Lost Girls Vintage, a small Chicago vintage retailer, says its Shopify account was hijacked and used to open a line of credit that paid out more than $33,000 before anyone could stop it. Owner Kyla Embrey says a sudden flood of subscription emails buried the account's security alerts, letting the fraud ramp up fast. As the shop waits to find out whether its bank or Shopify will reverse the payouts, it is publicly warning other local retailers to lock down their accounts.
What the shop says happened
According to FOX 32 Chicago, Lost Girls described the incident on social media, saying attackers opened a line of credit in the business’s name through its compromised Shopify account. By the time the store or its bank managed to lock the card, $33,400 had already been paid out, a hit Embrey called "a death sentence for a small business." The shop told FOX it is waiting to see whether the charges will be reversed while it works with its bank and payment providers to reconcile the payments.
How Shopify's financial tools can move money
Shopify's own documentation ties its financial products directly to merchant accounts: Shopify Balance can hold merchant payouts and Shopify Capital repayments are withdrawn from Balance, which can make those funds immediately available for use, according to the Shopify Help Center. The company also instructs merchants to enable two-step authentication and other account security features to cut the risk of unauthorized access, per Shopify support guidance. In public filings, Shopify warns that products such as Shopify Balance and Shopify Capital increase exposure to unauthorized transactions and related losses, which can complicate recovery efforts after an account compromise, a risk noted in Shopify's SEC filing.
Owners' steps and tips for other sellers
Embrey and her co-owners urged other small-business operators to turn on two-factor authentication, avoid clicking login links in email, and call the number on the back of their card if they get suspicious phone calls from a bank, the owners told FOX 32 Chicago. Their warning was shared publicly while Lost Girls works with its bank and payment providers. The retailer, which launched in 2013, now runs multiple Chicago storefronts, according to the shop's website. The owners say their inbox was buried under subscription notifications that hid critical alerts, a detail they have flagged as a tactic used in account-takeover schemes.
What merchants should watch
Merchants are urged to treat sudden spikes in email volume or unexplained account changes as immediate red flags and to review login history and connected apps. Discussions on Shopify's community forums show other sellers reporting confusing Shopify Capital or payout activity, while Shopify's regulatory filings explicitly highlight the heightened fraud risk tied to on-platform financial products. Sellers who suspect an account takeover should secure logins with two-step authentication, contact their banks using official phone numbers, and open a support ticket with Shopify to report any unauthorized financing or payouts.
For Lost Girls, the fallout is both financial and operational as the owners work to safeguard customers' accounts and the future of the business. Embrey said the ordeal has left the team shaken but determined to use the experience to warn other retailers about how quickly an account takeover can spin out of control.
