Shopify Spam Customer Accounts with Real Email Addresses

New Member
1 0 6

To add to this list, we are also having the same issue.

 

It is not the contact form, in fact our site is extremely simple. 

 

This is the Account Registration form.  I deleted 41 accounts where the names were gibberish and the emails were real people.

 

Shopify - if you don't take care of this issue, domains will start to auto-block any notifications coming from the *.shopify.com address, including registration and sales emails.

6 Likes
Tourist
9 0 14

I just deleted 7 accounts in my store that were created in the last 24 hours. These are customer accounts, not contact form fills. 

4 Likes
Tourist
3 0 5
I had another web store for years until a few months ago, and never had these issues. I am considering closing my Shopify store and advertising my reasons on Facebook, unless Shopify remedies the problem.
3 Likes
Excursionist
12 0 13

Shopify, I assume your following this. Is there an easy way to just turn off "Customer Account Welcome" emails? I assume who ever is doing this is using that notice to test emails they have taken control of.

2 Likes
New Member
1 0 8

Add my company to the list unhappy Shopify customers wanting a resolution.  This is clearly a known issue, but it's not clear Shopify is taking seriously. When I asked Shopify support about it a few weeks ago, they suggested Captcha on our registration form.  We tried that but the bot fake accounts kept coming.  So we disabled the form, still they kept coming.  I contacted Shopify Support again and asked them to identify the source.  They responded that the bots are coming through Shopify API, and in an apparently rehearsed response, said essentially it's minor issue that we just have to deal with.  Specifically, the tech said this:  "Our aim is to prevent bot sign-ups, but bots are a part of the online (internet) reality and are constantly changing their behaviour so recognising this behaviour is not as straightforward as we would like it to be. However alarming the constant spam accounts might be, this has no material impact on your business as checkouts can't be completed by bots."   This is an unacceptable response, and this DOES have a material impact on our business: littering our interface and reporting, spurring fake accounts elsewhere in our connected apps, and wasting employee time working to remove them via the cumbersome “remove personal data” process (the only way to really remove the fake accounts).  Even if this were a mere minor annoyance to our business, this is a real security concern for the people whose stolen email addresses are being injected into our records without their permission (the accounts may be fake, but the email addresses within them are real). And as others have noted on this thread, the automated account completion email Shopify sends out is going to get our domain blacklisted as a spammer. 

 

Shopify, if you are paying attention to this thread, please prioritize and fix this problem. 

8 Likes
Tourist
8 0 16
Again - After my original post, I added the app "Shop Protector" and it has
worked for me. I agree we should not be forced to purchase an app to solve
this problem.
2 Likes
Excursionist
11 0 21

I have just been on to support. Here is the transcript. They are "aware" and trying to develop a solution. 

----

Dan Kevin C:  From what I understand, you're seeing fake spam accounts created by bots
Me:  Yes.
Dan Kevin C:  Thanks for that link. Let me read through the discussion real quick.
Dan Kevin C:  Thanks for waiting
Me:  n.p.
Dan Kevin C:  I understand that it can be worrisome for you guys, but it should have no material impact on your business as checkouts can't be completed by bots
Dan Kevin C:  Our devs are aware and they're doing something about it
Dan Kevin C:  To prevent this, you can set a store password or restrict customer account sign up and require a customer account for checkout
Dan Kevin C:  If the signups have any consistency, like they're always coming from a certain name or email address, then a third-party app might be useful
Me:  There are two problems: (1) emails are going out to those email addresses from us which is not good for our reputation, and (2) it clutters up our customer list and adds fake emails to our email marketing list. It is a problem, as plenty of other people have commented on the thread I linked to and plenty of other threads. I am glad to hear you are doing something about it. I know there is an app that seems to solve the problem, but this seems like something Shopify should be taking care of.
Me:  A store password? Really?! Requiring a customer account for checkout I don't think will help either.
Dan Kevin C:  Requiring a customer account will help since checkouts can't be completed by bots
Dan Kevin C:  Only a real customer can checkout
Dan Kevin C:  Forget about having a store password
Dan Kevin C:  That's the least desirable option
Dan Kevin C:  Yes, our devs are doing something about this and hopefully
Dan Kevin C:  an update is rolled out soon to help merchants counter bot accounts
Me:  I am not getting fake orders, just fake customer accounts being created. That's why I don't think requiring an account to checkout will solve that problem.
Dan Kevin C:  The reason for that is
Dan Kevin C:  Shopify has an open API on the storefront that allows for the creation of customer accounts to support functions like newsletter signups
Dan Kevin C:  It's fully intended to work this way, however the way it works also allows bots to freely create accounts
Dan Kevin C:  Our devs are working on a means of preventing these bot signups but as with all bots they are typically disguised as, or are actually using, normal browser traffic
Me:  Whatever you can do to urge the devs to solve the problem asap will be good. But I see this problem going back 3 years in the community discussions. So it is not new. And there is an app that people report is solving the problem, so surely Shopify devs can do something similar.
Me:  I look forward to hearing news. I presume it will be announced on the new release page.
Dan Kevin C:  Your feedback is noted
Dan Kevin C:  and this won't be unheard, I can assure you of that
Me:  Thanks. I will update that community thread so people know a solution is coming.
Dan Kevin C:  Yes, hopefully it comes out as soon as possible
Dan Kevin C:  Please do
Me:  Thanks for your time. Bye for now.
Dan Kevin C:  I appreciate you for doing that and for being an active community member
Dan Kevin C:  Bye for now. Have a good one.
6 Likes
Excursionist
15 0 21

 

I'm also encountering this problem, which started occurring for my website on 11th October.

 

Every day since then I need to delete a dozen or more of these fake customer accounts which have gibberish account names but real email addresses.

 

The concerning thing is that all of the real email address owners are getting an auto generated Customer Account Welcome email from my email address which they should not receive at all as they personally did not sign up - the bot who stole their email address did.

 

I have asked Shopify to disable the auto generated Customer Account Welcome email as I don't want it to go out at all while this issue exists, but they refuse to disable that email. They say it is a mandatory automatic email that goes out on account creations.

 

I understand that they are having great difficulty fixing this bot account creation issue, but it should be a really simple fix for them to allow shop owners to control whether or not they want the automatic email sent out on a new account creation.

I have received several notifications that my emails are being detected as spam and am very unimpressed that this is due to a problem that Shopify refuses to either acknowledge or care about. 


Shopify also seems to be not comprehending the real issue , as many of their responses refer to what to do about the Contact form - the issue here is nothing to do with the Contact form it is the Account Registration form that is being targeted by the bots.

 

Shopify please look into this and listen to what the real issue is here.

 

2 Likes
Shopify Partner
10 0 8

I'm having the same problem. It would seem there is a weakness in Shopify unfortunately.Screenshot 2019-11-01 at 7.22.05 AM.png

4 Likes
Tourist
3 0 5
I’m seriously leaning toward closing my Shopify store.
2 Likes