Shop verification code: what that text means

What Shop Pay is, and why it has your number

Shop Pay is Shopify’s checkout wallet. Shopify runs the shop software behind a very large number of independent online stores, and Shop Pay is the box on a checkout page offering to remember your card and address so the next store does not ask again. If you have ever ticked that box anywhere, your number is in it, and every store using Shopify can then send you a code.

That is the ordinary reason a company whose name you do not recognise is texting you: you never signed up to anything called Shop, you agreed to a faster checkout at one store, once.

Shop’s own help page lists three situations that produce a code. “You’re using the same device that you used to opt in for the first time after setting up your account.” “You’re using a new device or a new browser.” “At checkout, you select Shop Pay.” It then describes the mechanics: “When you need to verify your account during checkout, you receive a verification code by SMS to the mobile phone number that’s associated with your account.”

All three of those assume you asked for it, and the reason you are reading this is almost certainly that you did not. That case is not on the page. It is on a different page of Shopify’s, which does not appear anywhere in the search results for this question, and which is the most useful thing here.

The code you did not ask for, in Shopify’s own words

Shopify runs an opt-out page for exactly this, and it opens by asking the reader’s own question back: “Have you received an unsolicited SMS containing Shop Pay verification code?” Its answer is the same one Stripe gives for its own wallet: “Most likely someone typed your phone number by mistake.”

Shopify calls that the likely explanation, and it is a dull one, which is the good news. Somebody a few digits away from you was buying something, mistyped, and their code came to you. Their purchase failed. Nothing of yours was touched, because the code alone does nothing — it is the second half of a pair, and whoever mistyped does not have the first half either.

The case worth separating out is a code that keeps coming back. One stray message is a typing error. The same message several times over several days is something repeatedly asking for a code against your number, and that is what an attempt to sign in looks like from the receiving end. It does not mean anybody has got in; it means somebody is trying, and the useful response is on the account rather than on the message: change the password there and anywhere it is reused, and check whether the address involved has turned up in a known data breach, because that is usually where the attempt comes from.

Two different messages arrive from the same number

This is the detail that makes the sending number useless as evidence, and it is stated on Shop’s help page rather than inferred here.

A checkout code reads, in Shopify’s own transcription, “XXXXXX is your Shop verification code”. A different message reads “Enter XXXXXX as your Shopify authentication code”, and that one is not about a purchase at all: it is the two-step login code for a Shopify admin account, the kind a person running a store has. The help page adds the part that matters: “you might receive verification codes from the same phone number that the Shopify authentication codes are sent from.”

So two messages meaning two different things, about two different accounts, share a sender. Reading the sender tells you nothing at all; reading the six words at the start of the message tells you which account somebody is touching. If it is the second wording and you do not run a store, that is the more interesting of the two.

Shop also documents a second delivery route: “Alternatively, you can choose to verify your account by an email sent to the primary email that you use for Shop Pay.” If codes are arriving in an inbox rather than by text, that is why, and the same reasoning applies to them.

How to make them stop without replying to anything

Shopify publishes a page for this and it does not appear in the search results for the question it answers. On it you enter the mobile number yourself, and the page states plainly what happens next: opting out will “Stop sending you Shop Pay verification codes” and “Delete your phone number and any data associated with it”.

Two things are worth noticing about that. It removes the cause rather than filtering the symptom, and it never requires you to answer a message from a number you do not recognise. Replying is the habit worth breaking generally: a reply tells whoever is at the other end that the number reaches a real person who reads texts, which is exactly the fact a list of numbers is sold on.

Blocking the sender is the other instinct, and it is weaker than it looks. Codes travel over short codes that get rotated, so blocking one silences the next genuine code you actually need while the unwanted ones arrive from somewhere else.

And this should not have been happening in the first place. The industry rulebook for these messages, CTIA’s Short Code Monitoring Program Handbook, is explicit: “Unsolicited messages should not be transmitted using Short Codes.” The same section extends that to messages delivered without consent and to messages sent after somebody has opted out. A code generated by a stranger’s typing error is an edge the rule does not cover cleanly, which is precisely why the opt-out form exists.