We are getting 10-15 bogus customer records stored daily from 'bots' I am told.
I have seen a few old comments on the subject, and they state that they won't 'hurt anything'.
However, having hundreds of bogus customer records in our database, the customer information on the dashboard becomes pretty meaningless.
Does anyone know if Shopify is working to cut this down if not eliminate it? I had to subscribe to an app and pay to have it done. I believe this is Shopify's responsibility. The third party app actually grabs the data and sends it to their servers to 'test' it and then sends it back. I don't like potential customer information to be sent outside of the shopify infrastructure with the potential of them storing it for their benefit. It just doesn't seem right.
Any insight is greatly appreciated.
I appreciate you sharing your concerns about these fake customer records being created on your store, and I can understand how this can make your admin overcrowded and very confusing.
As you might already know, these fake customer records are created by bots, and they do not have any impact on your store as they will not be able to checkout.
They can leave records of abandoned checkouts behind because of this. There are a few ways you can prevent more fake records from being created:
1. Restrict customer account sign-up and require for customers to login at checkout. This will decrease the number of abandoned checkouts left behind by the bots as they would need to login to their account to proceed. You can set-up accounts to be disabled/required by going into Settings > Checkout. Here’s our help doc with all of the steps: Enable or disable customer accounts.
2. Set a storefront password - This would only allow those with a storefront password to access your store, preventing any bots from going through your storefront and to the checkout.
To add another step of security to prevent fake accounts and records, you can use an app like Shop Protector to monitor the traffic to your store and block suspicious activity.
I would be happy to take up your feedback to our developers so that they are aware we should look into ways of decreasing/eliminating fake customer records from being created. We value your feedback very much as it helps us make improvements to the platform! If the feature is developed, we will make the announcement here.
Let me know if that helps!
I am also having this problem. Additionally I have gotten an email from google claiming that there is malware on my site.
Maybe they aren't related, but this bogus customer thing should NOT be something that we have to buy an app to fix.
Shopify seems to me to be mostly a way to sell third party apps that really should be part of the core function of the website.
This constant selling of apps to fix the deficiencies of the website is getting very old.
This should be fixed by shopify, now.
Thank you Dee12 and jimbarber for your additional feedback. I understand that this has been a roadblock for you both and I really appreciate you reaching out and telling us how we can do better. We definitely want to help you with focusing more on building your business, and I have passed your concerns on this and additional thoughts to our developers team, so that we can work on improving Shopify for everyone.
I did some further research after reading both of your comments. I can definitely understand the frustration on captcha, and wanted to share what I found, and shed some light on reCAPTCHA, which is the kind of captcha we have enabled on customer account creation, as well as on the contact and newsletter forms. It is also developed by Google, and you can learn more about it here.
The reCAPTCHA will appear when there is more than 1 customer account creation attempt in a 24-hour cycle made from the same IP. For the contact and newsletter forms, it will enable when there are two or more actions that could post to these forms using the same IP within 24 hours.
The reCAPTCHA would either show a checkbox to confirm that the user is not a robot, or a more challenging option that requires the user to look at an array of photos and check off the ones with similar characteristics. For example, “pick all of the traffic lights” could be an option. The more challenging option will appear if there is a high spam from that IP, or if the user is using incognito mode through their browser.
You do bring up a good point that my recommendations may not be for everyone, and for certain business/stores, they can help. I understand that you’re using Shop Protector. If you do have any questions about the information being sent to the third-party developers, you can always contact them to ask for additional information at: firstname.lastname@example.org.
jimbarber, did the email you received from Google mention any further details about the malware it detected on your store? Let me know, I would be happy to look into this further with our team for you!
The reCaptcha item is interesting. Is this 'active' automatically or do we need to do something to 'activate' it? Is there a way I can tell?
I do not know how I could check to see if any of those bad customer recs were coming from the same IP address or not. If there is a way I can
tell, I would appreciate knowing how. Thx.
If reCaptcha has been up and running for a while, then it did not help much, since up to about 4 days ago, I was getting 10-15 bad custs a day
stored when the Shop Protector pgm wasn't working on my site. I guess that means that alot of the customer recs were coming from multiple IP
addresses (or they masked them to look like it).
Does Shopify notify their customers when they install new features like that so that we might stop having to pay third parties? If so, where does one
go to see notifications like this?
Again, thanks for the additional info. Bottom line . . . I am still paying extra for an app to stop bad data when I budgeted $$ to put towards enhancing what I could do for my customers...
You’re welcome, Dee12.
That’s a great question! The reCAPTCHA is active on all stores and helps to prevent the creation of spam accounts by the same IP address. You can test it out by performing the same action on the same IP within 24 hours as I mentioned in my previous reply.
You do bring a valid point that it’s possible multiple IP addresses (or masked ones) are being used when the accounts are created. It’s also possible that these are humans creating some of the spam accounts on your store, and they can bypass the reCAPTCHA from triggering if they are using multiple IPs.
Our changelog includes any features/updates to the platform. We also include updates in your admin dashboard, too! You can view our changelog here.
If you have any other feedback for me to pass along, just let me know!
I'm having the same problem, and it's obvious that the Shopify reCaptcha solution is not adequate. When Shopify store owners tell you that we're getting dozens of fake customers coming in daily, does it really make sense to tell us that Shopify has an existing feature to help with spam? If that existing feature were enough, we wouldn't be having these problems. I've been to every spam/bot-related post on the community forum, and I cannot find a solution to this problem. I can't even figure out how to enable Google reCaptcha v3 on my forms without paying for an app. This really needs to be at the top of Shopify's to-do list.
No, they KNOW it's important. Shopify is created to sell apps, not deliver reliable framework. I am beginning to realize this, and looking to move on from Shopify.
Starting to feel like the vBulletin of Ecommerce, except they control their own vb.org from the get-go, collecting royalties from app sales. Why fix something when their customers will pay for an app that THEY themselves profit from?