E-commerce
July 1, 2026
A customer may suspect a hack when they see an unknown order, a modified email, a strange device, or a payment attempt. In these moments, they expect a quick and secure response.
The chatbot must recognize the urgency, advise on initial security actions, and immediately transfer sensitive cases. It must not ask for passwords, bank codes, or unnecessary information in the conversation.
This guide shows how to handle a suspected hacked account with method and caution.
Summary
Why is the first response critical?
The customer may be worried about their money, personal data, and orders. A response that is too slow or too vague increases panic and can allow time for a fraudulent action to continue.
The chatbot must therefore recognize the risk, guide basic actions, and transfer to security support without delay.
Faced with a potentially hacked account, the chatbot must protect before diagnosing.
Convert over 2,000 customers on average per month with Qstomy.
The world’s 1st Shopify AI dedicated to customer conversion
Empowering 200+ e-commerce merchants
Which signals should be recognized?
Frequent signals are an unknown command, an email change, a password reset without a request, an added address, a payment method used, an unknown device, or unusual notifications.
The bot must also recognize urgent formulations: “it wasn’t me”, “my account has been taken”, “I have been charged”, “I no longer have access”.
What actions should be recommended?
If the customer still has access to the account, the chatbot can recommend changing the password, disconnecting devices, checking orders, and enabling additional security if available.
It should also recommend contacting the bank if an unauthorized payment is suspected, while transferring the case to the shop side.
How do I manage lost access?
If the customer no longer has access to the account, the bot must direct them to the secure procedure. It must not reveal order information or modify an email without verification.
The priority is to prevent further actions and to have the account reclaimed by the rightful owner.
How do I handle suspicious orders?
An unknown order must be checked quickly: status, address, payment, cancellation possibility, carrier, and lead time before shipment. The bot can collect visible evidence, but the action must often be human.
If the order has already been shipped, support will have to decide on the next steps according to the anti-fraud rules.
Which flow to follow?
The flow must mitigate the risk immediately.
Identify the account, current access, suspicious signal, order, payment, email, and device concerned.
Remind never to share passwords, bank codes, or verification codes.
Advise safe actions: change password, log out of sessions, check bank.
Collect useful evidence without exposing sensitive data in the chat.
Prioritize transferring unknown orders, payments, modified emails, lost access, and fraud.
Which messages should be used?
To reassure: "I understand the urgency. We will secure the account and forward the file to the relevant support team."
For security: "Do not share your password, verification codes, or card details here."
For orders: "If an unknown order appears, I will immediately forward the information to check if action can still be taken."
When to transfer?
Transfer is necessary in almost all cases of real suspicion: lost access, changed email, payment, unknown order, modified address, unknown device, or highly anxious customer.
The bot must transmit the account, signal, order, date, device, email, actions already attempted, urgency, and financial risk.
Which KPIs should be monitored?
Track suspected hacking, recovered accounts, timely canceled orders, disputed payments, handling times, reopenings, and post-resolution satisfaction.
This data helps improve protections and alert messages.
Which mistakes should be avoided?
Avoid downplaying the alert, asking for secrets, revealing information without verification, advising a new payment, or treating the situation as a simple connection issue.
The chatbot must act as a first security filter, not as an improvised investigator.
improvised investigator.
How can Qstomy help?
Qstomy can connect the chatbot to quotes, orders, customer accounts, security rules, privacy procedures, email changes, account merges, and support teams to answer clearly, then transfer sensitive cases with an actionable summary.
The chatbot helps the customer move forward without inventing a custom price, an effective deletion, an identity verification, a proof of hacking, or a data merger that still needs to be confirmed by a reliable and secure source.
Explore AI support, the AI sales agent, or request a demo.
Key takeaways
Key takeaways
A suspected hacked account must be handled quickly with security securing, careful collection, and priority escalation.
What the customer must understand
The customer must know what to do immediately without sharing sensitive data in the chat.
The chatbot's limit
The chatbot can guide on the first safe actions, but it must escalate lost access, payments, unknown orders, and suspicious changes.
Enzo
July 1, 2026
