FROM CACHE - en_header

Bad customer records being stored daily

6 0 4

We are getting 10-15 bogus customer records stored daily from 'bots' I am told.

I have seen a few old comments on the subject, and they state that they won't 'hurt anything'.

However, having hundreds of bogus customer records in our database, the customer information on the dashboard becomes pretty meaningless. 


Does anyone know if Shopify is working to cut this down if not eliminate it?  I had to subscribe to an app and pay to have it done.  I believe this is Shopify's responsibility.  The third party app actually grabs the data and sends it to their servers to 'test' it and then sends it back.  I don't like potential customer information to be sent outside of the shopify infrastructure with the potential of them storing it for their benefit.  It just doesn't seem right.


Any insight is greatly appreciated.



Replies 11 (11)
Shopify Staff (Retired)
Shopify Staff (Retired)
1260 90 212

Hi, there!


I appreciate you sharing your concerns about these fake customer records being created on your store, and I can understand how this can make your admin overcrowded and very confusing.


As you might already know, these fake customer records are created by bots, and they do not have any impact on your store as they will not be able to checkout.


They can leave records of abandoned checkouts behind because of this. There are a few ways you can prevent more fake records from being created:


 1. Restrict customer account sign-up and require for customers to login at checkout. This will decrease the number of abandoned checkouts left behind by the bots as they would need to login to their account to proceed. You can set-up accounts to be disabled/required by going into Settings > Checkout. Here’s our help doc with all of the steps: Enable or disable customer accounts.

 2. Set a storefront password - This would only allow those with a storefront password to access your store, preventing any bots from going through your storefront and to the checkout.


To add another step of security to prevent fake accounts and records, you can use an app like Shop Protector to monitor the traffic to your store and block suspicious activity.


I would be happy to take up your feedback to our developers so that they are aware we should look into ways of decreasing/eliminating fake customer records from being created. We value your feedback very much as it helps us make improvements to the platform! If the feature is developed, we will make the announcement here.


Let me know if that helps!

Tira | Social Care @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit the Shopify Help Center or the Shopify Blog

6 0 4
Thank you for your response.
We are new customers of Shopify, and this issue has left us a bit *skeptical
of Shopify's frameworks & security*. I am spending more time on verifying
that things are running correctly rather than looking into how I can build
my business using Shopify's offerings.

Regarding the recommendations you provided:
1. There were no abandoned carts left by these bots. We were told that
adding captcha as an additional layer of scrutiny in these customer create
routines would help. We do that on all points in the system were one has
access to store a customer rec. *This does nothing. *I don't understand
how bots get past these as it is supposed to 'weed out' non humans.
3. Setting a storefront password? I don't believe this is a viable
solution by a company who hosts e-commerce business solutions. I wouldn't
even suggest this.

Yes, a few more customer records stored by bots does not cause a problem.
However, when you are getting >100 customers *a WEEK* stored, it is clearly
an issue with Shopify's framework. We need to do some extra things with
our customer records, and to have to wade through hundreds of bad ones to
get to the 'real' ones is just *more* time we have to spend figuring out
*bad* data. The fact that this has been going on for years (I have seen
comments in the 'community' dating that far back) shows us that it is
definitely NOT a Shopify priority. That is pretty discouraging. We have
been on the system only a little over a month, and seeing something like
this happening has me checking to make sure that every part of this store
is working correctly instead of digging into what Shopify has to offer to
help my business.

Yes, we have subscribed to* Shop Protector*. I am not crazy about third
party software that literally captures potential customer information,
sends it over to *their *server for analysis, then sends it back only if it
is valid. What do they with that valid customer info? Do they keep it?
Do they sell it? It just leaves another level of uncertainty on how
things 'work'. Leaving us to figure it out.

*We want to spend our time learning how to use Shopify's features to make
us and Shopify successful. *
*Instead we were fighting fires (deleting customers every morning) and
researching if the system is working correctly.*

Having to pay extra for a software that is 'covering' for a major problem
with Shopify processing, is concerning. If they can code for this....why
can't Shopify?

I truly hope greater consideration is given to resolving this issue and I
can stop paying outside vendors to fix Shopify's problem. I want to spend
money of building my business.
Thank you.
3 0 1

I am also having this problem. Additionally I have gotten an email from google claiming that there is malware on my site.

Maybe they aren't related, but this bogus customer thing should NOT be something that we have to buy an app to fix.

Shopify seems to me to be mostly a way to sell third party apps that really should be part of the core function of the website.

This constant selling of apps to fix the deficiencies of the website is getting very old.

This should be fixed by shopify, now.

Shopify Staff (Retired)
Shopify Staff (Retired)
1260 90 212

Thank you Dee12 and jimbarber for your additional feedback. I understand that this has been a roadblock for you both and I really appreciate you reaching out and telling us how we can do better. We definitely want to help you with focusing more on building your business, and I have passed your concerns on this and additional thoughts to our developers team, so that we can work on improving Shopify for everyone.


I did some further research after reading both of your comments. I can definitely understand the frustration on captcha, and wanted to share what I found, and shed some light on reCAPTCHA, which is the kind of captcha we have enabled on customer account creation, as well as on the contact and newsletter forms. It is also developed by Google, and you can learn more about it here.


The reCAPTCHA will appear when there is more than 1 customer account creation attempt in a 24-hour cycle made from the same IP. For the contact and newsletter forms, it will enable when there are two or more actions that could post to these forms using the same IP within 24 hours.


The reCAPTCHA would either show a checkbox to confirm that the user is not a robot, or a more challenging option that requires the user to look at an array of photos and check off the ones with similar characteristics. For example, “pick all of the traffic lights” could be an option. The more challenging option will appear if there is a high spam from that IP, or if the user is using incognito mode through their browser.


You do bring up a good point that my recommendations may not be for everyone, and for certain business/stores, they can help. I understand that you’re using Shop Protector. If you do have any questions about the information being sent to the third-party developers, you can always contact them to ask for additional information at:  


jimbarber, did the email you received from Google mention any further details about the malware it detected on your store? Let me know, I would be happy to look into this further with our team for you!

Tira | Social Care @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit the Shopify Help Center or the Shopify Blog

6 0 4

Thanks Tira,


The reCaptcha item is interesting.  Is this 'active' automatically or do we need to do something to 'activate' it?  Is there a way I can tell?

I do not know how I could check to see if any of those bad customer recs were coming from the same IP address or not.  If there is a way I can
tell, I would appreciate knowing how.  Thx. 


If reCaptcha has been up and running for a while, then it did not help much, since up to about 4 days ago, I was getting 10-15 bad custs a day
stored when the Shop Protector pgm wasn't working on my site.  I guess that means that alot of the customer recs were coming from multiple IP
addresses (or they masked them to look like it). 

Does Shopify notify their customers when they install new features like that so that we might stop having to pay third parties?  If so, where does one
go to see notifications like this?


Again, thanks for the additional info.  Bottom line . . .  I am still paying extra for an app to stop bad data when I budgeted $$ to put towards enhancing what I could do for my customers...

Shopify Staff (Retired)
Shopify Staff (Retired)
1260 90 212

You’re welcome, Dee12.


That’s a great question! The reCAPTCHA is active on all stores and helps to prevent the creation of spam accounts by the same IP address. You can test it out by performing the same action on the same IP within 24 hours as I mentioned in my previous reply.


You do bring a valid point that it’s possible multiple IP addresses (or masked ones) are being used when the accounts are created. It’s also possible that these are humans creating some of the spam accounts on your store, and they can bypass the reCAPTCHA from triggering if they are using multiple IPs.


Our changelog includes any features/updates to the platform. We also include updates in your admin dashboard, too! You can view our changelog here.


If you have any other feedback for me to pass along, just let me know!

Tira | Social Care @ Shopify 
 - Was my reply helpful? Click Like to let me know! 
 - Was your question answered? Mark it as an Accepted Solution
 - To learn more visit the Shopify Help Center or the Shopify Blog

New Member
1 0 0

I'm having the same problem, and it's obvious that the Shopify reCaptcha solution is not adequate.  When Shopify store owners tell you that we're getting dozens of fake customers coming in daily, does it really make sense to tell us that Shopify has an existing feature to help with spam?  If that existing feature were enough, we wouldn't be having these problems.  I've been to every spam/bot-related post on the community forum, and I cannot find a solution to this problem.  I can't even figure out how to enable Google reCaptcha v3 on my forms without paying for an app.  This really needs to be at the top of Shopify's to-do list.  

6 0 4
We have solved the problem by paying $5/month for the app Shop Protector.
It has stopped 99.9% of the bogus customer records being stored.
Unfortunately, Shopify still does not feel this is an important enough
issue to resolve.

You might want to give it a try. Good luck!
27 2 9

No, they KNOW it's important. Shopify is created to sell apps, not deliver reliable framework. I am beginning to realize this, and looking to move on from Shopify.


Starting to feel like the vBulletin of Ecommerce, except they control their own from the get-go, collecting royalties from app sales. Why fix something  when their customers will pay for an app that THEY themselves profit from?

New Member
1 0 0

We had a Mark Mustermann sign up as a customer last night 47 times! Seriously? All different addresses. All email starting with fake - and all with the same phone number. 

What gives?

10 0 14

Same just happened to me.  10 fake accounts from "Mark Mustermann" using different physical addresses and email addresses with the form: where the XXXXX is different random digits each time.  If you Google Mark Mustermann, that same name has been used for 6+ years to create fake accounts on different platforms. 


I created a support case with Shopify support to suggest that they should be able to EASILY filter out this kind of crap, and of course I was told the standard: "you should use a third party security app", and "I will pass this along to our developers."  Broken record at this point for anything a store owner brings up that should already be a basic capability of Shopify.  Think of it as the most basic spam filter that doesn't need sophisticated logic to detect this kind of obvious abuse.  


I refuse to install any more apps, since I don't trust their data access, and I've had apps in the past that have negatively affected my store's performance and also spammed a huge chunk of my customer list due to a "developer error."