Fake Stripe Merchant Recall Refund Scam
Criminals send fake notices to merchants claiming Stripe has initiated a batch recall refund to buyers and that merchants must verify their account to approve the refund disbursement.
Part of: Fake Product Recall Refund Scams
Last reviewed: 8 June 2026
Stripe processes payments on behalf of merchants, and when a merchant issues a bulk refund — for a product recall, a cancelled event, or a pricing error — Stripe facilitates those refunds from the merchant's Stripe balance. Scammers reverse this process by targeting merchants with fake notifications claiming Stripe has been notified of a recall affecting products sold through the merchant's Stripe-connected store, and that a batch refund disbursement will deduct $X from the merchant's payout unless they log in to dispute or modify it.
The fear of an unexpected large deduction from their payout drives merchants to act immediately. The login link leads to a fake Stripe Dashboard page. After entering credentials, merchants are shown a convincing fake payout schedule showing the deduction, which further reinforces the sense of reality, while the scammer takes over the real account in the background.
Real Stripe recall-related refunds are always visible in the Dashboard before any action is taken, and Stripe would not initiate a batch refund on a merchant's behalf without prior agreement.
How this scam works on the Stripe brand
The email arrives from stripenotifications.net or similar and states: 'Action required: A product safety recall has been flagged for items sold through your connected store. Stripe will automatically issue $[large amount] in refunds to affected buyers in 48 hours unless you review and dispute the claim. Log in to your Stripe Dashboard to manage this notification.' The link opens a fake Stripe login page.
After entering credentials, merchants see a fake pending-refund screen showing a list of fabricated orders and a large total refund amount. The screen offers two options: 'Approve All' or 'Dispute — Contact Support.' Clicking either option leads to a second credential-capture step.
Merchants who call the fake support number on the page are connected to a scammer who asks them to verify their identity by providing their Stripe API keys or the linked bank account details 'to hold the refund while the dispute is processed.'
Common red flags
- You receive an email about a Stripe recall refund disbursement from a domain other than stripe.com.
- The Stripe Dashboard does not show any corresponding recall notice when you log in directly.
- The email states that a large amount will automatically leave your account unless you log in immediately.
- The login link goes to a site other than dashboard.stripe.com.
- The 'Stripe support' phone number is not listed at stripe.com/contact.
- A Stripe agent asks for your API keys to 'hold' a refund — Stripe never requests API keys via support.
- The recall affects a product category your store does not sell.
How to protect yourself
- Access your Stripe Dashboard only by typing dashboard.stripe.com — never via email links.
- All Stripe-managed refunds are visible in the Dashboard before any funds move; check there first.
- Know that Stripe will never initiate a recall refund on your behalf without your prior consent.
- Enable Stripe email alerts for payout changes so you see genuine balance movements as they occur.
- Contact Stripe support through dashboard.stripe.com/contact, not through numbers in unsolicited emails.
How to report it
- Forward the phishing email to [email protected].
- Report to the FTC at reportfraud.ftc.gov.
- File with ic3.gov if account access or funds were compromised.
- Report to the CPSC at cpsc.gov if a real recall was impersonated.
- Report the phishing domain to Google Safe Browsing.
Frequently asked questions
Can Stripe initiate recall refunds without a merchant's instruction?
No. Refunds on Stripe are merchant-initiated (or initiated by Stripe under certain fraud conditions). Stripe does not execute batch recall refunds on a merchant's behalf without explicit instruction from the merchant.
How would I know if a genuine recall involved my Stripe products?
You would be contacted by the relevant regulatory authority or product manufacturer, and any Stripe-related refund actions would appear in your Dashboard. Stripe would not be the first point of contact for a product recall.
What is a Stripe API key and why should I never share it?
A Stripe API key grants programmatic access to your Stripe account, including the ability to initiate payouts and refunds. Sharing it with anyone is equivalent to giving them full control of your payment infrastructure. Stripe support will never ask for your API key.