Texts and orders

The Shopify Store Refund Text Scam, October 2026 (40ch)

Updated 17 October 2026

You get a text that looks like it came from a small shop you actually ordered from last week. The order number matches. The product name matches. The link goes to a page that looks like the shop, asks for your card number to 'process the refund,' and the page even loads on the shop's real domain. The text is a lie, the page is a clone, and the money is already moving by the time you finish typing.

What the Shopify refund text actually says

You ordered a candle, a phone case, a dog bed, a t-shirt. Something small. A few days later your phone buzzes with a text that reads almost exactly like this:

"Hi [your first name], your order #[matching number] from [shop name] is on hold. Due to a stock issue we are unable to fulfil. To process a full refund of $[matching price] please confirm your card: [link]"

Or a shorter version: "[Shop name]: we could not deliver your order. Confirm delivery and refund here: [link]"

The shop name is one you've actually used. The order number lines up with an order you actually placed. The price is right. Sometimes the link is even on the real shop's subdomain, because the scammer registered a lookalike domain the week before, or worse, the shop itself runs on Shopify and the link is a legitimate Shopify storefront the scammer set up to look identical to the real one.

Shopify powers around five million online stores, and any of them can be cloned in an afternoon. The scammer copies the product photos, the about page, the footer. They pay for the real domain or a near-miss like shop-name-help.com. They buy a Shopify plan, drop in a refund form, and run a paid ad or a text blast to a list of phone numbers scraped from data brokers or from the shop's own leaked customer list.

What you are looking at is a phishing kit wrapped in a real storefront. The form on the page is not a refund form. It is a card capture form.

How the scammer already knew your order number

This is the part that fools people, and it is worth slowing down on. Three things can give the scammer your real order details, and each one changes how you should respond.

1. The shop got breached, or a Shopify app did. Shopify has had app and vendor incidents in recent years where customer records were exposed. In 2025, a Salesforce related integration that many Shopify stores used was found to have leaked order data, and a class of refund scams spiked in the months after. If your shop is using a third party for email, SMS shipping notices, or reviews, that third party is a likely leak point. The breach is not your fault and the order number alone is not enough to steal from you. Your name, address, phone, email, last four of a card, and order total are. That is the kit the scammer bought.

2. The scammer scraped public order confirmation emails. If you have ever posted a screenshot of an order to social media, a review site, a Reddit thread, or a dispute on a forum, the order number is in the image. Run a search for your own order number in quotes and see what comes up. If anything shows, delete it now and rotate the card on that order.

3. The phone number is the key, the order number is a guess. Plenty of these blasts are pure spray. The scammer sends ten thousand texts, hoping a few hundred people ordered from a shop with a similar name in the last month. If the order number is a hair off, the scammer is gambling. If it matches exactly, assume a leak.

The order number matching your real order is not proof the text is real. Treat it as a warning that your data is in someone's spreadsheet.

Why the link looks like the real shop

Shopify gives every store a .myshopify.com address. Scammers register free trial stores, copy the theme, copy the product photos, copy the logo, and you land on a page that looks identical to the shop you remember. The only tells are usually in the URL bar and in the form itself.

On a real Shopify store, a refund does not require you to type your card number. The shop already has it from checkout. If a refund is genuinely owed, the money goes back to the card you paid with, automatically, and the shop emails you. You do not need to confirm anything. You do not need to enter the long card number again.

If a form is asking for the full card number, the expiry, the CVV, the billing postcode, or your online banking password, you are on a phishing page. The CVV is the kill shot. No legitimate merchant needs it to push a refund. The CVV is what lets the scammer use the card number on other sites.

Some scammers are lazier. They send you to a fake PayPal or a fake Apple Pay confirmation page. Same idea. If a refund is owed on PayPal, the money lands in your PayPal balance. You do not need to log in anywhere to receive it.

What to do in the next ten minutes if you tapped

You are reading this because you tapped. That is fine. You are not ruined. The clock is the only thing that matters now.

If you entered a card number, open your banking app right now. Find the card. Tap freeze. That stops new authorisations on the card in seconds, and it is reversible. Then call the number on the back of the card and ask for a card replacement and a chargeback on the charge the scammer is about to run. The bank will want the merchant name, the amount, and the date. If you do not see the charge yet, ask the bank to flag the card for fraud monitoring and to issue a new number.

If you entered a PayPal login, go to PayPal on a device you trust, change the password, turn on two factor with an authenticator app rather than SMS, and check the activity tab for logins from a city you have not visited. PayPal's resolution centre is where you open a dispute if money has already moved.

If you entered an online banking password, that is the worst case. Call the bank's fraud line from a different phone if you can, because the scammer may have a live session on the screen. Ask the bank to revoke the session, reset the password, and walk you through every active device. Watch your statements for ninety days.

After you have stopped the bleeding, screenshot the text, the page, the URL, and the time. Forward the text to 7726 (SPAM) so your carrier can log it. Report the domain to Google Safe Browsing and to Shopify's abuse team at abuse@shopify.com with the full URL. The real shop also wants to know. Search their real site for a contact page and tell them. Most small shops will post a banner the same day.

The tell that catches most Shopify refund scams

The single sharpest tell is also the easiest to check. The text says "confirm your card." A real refund does not need a confirmation. A real refund pushes the money back to the card on file. The shop already has the long number, the expiry, and the billing address. The only thing the shop is missing, the only thing the scammer needs, is the CVV or the online banking password. The form is built to ask for that one missing field. The whole phishing kit exists to harvest the three digits on the back of your card.

Second tell, the URL. Read it letter by letter. shopname.myshopify.com is the only legitimate pattern. shopname-refund.com, shopnamehelp.co, shopname-secure.shopify-refund.app, anything with a hyphen and a word like refund, help, secure, or verify, is a scam. New domains cost eleven dollars. Old trust costs years. Scammers buy the cheap one because the trusted one is not for sale.

Third tell, the urgency. "On hold," "expires today," "confirm in 24 hours." The text is written to push you past the part of your brain that reads URLs. Slow down. The money is not going anywhere. If a real shop cannot fulfil an order, the shop emails you and refunds you. The shop does not need your card to do it.

The refund that the real shop will actually send

It is worth showing you what a real Shopify refund looks like, because the contrast is the whole point.

You ordered a £28 candle. The shop cannot fulfil. Two things happen in your inbox within an hour or two. First, an email from the shop, on the shop's real domain, saying the order is cancelled and a refund is processing. Second, a separate email from Shopify Payments, on a shopify.com address, with a real refund receipt that includes the last four of the card and the order total. The card on file is credited. No card number is requested. No link is sent. No "confirm" step exists.

If you get a text out of the blue instead, assume phishing. If the text contains a link, assume phishing. If a page asks for the three digits on the back of the card, assume phishing. These three rules cover almost every Shopify refund scam reported in 2026.

How to report a Shopify refund text

Reporting does not usually get your money back by itself, but it slows the next wave and it builds the file the bank uses if you do dispute the charge.

Forward the text to 7726. In the United States that is the GSMA spam reporting short code used by AT&T, Verizon, and T-Mobile. In the UK the equivalent is 7726 on every major network. The carrier logs the sender and may block the number across the network.

Report the link to Google at https://safebrowsing.google.com/safebrowsing/report_phish/. Chrome users will see a warning on the page within hours if enough people report it.

Email Shopify at abuse@shopify.com with the URL, the text screenshot, and the date. Shopify takes down confirmed phishing stores, usually within a day, and bans the account that set them up.

Tell the real shop. Search the shop on Google, ignore the link in the text, open the shop's real site, and use the contact form. Most small shops will post a banner the same day and email the customer list a warning. That is the only response that actually protects other people.

File a report with the FTC at reportfraud.ftc.gov or, in the UK, with Action Fraud at actionfraud.police.uk. These do not always result in a callback, but they feed the datasets that get a scammer's number shut down at the carrier level.

Longer term, the only durable fix is your data

Until your name, phone, and order history stop being a commodity, these texts will keep landing. Three habits make the next wave harder.

Use a virtual card for online shopping. Most banks now offer single use card numbers, or capped merchant card numbers, that you can throw away after one transaction. If the card number leaks, the card number does not work. Privacy.com, Revolut disposable cards, and Capital Entain virtual numbers all do this for free or near free in 2026.

Strip your phone number and address from the data brokers that sell to scammers. The major ones, Spokeo, Whitepages, TruePeopleSearch, Radaris, and BeenVerified, all have opt outs. It is tedious and the listings come back, but each removal cuts the next blast by a meaningful slice. MalwareZero has step by step guides for the biggest ones, and the time it takes is the only thing that has not changed since 2018.

Use a unique email for shopping and do not let that email be the same as your bank email. If the shopping email leaks, your bank login is not on the same server.

Most of all, treat every refund as something the merchant pushes to you, never something you go and fetch. The merchant has your card. The merchant does the refund. The day you internalise that, the rest of the scam stops working on you.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.