Is an Email from Shopify about SSL certificate expired for my site legit

Shopify Discussion
1

I received an email today from Shopify Support but not sure it is legit because I di see the “padlock” on my URL which I thought indicated I had an SSL certificate. art by alexandra nicole dot com

Are you able to look at my site and see the SSL certificate. Shopify does provide a free SSL certificate from my understanding. I did not know they expired. I have had my site for years. Thank you for your help. I get so many scam emails, I don’t know who to trust.

Below is the email..

Dear Merchant,> > We have conducted a routine security audit and identified areas that require immediate attention to ensure the continued security and integrity of your store. Specifically, our scan detected an outdated SSL certificate, which may leave your customers’ information vulnerable to potential leaks and your website susceptible to DDoS attacks.> > To maintain the highest security standards and protect your business and customers, we kindly request that you take prompt action to address these vulnerabilities. Failure to do so may result in store suspension to prevent potential security breaches.> > Please respond to this email at your earliest convenience to receive comprehensive guidance on resolving these issues. Our support team is available to assist you in ensuring your store’s security and compliance.> > Thank you for your prompt attention to this matter.> > Best regards,> Leona> Shopify Support Team> > © Shopify, 151 O’Connor Street, Ground floor, Ottawa ON, K2P 2L8

2

Hi @LisaSadie

SSL certs expire but ones from Shopify will automaticity renew and your site currently has SSL.
Most likely its a scam, what was the senders email?

Regards

3

Thank you for your reply. Now that I look at the email address below - this might be a scam…

shopifyassistant.helpcentre@gmail.com

Tricky because they did use Shopify in the email address.

4

Hi @LisaSadie

Definitely a scam using a gmail email :slightly_smiling_face:

You can “Report abuse from a Gmail account” here:
https://support.google.com/mail/contact/abuse

Regards

5

Hi there, @LisaSadie . Thanks for taking the time to reach out to the Shopify Community Forums in relation to this email you’ve received! My name is Imogen. It’s good to meet you!

I can confirm that the email address you referenced in a follow up post is not affiliated with Shopify. Emails coming from Shopify will typically include** @Shopify_77 .com**at the end of the email address, and not something like @gmail, or ‘@anotheremailserviceprovider’. If you’re ever seeking additional confirmation about emails that may be coming from Shopify, reach out to our Support Team via our Help Center and we’ll be able to confirm for you. Additionally, please review ou Help Document on Phishing Emails to make sure you take the steps to protect yourself and your account

To have this email reviewed further, we ask that you share it to our Safety inbox along with the email Header information. Email headers are a part of the email code that includes sender details, allowing us to determine the email’s source and report it to the appropriate parties if it is a phishing campaign.

  1. Obtain the Email’s Headers:
  • See MX Toolbox’s guide for Getting Email Headers
  • Selecting your email service provider on the left-hand navigation
  • Follow the steps outlined there to download a copy of the .eml file or copy the email’s source code and paste it into a text file
  1. Attach the file to the email you received and forward it to safety@shopify.com

Let us know if you have any additional questions!