They Copied My Website, Stole My Traffic, and Outsold Me—Here’s How I Fought Back

So here’s the gist.

I run a fairly successful online fashion store based in Lagos—Instagram, Shopify, the whole shebang.

We deal in trendy two-pieces, Ankara fits, and those feather-styled luxury robes that influencers love to flaunt in hotel mirrors. Business was booming. Orders were flying in from all over—Abuja, Accra, even some surprise ones from the UK.

The secret? I had my e-commerce strategy locked down. SEO-optimized product descriptions, proper Facebook pixel tracking, and I reinvested every naira. I was even ranking on Google for keywords like “affordable luxury loungewear Nigeria” and “buy Ankara robes online”. My digital marketing game was strong.

Or so I thought.

About three weeks ago, I noticed something strange. Cart abandonments increased. Shopify was still pinging with orders, but several customers were messaging my business page asking, “I paid, where’s my delivery?” One even said, “Why did I get an empty box with just pure water in it?”

Confused, I checked my backend. The orders were showing as fulfilled, but the tracking numbers were bogus. I called my dispatch company—same guys I’d been using for over a year.

They swore up and down that they never received the last batch of packages.

That’s when my stomach sank.

I called my assistant—Debbie.

No answer.

Called again.

Switched off.

I went to her house in Surulere. Neighbors said she hadn’t been home for two days.

Now here’s the thing—Debbie was the only one who had access to my Shopify admin, the inventory, and the logistics chain. She handled customer service too. She even processed refunds and had the business email on her phone. I trusted her like a younger sister. Even introduced her to my mum.

At first, I thought she had been kidnapped or something. Then I checked the business bank account.

₦1.7 million was gone.

Not transferred. Not spent.

Withdrawn. In cash. In chunks.

Still trying to wrap my head around it, I went through my Gmail security logs.

Someone had added their own number to the password recovery settings.

Guess whose?

Debbie’s.

Turns out, she created a duplicate Shopify store, cloned my theme and products, ran her own ads using MY creatives, and was redirecting my top-ranking product links from Google search to her fake site using a DNS switch.

I didn’t even know that was possible.

I was running ads, spending over ₦70k weekly boosting my real store—yet all the traffic was landing on her clone.

And the worst part?

She made the site look slightly glitchy on purpose. When people complained, she blamed Shopify and promised refunds—which never came.

I reported to the police. They asked for proof. I showed them.

They asked, “How old is she?”

I said 23.

They sighed and said, “These Gen Z girls no dey fear God again.”

Till today, Debbie is nowhere to be found.

She blocked me everywhere. Even on Pinterest.

But here’s the kicker—last week, a customer tagged me in a video. A boutique in Enugu.

Guess who was on the shop’s soft opening banner?

Debbie.

Smiling. Wearing MY feather robe. Using MY logo.

So yes, I lost ₦1.7 million. But I also learned the most painful rule in e-commerce and online business:

iNever give full admin access to someone who knows Canva, codes a little, and calls you “sis.”

I’m now rebuilding my brand. Stronger systems. Tighter passwords. Verified plugins. Limited access.

Because in the world of online business, trust isn’t a strategy—security is.