How to report a phishing site to Shopify

To report a phishing or scam site to Shopify, use Shopify's spam or malicious practices (including phishing).

Storefront platform: common for fake shops.

Shopify is an e-commerce platform that hosts online stores for merchants. Shopify's Help Center says every store gets a myshopify.com address when it signs up, so a shop at something.myshopify.com is on Shopify. Many stores also connect their own domain, bought from Shopify or elsewhere.

Fake shops and phishing pages built on Shopify are reported through Shopify's "Report an issue" tool, not by email. Shopify's Acceptable Use Policy says that if you believe a Shopify user is breaking the policy, you can submit a report there.

Shopify splits merchant reports into categories. Two matter most for scams: "Spam or malicious practices", which covers phishing and malware, and "Fraud", for merchants you believe are running scams or fraudulent activity.

How to reach them

Spam or malicious practices (including phishing)Fraud report form

Shopify owns the parent domain of these addresses, so it can remove a page on any of them directly:

  • *.myshopify.com
  • Use Spam or malicious practices for phishing, and Fraud for a scam store
  • Both forms ask you to log in to or create a Shopify account first

Reporting to Shopify, step by step

  1. Go to shopify.com/legal/tools/report-an-issue/report-a-merchant to see the list of report types.
  2. If the store is a phishing page (for example a fake login page for a bank or for Shopify itself), choose "Spam or malicious practices".
  3. If the store takes payment and never delivers, or is otherwise a scam shop, choose "Fraud".
  4. If your problem is with a specific order you placed, Shopify has a separate "Issue with an order" option.
  5. Shopify asks you to log in to an existing Shopify account, or create a new one, before you can report an issue with a merchant. Press Continue and sign in.

What Shopify asks you to include

  • Shopify does not show the report questions until you sign in, so it does not publish an evidence list. Have the store's web address ready, including its myshopify.com address if you can find it, since that is the address Shopify gives every store.

What Shopify can do

  • Shopify's Acceptable Use Policy says it does not tolerate anyone defrauding Shopify, other merchants or buyers, or using Shopify for spam or other malicious practices.
  • In those cases Shopify says account-level action is often more appropriate than its usual product-level enforcement.

What Shopify cannot do

  • Shopify does not offer an anonymous merchant report: you must sign in to a Shopify account, or create one, to report an issue with a merchant.
  • Shopify publishes no abuse email address for these reports on the pages checked; the report tool is the route.

What happens after you report

  • For most policy problems, Shopify says it gives the merchant notice and a chance to fix things, enforces at the product level first, and takes account-level action as a last resort.
  • For fraud and malicious practices it says account-level action is often more appropriate.
  • Shopify's pages checked do not say whether or when it will reply to the person who reported.

Write the report

Paste the link, phone number or email address and we'll write the message for Shopify. You send it yourself.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.

Scan a website

Checked against Shopify's own pages on 2026-10-20: