Shopify developer scams: 10 red flags before you hire

The most common Shopify developer scams start with an unsolicited message about problems in your store, then ask for your owner login, full payment upfront, or a theme or app install from a link they send. A real developer uses a collaborator account, puts scope and milestones in writing, and lets you verify who they are. If someone skips all three, walk away.

These scams work because they sound like help. A founder sees a sales dip, then a message lands saying "your store has 14 critical issues hurting conversions". It's tempting to reply. The trouble starts when that reply turns into a WhatsApp chat, an OTP forwarded at night, and a payment to someone you can't find again.

Below are the 10 flags I'd check before you hire anyone, a section for job-seekers targeted by fake Shopify recruiters, and what to do if you've already been caught.

Why are there so many Shopify developer scams?

Shopify store owners are easy to find and easy to target. Your store's contact page lists an email, your Instagram lists a WhatsApp number, and anyone can see which theme you use.

In late 2025, Partners in Shopify's developer community reported scammers impersonating them from look-alike Gmail addresses. The scammers contacted merchants who had left public reviews on the Partners' directory listings, offered "audits" and asked to be added as staff. One partner said a victim had sent over $600 before realising. Shopify's community forums are also full of merchants posting a message and asking "scam or legit?". The pattern repeats because some of it works.

Payment is the other reason. Shopify's Help Center says a Partner bills you directly and those charges don't appear on your Shopify bill. That's normal for freelance work, but it means no platform holds the money while the job gets done.

The 10 red flags

1. They found you first, with a "review" of your store

An unsolicited email or DM saying they've audited your store is the classic opener. Google's guidance on hiring an SEO says to be wary of consultants who "email you out of the blue", and the same goes for Shopify developers. Generic issue lists, a free email address and an urgent push to switch to Telegram or WhatsApp make it worse.

Some of these people are just aggressive salespeople. Either way, a stranger's audit tells you nothing about whether they can fix anything.

2. They ask for your owner login or a login code

Shopify's Help Center says not to share your login credentials with anyone, including staff, and notes that Shopify Support doesn't ask for your password. A developer never needs it. Shopify built collaborator accounts so a Partner can work in your store with their own login and their own two-step authentication. On the Basic plan, which has no staff accounts, that's the normal route.

If someone asks you to forward an OTP "just to get in quickly", stop the conversation. I've written the safe process step by step in how to give a Shopify developer access.

3. They want 100% upfront

Full payment before any work leaves you with nothing but a promise. A senior developer is comfortable with a deposit followed by milestones you can review on a preview theme, with the last payment at handover. Pressure to pay everything now, often with a "discount if you pay today", is a sales tactic you don't need.

4. They send you a theme file or an app link from outside Shopify

Watch for a zip file of a "premium theme at 90% off", or an app that isn't on the Shopify App Store. Shopify's Theme Store rules say themes listed there can only be distributed through the Theme Store, so a cheap copy of a paid Theme Store theme isn't a legitimate licence. Shopify also says updates aren't supported for themes bought outside the Theme Store. Unknown code in your theme can load scripts you never approved, on every page, including checkout-adjacent pages like cart.

5. Their Partner claim doesn't check out

Plenty of people put "Shopify Partner" or "Shopify Expert" on a profile. Check two things:

1. Search the Shopify Partner Directory for their name or agency. Shopify only guarantees listing from the Plus tier up, which requires at least 10 Verified Skills across the team, so a small freelancer may be a real Partner without a listing. But anyone showing a tier badge (Select, Plus, Premier or Platinum) should have a matching listing.
2. When they send a collaborator request, Shopify shows you how long they've been a Partner, their active collaborations, their sign-up country, the country the request came from, and a "possible VPN" flag. If the details don't match the person you've been talking to, reject the request.

Also note that the "Shopify Experts" brand was retired in December 2023, according to Shopify's Partner Program page. Someone calling themselves a "certified Shopify Expert" in 2026 is using an old label at best.

I cover tiers and listings in detail in my guide to hiring from the Shopify Partner Directory.

6. The "Shopify" email isn't from Shopify

Some scams skip the developer pitch and impersonate Shopify itself: a store suspension notice, a chargeback alert, a "policy violation" with a 24-hour deadline. Shopify's Help Center says it only sends email from @shopify.com, @email.shopify.com, @em.shopify.com and @shopify-billpay.melio.com, and never asks for sensitive information directly in an email. It lists free email services, poor grammar, urgent or threatening language and unfamiliar links as warning signs.

Shopify also says sensitive documents are only ever requested through a secure upload page on app.shopify.com or another .shopify.com address. Forward anything suspicious to phishing@shopify.com, and if you're unsure, log in to your admin directly instead of clicking the email's link.

7. They guarantee results nobody can guarantee

"Page one on Google in 30 days." "Double your conversion rate or your money back." Google's own documentation is blunt: "No one can guarantee a #1 ranking on Google", and if someone does, "find someone else". Conversion and revenue guarantees are the same story. A developer can commit to deliverables, a timeline and measured page speed. Sales depend on your product, traffic and pricing too.

8. There's no written scope

A WhatsApp voice note saying "I'll fix everything" is not a scope. Before any payment, you should have a document that lists what will be built, how many revisions are included, the timeline, the payment milestones, who owns the code, and what is excluded. Without it, every disagreement becomes your word against theirs.

9. They want broad access and want to keep it

A developer fixing a product page doesn't need customer exports, payment settings or billing. Shopify flags permissions like "Manage payments settings" and "Edit billing payment methods and pay invoices" as sensitive. Be wary of someone who asks for everything "to save time", and of anyone who resists being removed once the work is done. Shopify only expires an unused collaborator after 90 days without a login, so access you forget about can stay open.

10. The store or code lives in their account

If a developer builds your new store, it should end up owned by you, with your billing. Shopify's client transfer process exists for exactly this: the Partner builds, then transfers ownership. A developer who keeps the store in their own account after launch, or won't hand over the theme code, controls your business. Ask before you start: "Whose account is the store in, and when does it move to me?"

The checklist: red flag vs what a real developer does

Job-seekers: is that "Shopify recruiter" real?

Probably not, if the contact came from an unknown number and the job involves "improving sales rankings", fake shopping tasks or a deposit. In Shopify's community forums, people describe a message from someone claiming to be a "customer service executive of Shopify", followed by a request to deposit money before starting. One user said they had paid ₹4,665.

Shopify Community staff have answered these posts directly. In March 2024, staff replied that the offer "is not an official Shopify post or promotion", told the person to "not pay anything", and said all job opportunities at Shopify are posted on its careers website. Another staff reply said a site making such offers was "not affiliated with Shopify in any way".

The rule is simple. A real employer doesn't charge you to work for them. Find Shopify roles on shopify.com/careers, and if you've paid money to a fake recruiter in India, report it on the 1930 helpline or cybercrime.gov.in quickly.

Already hired someone you don't trust? Do this today

1. Remove their access. Go to Settings > Users, open the collaborator or staff account and remove it. Removing a collaborator is permanent, so they'd need a new request with your code to return.
2. Generate a new collaborator request code under Settings > Users > Security, so the old one stops working.
3. Change your password and turn on two-step authentication if it isn't already on.
4. Check apps and themes. Uninstall any app you didn't choose, and compare your live theme with a backup or an earlier version. A theme audit, such as my free Theme Audit skill, can help list the third-party scripts your theme loads.
5. Review the activity log and any staff or collaborator accounts you don't recognise.
6. Report it. Forward phishing to phishing@shopify.com, and use Shopify's Report a Partner violation form for a Partner breaking the Partner Program Agreement. Shopify's Help Center notes that it isn't directly responsible for freelancer or agency issues, so report fraud involving money to the police too.

If you'd like someone to check what was changed, send me the details and I'll tell you what I'd look at first.

What I'd do

If I were hiring a Shopify developer tomorrow, I'd start from my own shortlist instead of my inbox. I'd look at people whose work I can see live, check the Partner Directory, and have a short call before sharing anything.

Then I'd ask for three things in writing: a scope with exclusions, a milestone payment plan, and a statement that the code and store are mine. And I'd give access only through a collaborator request with the permissions that scope needs.

That's also how I work. I'm a Shopify Partner with a verified directory listing, and I'll be straight about it: the listing is new and has no reviews yet. So instead of a badge, I'll show you live stores like Mahina, where the work lifted AOV by 28% and got speed scores into the 95+ range, and you can shop them yourself. If you want a second opinion on a quote or a developer you're unsure about, or you'd like to hire someone you can verify, tell me about your store. You can also see how I price work on the rates page.

Related reads

• How to give a Shopify developer access to your store (safely)
• Freelance Shopify developer vs agency vs marketplace
• Hire an offshore Shopify developer: the vetting process

Sources

• Shopify Help Center: Protect your account against phishing, vishing and smishing
• Shopify Help Center: Account security best practices
• Shopify Help Center: Collaborator accounts
• Shopify Help Center: Store permissions
• Shopify Help Center: Hiring and working with Shopify Partners
• Shopify Help Center: About the Shopify Partner Program tiers
• Shopify Help Center: Eligibility for the Shopify Partner Directory
• Shopify Help Center: Updating themes
• Shopify.dev: Theme Store prohibited actions
• Shopify.dev: Client transfer stores
• Google Search Central: Do you need an SEO?
• Shopify Community: Is this part time job opportunity with Shopify legitimate or a scam? (staff replies, March 2024)
• Shopify Developer Community: Experts Directory impersonation thread
• Kerala Police: National Cyber Crime Reporting Helpline 1930
• National Cyber Crime Reporting Portal