# The ten scams that target store owners (not customers), and how to spot them > Phishing from fake Stripe emails, overpayment refund scams, supplier fraud, domain-renewal letters in the post. The scams targeting you, not your buyers, and how the security baseline stops most of them. Ryan Badger - 28 September 2025 - 8 min read ## Scams that target the merchant, not the card The previous post covered [transaction fraud: stolen cards, chargebacks, card testing](https://v3.shoprocket.io/blog/ecommerce-fraud-the-eight-types-youll-actually-see-and-what-prevents-them.md). This post is about the other side: scams that target you, the store owner, directly. Phishing emails pretending to be Stripe. Fake "customers" trying to social-engineer refunds. Suppliers that take your money and disappear. Domain-renewal scams in the post. Most of these are low-tech. They work because running a store is busy and the scam email arrives on a Tuesday afternoon when you're tired. The defences are mostly about knowing what to expect. ## The big categories ### 1. Phishing pretending to be Stripe, PayPal, Shopify, your bank You get an email: "Your Stripe account has been flagged, click here to verify." The link goes to a login page that looks perfect. You enter your credentials. They're captured. **What to watch for:** - Sender domain: real Stripe emails come from `@stripe.com`, not `@stripe-support.com` or `@stripe.verify.co` - Urgency language: "account will be suspended in 24 hours" is a scam pattern - Links: hover before clicking. Real Stripe links go to `dashboard.stripe.com` **Defences:** - Enable 2FA on every payment and commerce platform you use (Stripe, PayPal, your bank, your Shoprocket account, your email). A stolen password is useless without the second factor - Never click login links in emails. Go to the site directly via your bookmark or typed URL - Use a password manager. They auto-fill only on the real domain, so they silently refuse on phishing pages, which is a great tell ### 2. The "overpayment" scam "Customer" places a large order, overpays (by $500 or so), then emails you asking for a refund of the overpayment to a different card or via a different method (PayPal, bank transfer, gift cards). A week later, the original payment is reversed as fraud, and you've refunded money you never really had. **What to watch for:** - Any refund request to a method different from the original payment - Orders with unusually large amounts from new customers - Urgent pressure to refund quickly **Defences:** - **Only refund to the original payment method.** Stripe enforces this by default, so this scam mostly happens when sellers manually process refunds outside the platform - If a "customer" insists on an alternative refund method, that alone is the signal ### 3. The "wrong address, please reship" scam Customer orders, receives the item, then claims "the address was wrong, please reship to X". If you reship, they keep both. **What to watch for:** - Reship requests that reference an address change after tracking shows delivered - Multiple customers with variations of the same story, sometimes coordinated **Defences:** - Always check courier tracking before actioning an address issue - If the item was delivered to the address on the order, the order is fulfilled. Any further shipments are the customer's cost ### 4. The SEO / review blackmail scam Someone emails you: "I left a one-star review. Pay $200 and I'll remove it." Or: "I can remove negative reviews for a fee." Or: "Your Google Business Profile will be reported unless you pay." Most of these are bluffs. Real review removal goes through the review platform's process, not a private payment. **Defences:** - Never pay. Paying identifies you as a mark and you get more demands - Flag the email as spam, block the sender, move on - If there's a real negative review, address it publicly with a reasonable response. That does more for you than removal would ### 5. Fake supplier / dropship scam You source a new supplier, usually via Alibaba or a cold email. They offer prices that are too good. You send a deposit (often via wire transfer because "PayPal isn't available"). The goods never ship, or ship as fakes, or ship short. **What to watch for:** - Payment methods that have no buyer protection (wire, cryptocurrency, Western Union) - Prices 30%+ below market rate - No verified business presence (no factory audit, no Alibaba Trade Assurance, no company registration you can verify) - Communication exclusively via Gmail or WhatsApp rather than business email **Defences:** - Use Alibaba's Trade Assurance for first orders. It holds payment until you confirm delivery - Sample first. Order a small quantity before committing to a full run - Verify the business: registration number, Google them, check LinkedIn for employees, reverse-image-search their product photos (stolen photos are common) ### 6. Fake Google / Meta / "your listing is unverified" "Your Google Business Profile is about to be removed. Verify now." Or: "Your Meta Business account has unusual activity." The link goes to a fake login page that steals your ad account credentials. Meta ad account takeover is particularly painful: attackers run their own ads on your credit card before Meta notices and you get the bill. **Defences:** - Log into Google Business and Meta Business Manager directly (not via email links) to check status - 2FA on both - Set ad spend limits on your ad accounts. If they're taken over, the damage is capped at your limit ### 7. The "your domain is expiring" scam A letter (actual paper) or email arrives from "Domain Registry of America" or similar. They're not your registrar. The letter is a transfer request dressed up as a renewal invoice. If you pay, you transfer your domain to a slow, expensive registrar that charges three times your current fee and makes transferring out painful. **Defences:** - Know where your domain is registered. If the letter isn't from your actual registrar, ignore it - Enable registrar lock on your domain (most registrars offer this free) - Set your domain to auto-renew at your real registrar so you never have a "renewal panic" ### 8. Fake affiliate / partnership / "brand ambassador" scams "We love your brand! We'd like to feature you in our $500k marketing campaign. Pay $2,000 for placement." Or: "Become our brand ambassador, send us 50 units of your product for an influencer unboxing." (They're not an influencer; they resell the goods.) **What to watch for:** - Requests for free product from accounts you can't verify - Marketing offers where you pay them (not the other way around) - Vague, generic messaging that could be sent to any brand **Defences:** - Any real partnership proposal comes with specifics: audience numbers, past campaigns, a deck - If they want free product, send one unit and see what they do with it before sending fifty - If they want money upfront for a "feature" or "placement", assume it's not real ### 9. The fake legal threat scam You get a DMCA takedown notice or a trademark infringement letter from a "law firm" you've never heard of. They demand immediate action or payment. The firm isn't real; the claim is fabricated. **Defences:** - Verify the law firm exists (Google, state bar registry) - Forward the email to your actual lawyer or legal advice service; don't engage directly - Real legal notices arrive on paper or through your registered agent, not as a PDF attached to a Gmail address ### 10. The chargeback threat email "I want a refund. If you don't refund in 24 hours I will chargeback my bank AND leave a one-star review on every site." Sometimes this is a legitimate angry customer. Sometimes it's a scam to extract refunds for goods they received and kept. **Defences:** - Handle each on merit: if they have a real reason (wrong item, damaged goods), refund. If tracking shows delivered and the issue is vague, request specifics before refunding - If they chargeback anyway, respond to the dispute with shipping proof and customer communication. You win most "item not received" disputes this way - Remember Stripe's chargeback rate threshold is 1%; if you give in to every threat, your rate climbs and your account gets flagged ## The security baseline every store should have Independent of specific scams, a few defaults make almost all of this harder for the attacker: - **2FA on every account** (email, Stripe, PayPal, Shoprocket, domain registrar, ad accounts). Ideally via an authenticator app, not SMS - **Password manager** with unique passwords per service - **Separate admin email** (not your personal Gmail) for commerce accounts - **Dedicated business card** for advertising with low limits - **Tracking + signature delivery** over a threshold amount - **Clear statement descriptor** on Stripe (cuts friendly-fraud chargebacks substantially) - **Regular log review** in your commerce platforms. Unknown logins should be investigated immediately ```
``` ## What Shoprocket handles - **Login monitoring.** New-device logins trigger an email to the account owner - **2FA available for seller accounts** (turn it on under My account → Account settings → Security, with an authenticator app) - **Admin activity log.** Every significant action (product edits, refunds, permission changes) is logged and reviewable - **Role-based permissions.** Staff only get the permissions they need; a support agent can't change bank details - **Refund protection.** Refunds route through the original payment method by default. No surprise "refund to different card" flows What Shoprocket doesn't solve: scams targeting your email, your ad accounts, your domain, your suppliers. Those are outside our scope, but the 2FA + password manager baseline handles most of them. > **Tip:** If you get a suspicious email claiming to be from Shoprocket, don't click the link. Log into your dashboard directly. Any real notice will be visible in the in-app alerts as well as email. ## TL;DR - **Most scams targeting merchants are social engineering, not technical.** The defences are about awareness, not software - **Phishing + ad account takeover** are the most financially damaging. 2FA on every platform blocks most of them - **Only refund to the original payment method.** The "send my refund a different way" request is almost always a scam - **Suppliers are a major attack vector.** Use Trade Assurance, sample first, verify the business exists - **Real legal / platform notices don't come via Gmail attachments.** Ignore PDF threats unless they're on paper or through a verified channel - **Security baseline:** 2FA everywhere, password manager, admin email separate from personal, tracking/signature on high-value shipments [Start a free trial](https://app-v3.shoprocket.io/signup) and 2FA + role-based permissions + admin activity logs are on by default. 14 days, no card. --- - HTML version: https://v3.shoprocket.io/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them - Language: English (en) - Also in: [العربية](https://v3.shoprocket.io/ar/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [Deutsch](https://v3.shoprocket.io/de/blog/betrugsmaschen-gegen-shopbetreiber-erkennen-und-abwehren.md), [Ελληνικά](https://v3.shoprocket.io/el/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [Español](https://v3.shoprocket.io/es/blog/diez-estafas-dirigidas-a-duenos-de-tiendas-y-como-detectarlas.md), [Français](https://v3.shoprocket.io/fr/blog/dix-arnaques-visant-les-e-commercants-comment-les-reperer.md), [עברית](https://v3.shoprocket.io/he/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [हिन्दी](https://v3.shoprocket.io/hi/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [Bahasa Indonesia](https://v3.shoprocket.io/id/blog/sepuluh-penipuan-yang-menyasar-pemilik-toko-dan-cara-mengenalinya.md), [Italiano](https://v3.shoprocket.io/it/blog/dieci-truffe-contro-i-titolari-di-negozi-ecommerce.md), [日本語](https://v3.shoprocket.io/ja/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [Lietuvių](https://v3.shoprocket.io/lt/tinklarastis/sukciavimo-schemos-nukreiptos-i-parduotuviu-savininkus.md), [Norsk](https://v3.shoprocket.io/nb/blogg/ti-svindeltyper-som-rammer-butikkeiere-og-hvordan-du-avsloerer-dem.md), [Nederlands](https://v3.shoprocket.io/nl/blog/tien-oplichtingstrucs-tegen-shopeigenaren-herkennen.md), [Polski](https://v3.shoprocket.io/pl/blog/dziesiec-oszustw-wymierzonych-we-wlascicieli-sklepow-i-jak-je-rozpoznac.md), [Português](https://v3.shoprocket.io/pt/blog/dez-golpes-contra-donos-de-loja-e-como-identificar.md), [Română](https://v3.shoprocket.io/ro/blog/zece-escrocherii-care-tintesc-proprietarii-de-magazine-si-cum-le-recunosti.md), [Русский](https://v3.shoprocket.io/ru/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [ไทย](https://v3.shoprocket.io/th/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md), [Türkçe](https://v3.shoprocket.io/tr/blog/magaza-sahiplerini-hedef-alan-on-dolandiricilik-ve-nasil-fark-edilir.md), [中文](https://v3.shoprocket.io/zh/blog/the-ten-scams-that-target-store-owners-not-customers-and-how-to-spot-them.md)