Phishing emails, by which scammers and identity thieves attempt to lure you into either clicking on links contained within the email which download malware or trick you into providing personal information that will be used to make you a victim of identity theft, are nothing new.   They are a staple of identity thieves and scammers and with good reason because they work.

Reproduced below is an email that I recently received that is not particularly convincing.  It starts with the fact that the email address has nothing to do with Shopify. but rather appears to be that of an unfortunate individual whose email account had been hacked and made a part of a botnet of infected computers used by scammers to send out phishing emails such as this.   I blocked out the section of the email with personal identifying information.  As with many phishing emails, this one prompts you to act quickly to remedy a phony emergency or your account will be disabled.

Data Compromised

Hi Steven,

We’ve detected a data breach that may have compromised xxxxxx. To safeguard your data and prevent further unauthorized access, please sign in to review your account and reset your password immediately.
If you do not verify your account within the next 24 hours, we will need to temporarily disable your account to prevent further potential compromise.
View Compromised Data
This link will expire in 24 hours.
151 O’Connor Street, Ground floor, Ottawa, ON, K2P 2L8

TIPS

As I often advise you, regardless of how legitimate such an email may appear, you should never provide personal information or click on a link in an email or text message until you have confirmed that it is legitimate.  In a case such as this, calling or emailing the real Shopify would have confirmed that this email was a scam.  General indications that emails such as this are a scam include the sender’s email address not matching that of the company or a generic greeting that doesn’t include your name or account number.  However, it is easy for a scammer to create an email address that might appear to be legitimate and AI has made it easy for scammers to include your name if not your account number in their emails. Also don’t count on your security software to protect you from downloading malware because often these types of phishing emails contain malware that takes advantage of zero day defects which are vulnerabilities that have not yet been recognized by security software companies.  It usually takes about a month before security software companies are able to take steps to protect you from newly discovered malware.

If you are not a subscriber to Scamicide.com and would like to receive daily emails with the Scam of the day, all you need to do is sign up for free using this link. https://scamicide.com/scam-of-the-day/