TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Scammers are inserting fake purchase receipts into the Shop app to trick users into calling support lines or clicking malicious links. Users should verify transactions carefully and avoid engaging with suspicious notifications.
Cybercriminals are inserting fake purchase receipts into the Shop app order histories, impersonating legitimate companies like Apple and PayPal. These fraudulent entries aim to trick users into calling scam support lines or sharing personal information, posing a significant security risk for millions of users.
Recent reports from cybersecurity researchers reveal that scammers are embedding fake invoices and order notifications within the Shop app user histories. These fake receipts often claim that large charges, subscriptions, or order preparations have been processed. They include contact details for disputing the charges, but calling these numbers leads to scammers who seek to steal login credentials, credit card info, or install malware.
Shop has acknowledged the issue, stating that they are implementing new controls to prevent such manipulations, but details on how the fake entries are inserted remain unclear. Experts note that these scams are part of a broader callback phishing tactic, frequently used by PayPal impersonators, which relies on convincing notifications to lure victims into malicious interactions.
Why Fake Shop Receipts Pose a Serious Security Threat
This scam is particularly concerning because it leverages a trusted app, making users less suspicious of fake notifications. The fake receipts may lead to identity theft, financial fraud, or remote device access if users engage with scammers. Since Shop app integrates with email and shipping data, the fake entries can appear highly convincing, increasing the risk of victims falling for the scam.
As an affiliate, we earn on qualifying purchases.
Background on Shop App Security Incidents
The Shop app, used by millions for order tracking and payment, pulls data from Shopify stores and email messages, which scammers are exploiting to insert fake purchase records. While Shop has not reported a breach of their systems, the scam involves malicious third-party actors manipulating user histories. Similar callback phishing schemes have been reported before, but this specific tactic of inserting fake receipts into app histories is a recent development that cybersecurity experts are currently investigating.
“The way these fake receipts are integrated into user histories makes them appear legitimate, which can easily deceive unsuspecting users.”
— an anonymous researcher
As an affiliate, we earn on qualifying purchases.
Unclear Details About How Fake Orders Are Inserted
It is not yet confirmed how threat actors are inserting these fake receipts into user histories, nor whether Shop, Shopify, or any of the companies being impersonated have been breached. The specifics of the attack vector remain under investigation, and Shop has not provided detailed technical explanations.
As an affiliate, we earn on qualifying purchases.
Next Steps for Users and Shop Security Measures
Users should verify any suspicious receipts against their bank or vendor accounts and avoid calling any phone numbers or clicking links in unrecognized notifications. Shop is expected to enhance security controls and provide further guidance on identifying authentic transactions. Cybersecurity researchers will continue investigating the method of insertion and the scope of the scam.
As an affiliate, we earn on qualifying purchases.
Key Questions
How can I tell if a Shop receipt is fake?
Check your bank or credit card statements for matching charges. Look for poor grammar, spelling errors, or unfamiliar contact details in the notification. If in doubt, verify directly with the vendor through official channels.
What should I do if I receive a suspicious receipt?
Do not call any support numbers or click links. Report the suspicious receipt to Shop and the legitimate vendor. If you have engaged with scammers, change your passwords and monitor your accounts for unusual activity.
Is my Shop account or device compromised?
There is currently no evidence that Shop or Shopify systems have been breached. The scam appears to involve third-party manipulation of user histories rather than a direct breach of the platform.
Will Shop implement new security controls?
Yes, Shop has announced they are working on ‘new controls’ to mitigate the insertion of fake receipts, though specific measures have not yet been disclosed.
Should I stop using the Shop app?
No. Continue using the app but remain vigilant. Verify transactions carefully and report any suspicious activity to Shop support.
Source: Lifehacker
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
