People worldwide report seeing mysterious $1 or $0 charges from Shopify-charge.com appearing on their credit card bills, even when they did not attempt to purchase anything.
The charges have no rhyme or reason to them and are seen on physical and virtual credit cards of all types, including those from Discover, Monzo, Capital One, and other Visa cards. Some people report that charges were also attempted against older deactivated cards.
According to reports, the charges started approximately ten days ago, on July 21st, with the number of impacted people increasing as time passed.
"Not sure if it was just me today but seems like I've got a shopify active card check today. Thankfully, no money was debited. Got in touch with support and they confirmed it was a scammer," warned a Monzo card member on Reddit.
"I just received an email from privacy.com notifying me of a decline. The declined payment was for $0.00 charge at SHOPIFY-CHARGE.COM I have not used this card outside of paying for my Wyze cam subscription," warned another person.
Source: Reddit
Since then, many people have reported these unusual charges on Reddit and the Shopify forums.
Of more concern is that two people claimed to have received similar charges soon after creating a new virtual card at their bank.
The attempted charges state they are from shopify-charge.com with a phone number of 866-938-2427. Some attempted charges include an address of 5715 Will Clayton Pkwy, Texas 77338, which appears to be a non-existent location.
However, Shopify-charge.com is a legitimate website operated by Shopify that, when visited in a browser, explains to a user that the charge came from a subscription fee or a purchase at a Shopify store. While some who received these charges claim they have never used their credit card at Shopify, many stores use the platform as their backend without a customer knowing.
If you have received any of these charges and have more information to share, please comment on this story, contact us via Signal at 646-961-3731, or email us at tips@bleepingcomputer.com.
As for the phone number, BleepingComputer's attempts to call it led to the debt collection firm Halsted Financial. BleepingComputer emailed the company to see if they were associated with the charges but has not received a reply yet.
One impacted person posted to Reddit saying they called the number, and Halsted said they do not know why their number is associated with these charges.
Shopify has recently suffered a third-party data breach at one of its vendors, leading many to think these charges may be related. However, the data exposed in that breach did not contain credit card or payment information.
If you have received any of these charges and have more information to share, please comment on this story, contact us via Signal at 646-961-3731, or email us tips@bleepingcomputer.com.
Update 8/2/24: Shopify says that the shopify-charge.com charges are unrelated to the company's recent vendor data breach.
"This card testing fraud is not related to a data incident at Shopify," Shopify told BleepingComputer.
However, Shopify has not responded to repeated questions about the charges themselves other than the above statement.
Comments
DyingCrow - 3 months ago
"Shopify has recently suffered a third-party data breach at one of its vendors, leading many to think these charges may be related. However, the data exposed in that breach did not contain credit card or payment information."
As some say, "o rly?"
aduwing - 3 months ago
I received a notice from Privacy that a charge from Shopify was blocked. It was attempted using the virtual card I use for Wyze.
Isaidiwasgonntell - 3 months ago
I’m not sure how this *isn’t* a Shopify issue. I’ve had 2 virtual cards compromised, with 2 different vendors, and they both use Shopify as their store’s platform. The cards are “locked” to a single merchant and can’t be used anywhere else. I’d think it was the provider of the virtual card numbers except it’s happening to too many different types of cards, from all over the world, with different issuing banks. I guess nothing’s impossible, but you hear hoof beats, think horses, not zebras, right? Idk
pistis_storge - 3 months ago
"I’m not sure how this *isn’t* a Shopify issue. I’ve had 2 virtual cards compromised, with 2 different vendors, and they both use Shopify as their store’s platform. The cards are “locked” to a single merchant and can’t be used anywhere else. I’d think it was the provider of the virtual card numbers except it’s happening to too many different types of cards, from all over the world, with different issuing banks. I guess nothing’s impossible, but you hear hoof beats, think horses, not zebras, right? Idk"
Same with me. All evidence points to Shopify leak. Even worse is that this appears to even happen to new cards added. I am hesitant to add a new card if it's just going to get another charge. Soon enough the fraud departments will get tired of replacing cards.