Before BFCM, do one boring thing: buy something from your own store…

Before BFCM, do one boring thing: buy something from your own store 🙃

Incognito window, add to cart, click checkout, and look where you actually land. Stop before the card details.

Since summer a few Shopify apps had their settings changed by someone who shouldn't, and stores were sending customers to fake checkout pages on lookalike domains. HulkApps, Selleasy and Swym all confirmed incidents in October. Roman Zipp caught it himself while buying a keyboard, his timeline is the clearest I found: https://romanzipp.com/blog/shopify-hit-with-phishing-attack

Shopify now asks customers to confirm before the store sends them to an outside website. Good. Still not the whole fix.

And open your app list. Every app that runs JS on the storefront sits in your checkout path. Do you still use all of them? 🤷‍♂️