Body
Woke up this morning to my inbox completely buried under thousands of spam emails. promotions for random craft fairs in europe, luxury brands i never signed up for, newsletters piling up so fast i could barely scroll. thought it was just another bot attack and started deleting in bulk but something felt off so i paused and actually searched for shopify.
buried like 400 emails deep were three critical ones i almost missed. one said a recovery code was used to log in. never requested it. another welcomed me to shopify credit which i definitely did not apply for. and the third had financial disclosures for a new line of credit. heart just stopped. logged in immediately and there it was. someone had opened a 30k credit line in my stores name and already racked up 25k in fraudulent charges for fake bulk orders to drop addresses. all within hours.
i have 2fa on everything. authenticator app not sms. changed all passwords locked everything down reported to shopify support right away. they say investigation could take 90 days and charges might get reversed but the account is frozen now for suspicious activity which is insane because the hack already happened. other merchants are messaging me saying same thing happened to them. spam flood to hide the real notifications.
this store was finally hitting 8k a month after a year of grinding products testing ads building trust. now everything paused customers emailing why site down potential refunds piling up. cannot even process real orders. feel like throwing up. how does this even happen with 2fa. is there any way to speed up shopify disputes or recover faster. anyone been through this nightmare and clawed back. please tell me this is recoverable before i shut it all down.
Top comments (9)