Shopify allows scammers to set up fraudulent stores under users emails without verification!

Shopify Discussion

Topic summary

Users are reporting that scammers can create Shopify stores using someone else’s email address without any verification process. Victims receive notifications about store creation, domain changes, and payment updates despite never authorizing these actions.

Key Issues:

  • Email verification is not required to set up a store
  • Scammers can enable two-factor authentication that the actual email owner cannot access
  • This problem has been occurring for months based on linked community threads

Shopify’s Response:

  • When reported to staff, they claimed this behavior aligns with their security model
  • Victims must create a separate Shopify account just to report the fraudulent activity

Users are questioning the legality of this practice and calling for Shopify to implement proper email verification safeguards.

Summarized with AI on October 29. AI used: claude-sonnet-4-5-20250929.
1

Within the past 24 hours, I have received a number of emails at my personal email address stating that a store has been set up under my email, domain name has been changed, payment details have been changed, etc. Apparently this has been happening for months:

https://community.shopify.com/c/shopify-discussions/someone-has-used-my-email-address-to-create-a-fake-shopify/td-p/2474075

My email itself has not been accessed or used to verify the store, yet somehow Shopify allows these scammers to set up 2 factor authentication that the actual email owner can’t access. Moreover, Shopify requires us to set up another account under a different email just to report the fraud. This can’t be legal?! Do something Shopify!

2

I reported it to Shopify staff and they said it was in line with their security model. Hahahahaha I really look like a clown.