahead of a normal support call and they can't transfer anyone to another team.  

It is a problem though, and every time a scammer wins - a small business owner pays the price. Need to stop what we can. 

Chris

[Shay]

Thank you Chris!

I ensured it was flagged with the appropriate team for further investigation and you should see a follow up about this issue soon.

I can't guarantee that we will be able to provide much insight into when/if changes are taking place on this matter but please know we sincerely appreciate your feedback on this and our financial team was definitely interested in looking into this further. 

[adamnyc31]

How did you discover they changed the address after the order was approved?  If I receive an order paid via ShopPay installments it appears instantly as soon as the order is processed.   Are you saying that they are able to edit their shipping address AFTER it appears in your Shopify order dashboard?  If so, is there any record that a change was made?   If they are able to edit the shipping address AFTER the order has been placed and that change is passed into my Shopify Dashboard then that is a massive risk and I'm immediately disabling ShopPay installments.