Dealing with a cloned store
What to do if someone clones your Shopify store
Found a copy of your shop on another website? Follow these steps to record it, help customers find your real store and report the problem to the right service.
The starting point
Record the suspicious website and the specific material it uses, check your own store for signs of unauthorised access, and report through the service relevant to the problem. Your store being on Shopify does not mean the clone is.
Hypothetical example: a customer asks about an order you cannot find. The address on their confirmation looks almost like yours, and the page uses your logo and product photos. You may be dealing with a website impersonating your business, rather than a missed order in your own shop.
Work through the following steps in order. Keep the customer issue, the copied content and any account-security concerns in separate notes so each goes to the right person. An entire store clone needs a broader response than a single reused photograph.
1. Save the website address and specific examples
Ask for the exact domain and relevant page URLs. Record when the site was observed and preserve screenshots already available. Identify a few clear examples: your logo presented as the shop’s identity, an original product photograph, or a passage copied from your own story page. Pair each example with its original URL.
If customers have contacted you, note what confused them without distributing their personal information unnecessarily. You do not need their full payment-card details. Keep any order-confirmation evidence private and remove unrelated personal details from material shared for review.
Avoid entering login or payment information to test the other shop. The NCSC’s suspicious-site guidance advises against interacting with links or entering personal information on a suspected scam site. Existing URLs and observations can still support a report.
2. Check whether your real store has changed
Visit your Shopify admin through your usual trusted route. Check for unfamiliar users or changes to settings, domains, theme content and contact information. If something suggests unauthorised account access, contact Shopify Support through its official help centre and address that issue promptly.
A clone built from public images and text does not, on its own, prove that your account was breached. Be precise about what you found. Strengthening account access is sensible, but changing a password will not remove a copy hosted on a separate domain.
3. Tell customers how to identify your real shop
If people are being confused, place a concise notice on your own site and relevant social profiles. Give the official address and any authorised stockist information. Describe verified facts, such as a particular domain having no connection with your business, instead of guessing who operates it.
Give support staff a consistent reply. First check whether the order belongs to your business. If it does not, explain that you cannot see or manage that seller’s order. Encourage the customer to contact their payment provider through its official channels about an unrecognised or disputed purchase; do not promise a refund on another business’s behalf.
Edit here, then copy. Your edits stay in this page and are lost when you leave or reload.
4. Choose the reporting route for the actual problem
Confirm whether the other site uses Shopify before sending a Shopify-specific report. Copying the appearance of a Shopify shop does not establish where the copy is hosted. When you cannot confirm the platform, say so in the case notes rather than presenting a guess as fact.
Shopify distinguishes complaints about a purchase, alleged copyright infringement and merchant-policy violations. Use its official guidance to choose the relevant form. A rights-holder complaint about copied content is different from reporting an order you personally placed.
For a copyright complaint, identify the specific original works and reported pages and check your authority to act. A logo, a product design, written text and a photograph can raise different rights questions. Do not assume that every similar layout is protected in the same way. Seek qualified advice if you are unsure what rights apply.
5. Report suspected phishing through the relevant abuse process
For a domain being used for suspected phishing or other abuse, ICANN’s guidance explains how to identify the registrar and its abuse contact. A registrar manages domain registration; it is not necessarily the website’s host. Use the provider’s published process and describe the observed behaviour. A registrar report does not guarantee removal and is not a substitute for the appropriate copyright process.
The NCSC also accepts reports of suspected scam websites. If you are reporting a crime or financial loss, follow its separate signposting for the appropriate reporting service. Keep reference numbers from each route so you can distinguish a report you submitted from a decision a provider has made.
6. Keep a record of responses and further sightings
Log the date, recipient and reference for each report. Record observable changes when checked: the page is unavailable, a photograph has changed, or the domain now redirects. Do not assume the reason for a disappearance, or that a new domain belongs to the same operator without supporting evidence.
Keep checking important product images and brand searches after the first report. Copywatch can help find and organise possible product matches from a selected Shopify catalogue. It does not take down whole stores, contact providers automatically or provide complete domain-impersonation monitoring.
Less searching. More creating.
Check where your product images turn up
Try a sample product scan from your Shopify store, then review any possible matches before deciding what to do.
Try a sample store scanOne example product. No sign-in required for the initial scan.