Why sellers are good targets
Running a store means dealing with a steady flow of messages about invoices, payments, shipments, domain renewals and customer problems. A scam that imitates any of these blends in easily. Owners are often busy, work alone or in a small team, and handle money and logins that attackers find valuable. A single careless click can expose an admin login or lead to a payment sent to the wrong party.
Phishing is the broad term for messages designed to trick someone into revealing information or taking an action, such as logging in on a fake page, opening an attachment or sending money. The channel is usually email, but text messages, social media direct messages, marketplace chats, phone calls and contact forms are used too.
Common scams
Fake invoices and renewal notices
A message arrives with an invoice for a service the shop never ordered, such as a domain renewal, a directory listing, a search ranking service or software subscription. The amounts are often modest, in the hope that someone pays without checking. Others carry an attachment that installs malicious software. Some mimic a real vendor’s look but use a different payment account.
Before paying anything, check whether you actually use the service. For domains, log in directly at the registrar to see the real renewal dates. A genuine domain name renewal appears in your registrar account whether or not you click an email.
Overpayment and refund tricks
A buyer pays more than the order total, or sends a payment that appears to arrive, then asks for the extra to be refunded, or for the goods to be shipped with a courier arranged by the buyer. Later, the original payment is reversed, flagged as fraud or turns out to be fake, leaving the seller out of both the goods and the refund. Variations involve fake payment confirmation emails that look as if they came from the payment provider.
The safe approach is to confirm funds in the payment account itself, not from an email or screenshot. If a payment is too high, it is generally better to refund through the original payment method, or to wait until the funds have fully settled, than to send money by another route. Settlement times vary by method.
Spoofed provider, platform and carrier messages
These pretend to come from a payment provider, the ecommerce platform, a hosting company, a carrier or even a government office. Typical lines: “Your account has been suspended”, “Unusual activity detected”, “Confirm your details within 24 hours”, “A package could not be delivered”. The link leads to a page that copies the real login form and captures what is typed.
Buyer messages with links or attachments
A “customer” writes with a question and asks you to open a photo, a spreadsheet or a link that supposedly shows their issue or order. Marketplace messages that try to move the conversation to personal email or a chat app are also a warning sign, since it takes the exchange away from the platform’s protections.
Pressure on large or odd orders
An unusually big order with an urgent shipping demand, a request to ship to a forwarding address, or to split the payment across several cards often goes with stolen cards. The discussion of order screening covers these signs. The scam may be targeting the shop’s goods rather than its logins, but the pressure and urgency are the same.
Impersonating the boss, a supplier or a staff member
If there are employees or contractors, a message that looks like it comes from the owner asking someone to buy gift cards, change bank details for a supplier or share a password is a well-known trick. The same applies to a supplier who suddenly announces new bank details. Supplier vetting at the start of a relationship helps you notice when something changes.
Warning signs
- Urgency or threats. Deadlines, suspensions and penalties meant to stop you from thinking.
- A request for credentials, codes or payment. Real providers do not ask for your password by email.
- A sender address that is slightly off. A misspelled domain, extra words or a free email service used by something that claims to be a company.
- Generic greetings, or details that do not match your account.
- Links whose visible text differs from the real destination. Hovering over a link on a computer shows where it actually goes.
- Unexpected attachments, especially compressed files or documents asking you to enable macros.
- Payment instructions that differ from previous ones.
- Poor spelling and odd phrasing, though well-made scams can be polished, so a clean message is not proof of anything.
How to verify
- Pause. A short delay costs little. Scammers rely on speed.
- Go to the source yourself. Open the provider’s site or app by typing the address or using a saved bookmark, not the link in the message. Check for notices in the account.
- Use known contact details. Call or message the company using details from a past bill or the official site, not those in the suspicious message.
- Check the money in the actual account before shipping goods or sending refunds.
- Ask a second person. A colleague, a friend or the provider’s support can confirm quickly.
- Treat changes to payment details as high risk, and confirm them through a channel you already trust.
Reduce the damage if something slips through
- Turn on two-factor authentication for email, the store admin, the payment account and the registrar, so a stolen password alone is not enough. The options are discussed in the article on two-factor authentication.
- Use a password manager, which will not fill a login on a fake site because the address does not match.
- Give staff only the access they need.
- Keep software updated and use reputable security software on work devices.
- Forward real phishing attempts to the impersonated company’s abuse contact if it publishes one, and delete them.
If you did click or enter details, change the password right away, from a safe device, sign out other sessions, notify the payment provider if money or card data may be affected, and watch accounts closely for a while. Report significant financial losses to the relevant authorities in your area. Practices and protections vary by place, and this article is general information, not legal advice.