Shopify Spam Customer Accounts with Real Email Addresses

Tourist
9 0 10

I've been on other sites were you have to respond to an email to confirm your address before an account is created. This could solve the problem since the owners of the email did not create the account and would not respond.

4 Likes
Excursionist
13 0 16

Another thought, I have been getting emails for some time from "mailer@shopify" and they contain messages similar to this below, The response I got from support was that people are spoofing Shopify mail and I should not worry.  I was informed that I did not need to forward these emails to Shopify and just to delete them.  I wonder if they are linked?

Name:

Carl Cooper

Email:

Carl1991@mail2soldier.com

Body:

hi  my cousin placed an order from your site 75 days ago, but still didn't receive it..The following tracking seems not to work:http://tiny.cc/sis3fzany updates?nice day regards.Carl.

Phone:

6659633821

1 Like
Tourist
9 0 10

@MJC wrote:

Another thought, I have been getting emails for some time from "mailer@shopify" and they contain messages similar to this below, The response I got from support was that people are spoofing Shopify mail and I should not worry.  I was informed that I did not need to forward these emails to Shopify and just to delete them.  I wonder if they are linked?

Name:

Carl Cooper

Email:

Carl1991@mail2soldier.com

Body:

hi  my cousin placed an order from your site 75 days ago, but still didn't receive it..The following tracking seems not to work:http://tiny.cc/sis3fzany updates?nice day regards.Carl.

Phone:

6659633821


This is not related. It's a phishing email and I hope you didn't click on the link.

If you hover your curser over the from email address will show you the real from address and I'll guess it's not from Shopify.

0 Likes
Excursionist
13 0 16

Hi, Do not worry I did not click on the link, but when I hover over the email address it just show "mailer@shopify" Which is my area of concern however you are correct most emails of this sort will show a different email address and are easy to spot.

0 Likes
Highlighted
Tourist
4 0 4

@Jim_Harger1 wrote:

I've been on other sites were you have to respond to an email to confirm your address before an account is created. This could solve the problem since the owners of the email did not create the account and would not respond.


...that would be a nice fix, problem would be solved.

 

Would really love Shopify to implemented this (or really _any_ other solution) in their core product.

1 Like
New Member
3 0 0

We have been having this problem for sometime now and its a right pain. More and more undelivered mail returns and blocked by Yahoo mail made me look and found we had so many spam customer accounts so I have deleted them and disabled the customer account required option which removed the sign in and create account links on the homepage. We have had no new spam customer sign ups since then but it is not really the work around I would like. Shopify need to pull there finger out on this and enable some security on the create account sign up form.

0 Likes
Excursionist
13 0 4

It's about 10 weeks after Shopify's only response on this thread and I've just started having this same problem. Why is Shopify not taking care of this and expecting everyone to pay $5 a month for an app? No way. I will move my store before I pay for this type of protection. My store is new so I don't have a ton invested yet. Can anyone recommend another platform that offers the functionality of Recapture for subscriptions? 

2 Likes
Excursionist
27 0 15

As of last night, the spam accounts I'm finding no longer have gibberish names, but names that look on the surface to be real. However, when you click on the account there is no information except for email address. When I check stats at Statcounter, these bots are coming in most recently from servers registered in Switzerland, Sweden, and the Seychelles; and they are coming directly to my Create Account page. They are not even landing on the home page, or any other page. 

1 Like
Tourist
13 0 32

We're also having this issue and it's a serious problem for anyone that wants to be able to protect their domain from being marked as sending SPAM emails.

 

Shopify's Customer Service response is to state that this is an internet-wide issue and that it's just we must accept. I don't think Google or Yahoo will buy that line when they block all of our legitimate emails from reaching real customer inboxes.

 

The main issue is that we cannot prevent an automated 'confirm your email address' email from being sent out after an account creation request is submitted. The email address owner then receives an email that they didn't sign up for and we get a spam marker. If the email used is a honey-pot account then we get an even stronger response. Not only does it affect your domain through shopify's automated emails but also, if you have an integrated on-boarding system that welcomes customers after account creation, they may well also get roped in to this process, increasing your spam markers as the CRM system can't tell the difference between fake and real accounts (I'm looking at you, Drip.) It could also increase your subscription fee if you pay for CRM based on subscriber numbers.

 

We will be monitoring fake account sign ups until the end of the year. If there is no change in the situation then we'll be moving all of our stores to another platform. 

3 Likes
Tourist
13 0 32

We've not been able to find any evidence of the bot sessions in Google Analytics. We think they're using the Shopify API to request account creation. 

In our CRM system there are no IP addresses and no other information other than the fake name, the real email address and thats it. We're at a loss as to what we can do to block them. The $5 app is not the answer. (What if they're bots created by them?! You don't pay firemen for the number of fires they put out...)

3 Likes