Urgent: Experts Directory - Fraud/Phishing Scam & Impersonating Shopify Experts

I’ve had a few emails shut down, but they keep popping up. I report them here: Report abuse from a Gmail account - Gmail Help

Good luck, it’s super frustrating. I still think Shopify Partners could truncate and block reviewer names. Does it seem to be coming from people who have reviewed you via your experts listing?

Nope, they’re all totally random merchants. I’ve literally had another one just now messaging me through the experts listing page to check. I dread to think how many fall for it and don’t think to verify if it’s a random scammer or not. So frustrating having to deal with this.

Hi @voltage
Sorry for asking a different question and is not related to this post but Is shopify partner Slack channel has been deactivated, or am I the one who has been removed?
Can you please check?
Thank you :slight_smile:

Yes, it’s been closed.

These scammers are still doing this to us, is anyone else seeing the same?

Yes unfortunately, had a few clients forward me some emails that they received this week.

It’s so annoying, I think now that they have scraped the customer data they’re just going to keep sending them.

They’re still using Gmail addresses so all we can do is let our clients know to be vigilant but they still get tricked easily when they’re using our personal names in the emails.

I received another scam email yesterday, forwarded to me from a client who has previously posted a review of my services on the Shopify Partner Directory. This time it was from a new Gmail address formatted to look similar to my custom domain. I’m now aware of 4 different Gmail addresses being used by the scammer. This latest email included a fake signature of my name, and an animated gif with my photo and company logo from my website. I asked my client to report the email to Gmail as phishing, but there’s not guarantee they will. It looks like the scammer is targeting merchants who have posted reviews on the Shopify Partner Directory and then getting their email addresses from the merchant’s Shopify store contact page. The problem could be mitigated if the merchant’s names were removed from the Shopify Partner Directory. Not sure if Shopify has responded to this issue, but it’s continuing to undermine the trust I have built with my clients over many years.

Yes, sadly, it’s still happening to us. All of the ones that we’ve seen have come from clients who also left us reviews via Shopify.

Shopify has not responded to this yet.

I agree Shopify should redact the store names until this is solved. We’ve been partners for 15 years and our credibility is everything to us, it makes me feel sick.

Yep, same thing has happened to us. Scammers even went as far as creating a website (patanecreative.site) with fake contact info, screenshots of work, and a list of our clients. Luckily, I contacted the domain registrar and they were able to take the site down, but old clients and even clients we have never worked with are still getting scam emails.

They have also set up several gmail addresses similar to the ones we use

So far I’ve reported it to frud@shopify.com, phishing@shopify.com, spoke to a few support reps but I have not heard anything back from Shopify

We’re still getting them too. We’ve interacted with the scammers and their aim is to get clients to pay them for SEO audits and compliance checks etc via their Upwork account by sending the client an email with an Upwork invoice and payment link.

I think the only way to stop this is to report them to Upwork, but since they’ve probably not broken any of Upworks terms they likely wouldn’t do anything. If they do actually provide an SEO audit then they’ve fulfilled the clients order technically.

The whole thing is a mess and doesn’t look like it’s going to stop any time soon.

I checked my Shopify directory profile and all the reviewer store names are still visible.

Hey, thats my email, and it never was compromised in a way that someone can use that to login to any of our client stores, we did also face the issues where people were impersonating us and sending emails to our past clients similar to everyone else, but there was never a credentials compromise that could have led to anyone logging in. Fortunately a buddy of mine was searching about this topic and he saw you posting my email.
I do remember working with you, so my account must’ve stayed there from one of our freelance projects, i don’t know if you can recall, but happy to work on figuring this out with you.