How to remove a Shopify-hosted fake storefront with a DMCA notice

A fake storefront on Shopify hosting is easy to recognize and easy to underestimate. Your product photos. Your descriptions, sometimes with your own typos intact. A domain one character off yours. And a checkout that takes real cards from real customers who think they are buying from you.

That checkout ends one of two ways. Either the card number goes somewhere it should not, or a knockoff ships in your product’s place. Both endings come back to you. The buyer believes they bought from your brand, so the complaint, the chargeback, and the one-star review all land on your name.

What a fake storefront is made of

The pattern repeats because it works and because it is cheap. Standing up a storefront takes an evening, and the parts are usually the same four:

• Stolen product photography. Your own images, re-uploaded at full resolution or hotlinked straight from your site.
• Copied product copy. Descriptions pasted wholesale, your brand name sometimes still sitting in the text.
• A lookalike domain. A hyphen variant, a TLD swap, a one-letter typo, or a bare myshopify.com subdomain.
• A discount that does the selling. A deep markdown, a countdown timer, and a checkout that works.

The business model behind the checkout varies. Some stores harvest payment data and ship nothing. Some ship a fake and keep the margin. A few do both. What never varies is whose demand they are trading on: the ad clicks, the rankings, and the reviews you already paid for.

The store does not wait to be found, either. The traffic usually arrives through paid social ads running your own creative, through comment spam under your posts, or through searches on your brand name plus the word discount. By the time a customer forwards you a screenshot and asks whether the sale is real, the store has already been selling.

There is one upside buried in this. When the storefront is Shopify-hosted, there is a single host to notify, and that host publishes exactly how it wants to be notified.

Why the Shopify path is worth taking

Shopify publishes its copyright policy and keeps dedicated intake forms for it: a copyright infringement notice for DMCA claims and a separate trademark or trade dress infringement notice. Both pages were checked on August 6, 2026. You are not hunting for a legal@ address and hoping. The intake exists, it is specific, and it asks for the statutory elements by name.

There is also a structural reason a proper notice gets attention. The DMCA’s hosting safe harbor (17 U.S.C. § 512(c)) shields a host from its users’ infringement only while the host responds expeditiously to valid notices. That is not a Shopify promise and it is not a timeline. It is the incentive the statute builds into every host that wants to keep its safe harbor. Your job is to file a notice proper enough that the incentive applies.

One caveat before you write anything: confirm the store actually is Shopify-hosted. A lookalike domain has a registrar too, and when the complaint is about the domain rather than the storefront content, the registrar can be the right recipient. We wrote a separate guide to that routing decision.

Capture the evidence before you file

File first and screenshot second, and you may have nothing to screenshot. A store that receives a notice can go password-gated, geo-blocked, or dark within the hour. Capture everything while the store is still confident:

• Full-page screenshots of the homepage, each infringing product page, and the checkout, with the capture date visible.
• The exact URL of every page you will cite. Deep links to the product pages, not just the homepage.
• Your originals, with where and when they were first published, so the notice can point at both sides.
• The hosting trail: the myshopify.com subdomain if one exists, DNS records, WHOIS results.
• An archived copy of the key pages, so the evidence outlives the store.

This is the same discipline platforms reward everywhere else. A notice that says the store stole your photos is an assertion. A notice with the original, the copy, the URL, and the date is a case. Our evidence-pack guide covers the full checklist.

What a proper DMCA notice contains

The statute (17 U.S.C. § 512(c)(3)) lists the elements, and Shopify’s form asks for them. A valid notice needs:

• Identification of the copyrighted work: the product photography, copy, or artwork that is yours, and where the original lives.
• Identification of the infringing material: the specific URLs on the copycat store, precise enough that the host can find and remove them.
• Your contact information: name, address, email.
• A good-faith statement: that you believe the use is not authorized by the copyright owner, its agent, or the law.
• An accuracy statement: that the information in the notice is accurate, and, under penalty of perjury, that you are authorized to act for the rights owner.
• A signature, physical or electronic.

Two of those carry weight beyond paperwork. The good-faith statement and the perjury language are what turn a complaint into a sworn instrument, and they are also the parts the law holds you to. And if the problem is your mark rather than copied content (a store trading on your brand name without reproducing your photos or copy), Shopify’s trademark form is the right intake, and the required elements differ.

One drafting note: when the whole store is a copy, it is tempting to write “the entire storefront” and stop. Name specific pages anyway. List the product pages that reproduce your photography one URL at a time, then note that the storefront as a whole reproduces your catalog. A reviewer who can click three links and see three thefts moves faster than one asked to audit a site.

§ 512(f): getting it wrong is not free

Section 512(f) creates liability for knowingly, materially misrepresenting that material is infringing. Aim a notice at a store that turns out to be a legitimate reseller with its own photography, and you can owe the target’s damages and legal fees. This is why file-on-everything is not a strategy, and why the review step before filing is not bureaucracy. We wrote about the statute and its case law separately, and about the review gate that keeps a takedown program on the right side of it.

The counter-notice reality

The store operator can respond. The DMCA gives the target a counter-notice path (§ 512(g)): if they swear the removal was a mistake and consent to federal jurisdiction, the host may restore the material after ten to fourteen business days unless you file a court action. Most copycats never do this. A counter-notice requires a real name, a real address, and consent to be sued, and operators who steal product photos are rarely eager to supply the first two.

The statute also requires hosts to maintain repeat-infringer policies (§ 512(i)): termination, in appropriate circumstances, of users who keep infringing. In practice your notices are still per-store, and the same operator’s next storefront is a new notice. Expect the pattern, and keep the monitoring on after the win.

How Brand Protector handles a Shopify-hosted fake storefront

Detection comes first, because you cannot file against a store you have not found. Brand Protector’s lookalike-domain monitoring generates the permutations of your domain (typos, hyphen variants, TLD swaps, homoglyphs), puts high-risk unregistered names on a daily watch, and classifies the ones that resolve: parked, active storefront, or suspected phishing.

When a detection looks like a store, the hosting gets assessed: a CNAME under myshopify.com is definitive, an address in Shopify’s IP range is strong, and page signals fill in the rest. The assessment is recorded with a reason and a strength, not a guess. When it supports Shopify, the draft notice routes to Shopify’s own intake, and the claim type picks the form: copyright complaints to the copyright notice, trademark complaints to the trademark notice, with a field guide mapping your evidence onto the form’s actual fields.

Nothing files itself. Every notice passes the same gate: an AI confirmation pass, a human review of the evidence, and an explicit authorization in which the operator confirms the exact domain being reported. And because Shopify’s intake is a form on Shopify’s site, the package is marked prepared, not submitted: you file it on Shopify’s form, complete the declaration there, and the record advances only when the filing is reported back. That distinction is not pedantry; it is what keeps the case history true. The full workflow is on the Shopify DMCA takedowns page.

You review. You approve. You file it on Shopify’s form. Shopify decides what happens to the store, and nobody honest will promise you more than that. What you can control is the quality of the notice, the evidence behind it, and how fast the next copycat gets found. That last part is ours.