How to Detect Phishing Attacks and Merchant Account Scams on Your Ecommerce Business

Phishing is a mix of social engineering and identity theft designed to trick people into handing over private details — passwords, account numbers, and cardholder data. For online sellers, the stakes are high: a single compromised login can expose your checkout, your customers, and the high risk merchant accounts your revenue depends on.

Fraudsters target merchants because that's where the money is. Payment credentials, settlement details, and processor logins are all valuable, and attackers know that busy ecommerce teams often click first and verify later. The good news: most phishing attempts and merchant services scams follow recognizable patterns. Once you know what to look for, they're much easier to stop.

What Is Phishing in Ecommerce?

In an ecommerce context, phishing is any attempt to impersonate a trusted party — your payment processor, PayPal, a marketplace, a supplier, even a coworker — to steal credentials or financial information. Attacks arrive by email, text message (smishing), phone call (vishing), and even through code injected into your own storefront.

The target isn't always the customer. Merchants themselves are phished for processor dashboard logins, bank details, and admin access to platforms like WooCommerce, Magento, and PrestaShop.

Common Phishing Tactics Targeting Online Merchants

Fake Emails, Texts, and Calls

In the most common scam, fraudsters pose as an authority figure from a legitimate business — your processor's "risk department," your bank, or a platform's support team — and pressure you to confirm passwords, account numbers, or one-time codes. Legitimate providers never ask for full passwords or two-factor codes.

Fake Checkout Pages and E-Skimming

Hackers inject malicious JavaScript into ecommerce platforms so that when a customer reaches checkout, the script either redirects them to a lookalike payment page or silently copies card data as it's entered. Outdated plugins and themes are the most common entry point.

URL Spoofing

Fraudsters register domains that are nearly identical to real ones — a swapped letter, an extra hyphen, a different top-level domain — and count on victims not looking closely. Inspect the full URL before entering credentials, and bookmark the real login pages you use.

Account Suspension Lures

"Your account has been limited" is a classic hook. Because a suspended PayPal or processor account means lost revenue, merchants panic and click. Treat any suspension notice as suspect: log in directly through your bookmarked URL or the provider's app — never through the link in the message.

Merchant Services Scams: Red Flags to Watch For

Not every scam arrives as an email. Fraudsters also impersonate payment providers and sales agents to defraud merchants directly. Common merchant services scams include:

• "Your processor" verification calls. A caller claims to be from your current processor and needs to "verify" your account, bank details, or login. Hang up and call the number printed on your merchant statement instead.
• Rate bait-and-switch. An "agent" promises rock-bottom processing rates, then buries fees in the fine print or switches your account without authorization (known as slamming).
• Bogus PCI or "compliance" fees. Scammers invoice merchants for fake compliance programs. Verify any PCI-related charge directly with your processor before paying.
• Equipment leasing traps. Long, non-cancellable leases for inexpensive terminals that cost many times the hardware's value over the term.
• Fake chargeback or settlement notices. Lookalike emails claiming a dispute or held settlement, linking to a credential-harvesting page.

A legitimate provider will put its pricing in writing, won't demand credentials or one-time codes, and won't pressure you to act before you can verify.

Signs of Merchant Account Fraud

Merchant account fraud often starts with a successful phish. Watch for these warning signs in your processing account:

• Logins, new users, or permission changes you don't recognize
• Unexpected edits to deposit bank accounts or payout schedules
• Refund spikes, off-hours transaction batches, or settlement totals that don't match your records
• A sudden surge in disputes — pair your monitoring with chargeback management tools so you catch problems before card-brand thresholds are breached

Reconcile statements weekly, restrict dashboard access to the people who need it, and require multi-factor authentication on every payments-related login.

Who's Most Likely to Be Targeted?

Attackers focus wherever compromised accounts are most likely to hold funds: financial services, payment services, online services, and ecommerce. Businesses that process card payments for others — and verticals like tech support merchant account solutions — are attractive precisely because their accounts move money daily. High-risk merchants also face extra scrutiny from processors, which scammers exploit with fake "compliance review" and "account verification" messages.

How Merchants Can Protect Themselves and Their Customers

• Create a master list of account numbers. Keep every vendor and processor account number in one controlled file. Before anyone pays an emailed invoice, compare it against the master list.
• Examine the sender's address. Hover over the display name to reveal the real address, and treat lookalike domains as hostile.
• Watch the tone. Urgency, threats, and "act now" language are hallmarks of a phish. When in doubt, delete and verify through a known channel.
• Train your team. Run periodic phishing simulations, coach the people who click, and make it easy to report suspicious messages without blame.
• Harden your storefront. Keep platforms and plugins updated, review third-party scripts on checkout pages, and monitor for unauthorized code changes.
• Verify out-of-band. Any request to change bank details, credentials, or payout settings should be confirmed by phone using a number you already have on file.

Leverage Technology to Close the Gaps

Common sense stops many attacks; technology closes the rest. Use a fraud detection solution that combines machine learning with human review, enable address and CVV verification, and tokenize stored payment data. Working with an experienced ecommerce payment processing provider gives you access to these tools plus account monitoring that flags unusual activity early — which means fewer false declines, fewer chargebacks, and more approved revenue.

What to Do If You've Been Phished

• Rotate credentials. Change compromised passwords immediately and turn on multi-factor authentication everywhere it's offered.
• Contact your processor and bank. Use verified numbers to freeze account changes and review recent activity.
• Scan your storefront. Look for injected scripts, unfamiliar plugins, and unauthorized admin users.
• Document everything. Notify affected customers if cardholder data may have been exposed.
• Report the incident. File reports with the FTC and the FBI's Internet Crime Complaint Center (IC3).