Fake Shopify store suspended emails: how to tell if your store is really in trouble

"Your store has been suspended for a policy violation. Verify your account within 24 hours to avoid permanent closure." For a merchant, few emails are more alarming, which is why criminals copy them. A fake Shopify notice sends you to a lookalike login page that captures your password and two-step code, and with them your orders, customer data and payout settings. This guide shows how to check any Shopify warning safely, what Shopify's real emails look like, and what to do if you already clicked.

What is a fake Shopify store suspended email?

A fake Shopify store suspended email is a phishing message made to look like a Shopify account notice. It claims your store is suspended, frozen, closed or about to be, and pushes you to "verify", "appeal" or "restore" it through a link. The link leads to a fake Shopify login page or a form that asks for personal or payment details.

Shopify's own phishing help article lists the warning signs it sees most: unexpected emails from free email services, requests for personal information, poor grammar and spelling, "urgent or threatening language" and links to unfamiliar websites. It also warns about vague greetings such as "Dear account holder".

Common versions of the lure

The copyright version overlaps with a wider scam that hits every website owner; our guide to fake copyright infringement phishing covers it in detail.

Example of a fake Shopify suspension email

This is an example written for this guide. It is not a real Shopify email.

From: Shopify Trust & Safety <compliance@shopify-merchant-review.com>
Subject: Action required: your store has been suspended

Hello Merchant,

Our team detected activity on your store that violates
the Shopify Acceptable Use Policy. Your storefront has
been suspended and payouts are on hold.

To appeal, verify your account within 24 hours:

[ Verify store ownership ]

Stores that are not verified will be permanently closed
and remaining funds will be forfeited.

Shopify Trust & Safety Team

The giveaways: a domain that isn't one of Shopify's, a generic greeting, a hard deadline, and a threat to your money. But don't rely on spotting mistakes. The checks below work even when the fake looks perfect.

How do I know if a Shopify suspension email is real?

Sign in to your Shopify admin yourself, by typing the address or using a bookmark or the Shopify app, and see whether the problem exists there. Never use the email's button. If your store, payouts and billing look normal in the admin, the email is fake. If you're still unsure, contact Shopify Support from help.shopify.com rather than from anything in the message.

Then check the sender and the request against what Shopify publishes:

1. Check the sender's full address, not the display name. Shopify says it only sends from "@shopify.com", "@email.shopify.com", "@em.shopify.com" and "@shopify-billpay.melio.com", and that mail from Gmail, Yahoo, Apple or Hotmail addresses should be treated as potential phishing (Shopify Help Center). Our guide to display name spoofing explains why the name you see means little.
2. Hover over the link before clicking anything. Shopify notes that its links may use "shopifysvc.com". A link to any other domain, especially one that only resembles Shopify, is a red flag. See how to check if a link is safe.
3. Look at what it asks for. Shopify says it "never asks you for sensitive information directly through an email message" and that sensitive documents go only through a secure upload page on app.shopify.com or a shopify.com address. Any request to reply with a password, card number or two-step code is fake.
4. Check the channel. A request to continue on WhatsApp, Telegram or a phone number in the email is a strong sign of a scam.

Real vs fake Shopify emails

A correct sender domain is necessary but not enough. Scammers can send mail from domains they own or through legitimate email platforms, and that mail can pass SPF, DKIM and DMARC, so the final test is always your admin. If you want to see where a message really came from, paste its headers into the Email Header Analyzer.

Does Shopify send real security emails?

Yes. Shopify's account security best practices say it emails you with the subject "A new device has logged in to your Shopify account" when it sees an unrecognized device. The real email has a Check activity button and, if the login wasn't you, a No, secure account option.

Because real emails like this exist, copies of them exist too. The safe habit is the same: open your Shopify account yourself and review recent login activity there, instead of trusting a button.

What should I do if I clicked a fake Shopify link?

If you only opened the email, delete it and report it. If you clicked the link but typed nothing, close the page and run a malware scan if anything downloaded. If you entered your password or a two-step code, act now.

Do this now

1. Change your email password first. Shopify's compromised-account checklist starts with the email account you use to log in to Shopify, because whoever controls it can reset your Shopify password.
2. Change your Shopify password from a trusted device. If you can't log in, reset it and contact Shopify Support if no reset email arrives.
3. Turn on two-step authentication, or if the attacker defeated it, remove the authentication method for that device and set it up again on a different one (Shopify Help Center).
4. Review login activity, financial accounts and banking details for anything you don't recognize, including Shopify Payments, Balance, Credit and Capital.
5. Contact Shopify Support so it can check for unauthorized access.

Then check the store itself

Shopify's checklist goes further than the password. Review:

• Staff and collaborator accounts and their permissions. Remove anyone you don't recognize.
• The store activity log at shopify.com/admin/activity for changes you didn't make.
• Settings: store contact details in General, Checkout, Shipping and Delivery, Domains and Notifications.
• Apps, including the Custom apps section, plus Discounts, marketing campaigns under Growth, and Content > Files.
• Orders and draft orders. Confirm suspicious ones with customers and cancel or refund as needed to prevent chargebacks.

Changed notification settings matter: an attacker who edits them can send convincing emails to your customers. For the general steps after any phishing click, see what to do after clicking a phishing link.

Does two-step authentication stop fake Shopify emails?

Two-step authentication stops a stolen password from being enough, but a code can still be phished. A fake page can ask for your one-time code and pass it to Shopify in real time; this is called adversary-in-the-middle phishing and is explained in our guide to MFA bypass.

Shopify supports authenticator apps, security keys, a built-in authenticator and passkeys. At the time of writing (November 2026), its secure sign-in page says existing SMS setups can continue but SMS "can't be set up as a new two-step authentication method". Security keys and passkeys are tied to the real site, so they don't work on a lookalike page; see passkeys and phishing-resistant MFA.

Shopify also says two-step authentication is required to use Shopify Payments, and that without it your payouts might be placed on hold (Shopify Help Center). Shopify advises that the owner shouldn't share login credentials with anyone, including staff, and that each person should have their own staff account with specific permissions.

How do I report a fake Shopify email?

Forward the fake email to phishing@shopify.com, the address Shopify gives in its phishing help article, then delete it. In the US you can also report phishing to the FTC at ReportFraud.ftc.gov, as the FTC's phishing guidance recommends. For more on where reports go, see how to report a phishing email.

What should a business admin do about fake Shopify emails?

If your company runs one or more stores, fake Shopify notices will reach the people who manage them: the owner, the ecommerce manager, the agency and the finance team. Treat a reported one as an incident, not a one-off.

1. Find every copy. Search for the sender domain and subject with Microsoft 365 message trace or Google Workspace email log search, then remove the messages; our guide to removing a phishing email from all mailboxes shows how in Microsoft 365.
2. Block the sender domain and the link domain. Never block Shopify's real domains; you'd lose order and billing mail.
3. Ask who clicked. Anyone who entered credentials follows the "do this now" list above, and their mailbox needs the same review as any compromised email account.
4. Separate store logins. Staff accounts with only the permissions each person needs limit what one phished login can do.

Your own store's name can be abused too. Criminals register lookalikes of store domains to phish your customers; check yours with the Lookalike Domain Generator, and read our ecommerce email security guide for authenticating Shopify's notification mail with SPF, DKIM and DMARC.

An inbound filter at the MX level checks mail for phishing, spoofing and lookalike senders before it reaches staff inboxes, and holds suspect messages in a quarantine each user can review. Our page on email security for small businesses explains where that layer fits.

Next steps

1. Tell everyone who touches the store the one rule: never act on a Shopify warning from the email; sign in to the admin yourself.
2. Turn on two-step authentication for every staff account, and move to passkeys or security keys where you can.
3. Save phishing@shopify.com somewhere your team can find it.
4. Run the free DMARC Checker on your store domain so criminals can't send as you, and if fake notices keep reaching staff, see how iBlockSpam protects small business email.

Browse our other phishing and threat guides.