Six breaking stories ran on Ecommerce Paradise today, and the biggest was three Shopify apps hijacked to send checkout clicks to fake payment pages.
This roundup is for ecommerce store owners, especially high-ticket Shopify operators, who want the day’s changes ranked by how much they affect your settings, budget and plans. Each item has the key number, what to do, and a link to the full breakdown.
1. Three Shopify Apps Hijacked to Fake Checkouts
Hulk Product Options, Selleasy and Swym Wishlist Plus were hijacked between October 10 and October 14 and used to redirect shoppers from the checkout button to fake card-harvesting pages, according to developer Roman Zipp and the app companies’ own statements. Logbase said the Selleasy window ran 7 hours and 13 minutes, and it claims more than 49,000 active stores use the app. Nobody has published how many shops were hit.
Why it matters: Your theme can be spotless while a vendor’s script runs on your checkout button, so every app you install is a vendor with a key to your storefront.
Do this: Test checkout from the product page, cart page, cart drawer and any quick-buy button in fresh private windows, and confirm the address bar stays on your domain.
2. Google Universal Cart Is Live: Audit Your Shopify Settings
Google launched Universal Cart in the US on October 15 across Search and the Gemini app. According to PPC Land, Google switched native checkout on for matched Shopify stores starting September 18, and Shopify’s help page says Google Analytics and custom pixels do not fire in that flow. Google has not said whether merchants pay anything on cart purchases.
Why it matters: Orders can close without the shopper ever seeing your checkout, so GA4 under-reports and your Shopping ads can look worse than they are. I would treat any ROAS dip since September 18 as suspect before cutting budget.
Do this: In your Shopify admin open Sales channels, then Agentic, decide per price tier whether direct checkout stays on, and compare GA4 revenue to Shopify orders since September 18.
3. Meta Terms Let It Crawl Your Store Site From Oct. 30
Meta’s new Commercial Terms take effect October 30 and let it crawl websites tied to your business accounts. Continued use of Meta’s tools counts as agreement. Outlets disagree on whether the AI-training sentence survived: Unite.AI reported it removed on October 17, while PPC Land’s October 18 capture still showed it. Meta also turns on product browsing in existing ads October 28.
Why it matters: The exposure is whatever sits behind a login or an unlisted URL, such as dealer pricing, quote pages and supplier files. I am not a lawyer, so take your dealer agreements to yours.
Do this: Save a dated copy of Section 1 of the terms today, then inventory every page behind a login or unlisted URL before October 28.
4. IRS Rule Lets It Take Card Tax Payments Directly
The IRS issued final regulations, T.D. 10060, on October 16 that let it accept credit and debit card tax payments directly and pass the processing fee to the payer. No fee has been published for the direct route. Today’s IRS processors charge 2.89% to 2.95% on commercial cards, which on a hypothetical $40,000 payment is $1,156 to $1,180.
Why it matters: A flat 2% cash back card loses to that fee unless a welcome bonus or points value makes up the gap. I am not a tax or financial advisor, so run your numbers with your CPA.
Do this: Compute the fee on your next estimated payment at both rates, and get your card issuer’s answer in writing on whether IRS payments earn rewards.
Hijacked apps, checkout defaults and platform terms all land on you when you run every piece of the store yourself, so want my team to build and run your high-ticket store for you? See the turnkey done-for-you service →
5. Amex Stops Pooling Points on New Cards
Amex now gives newly opened U.S. cards their own Membership Rewards account, according to Doctor of Credit and One Mile at a Time on October 15. View from the Wing reports that closing a card whose account is not linked can forfeit its points. Existing cards keep their current accounts, and whether business cards are covered is unclear in the sources.
Why it matters: If you open a card for the welcome bonus and cancel before the second annual fee, the points sit on the card you are about to close. I am not a financial advisor.
Do this: Log into Membership Rewards, open Manage Connections, and link your accounts before you close any card.
6. Southwest Ends Card Bonus Credit for Companion Pass
Southwest will stop counting card welcome bonuses toward the Companion Pass on January 1, 2027. Unlimited trips will come with Platinum status at 140,000 Tier Qualifying Points or 100 qualifying one-way flights, and Rapid Rewards cards earn 1 point per $1 spent. The Points Guy and Lazy Lauren report a December 2 approval cutoff for the old route, which Southwest’s own page does not repeat.
Why it matters: Spend now counts and bonuses do not, so the pass only pays off if your real card spend and paid flights justify it. I am not a financial advisor.
Do this: Pull 12 months of card spend, count your paid flights with a companion, and confirm the December 2 date on Southwest’s FAQ before you apply for anything.
Want to work through this week’s checkout, ad and card changes with other store owners and me inside the community? Join the Skool community →
That is today’s run. Tomorrow’s stories land through the day as they break, so start by testing your checkout tonight. Card, tax and terms items here are information only, and I am not a financial or legal advisor. Subscribe to the YouTube channel for daily breakdowns.
Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
