Dealing with potential spam in abandoned carts: should I be concerned?

[ColonyMa]

I have a fake name in my abandoned cart leaving fake email, fake address and fake phone number. Over 50 occurrences over a two week period. Should I be concerned? Do I need a special app to stop this.

Thank you for your help. 

[Victor · Accepted solution]

Hi @ColonyMa,

Thank you for reaching out. I understand that this can be concerning but it's good that you have recognized these spam checkouts. Be sure to keep an eye out for any potentially fraudulent or fake orders that are placed even if at this time they appear to only be abandoning their carts at checkout.

This happens to many merchants and is not an immediate cause for concern as bot activity can be common on online stores. If you head to the "Spam protection" section in Online Store > Preferences, you'll be able to enable Google reCAPTCHA on various pages on your store:

While this cannot prevent bots from accessing your checkout, it can prevent them from sending spam messages and creating accounts on the site.

There are also some third-party apps that can prevent bot activity on your site, such as Negate - Bot Protection and Shop Protector. These apps do come with a monthly charge but may be worth it if you feel that these spam checkouts are becoming a headache for your store.

Moving forward, I'd recommend being on high alert with regards to fraudulent orders coming in. This may just be bot behaviour on the checkout that won't result in orders being placed but it's good to be aware of the telltale signs of fake and fraudulent orders in general. Be sure to refer to our fraud analysis tool whenever an order comes in incase there are any potentially worrisome signs and you can also check out our documentation on fraud prevention to learn of other ways to protect yourself against potential scams.

I hope this helps but please let me know if you've any other questions.

[ColonyMa]

Thank you Victor,

I should say that the fake order is not placing any items in the cart.  We do use Captcha but will check that it is on all checkouts.

Rick

[JOHI]

Hi Victor, your input is helpful, but is there a reason that Shopify does not have greater built-in protections for this issue? I am frustrated that we're expected to pay extra for what seems to be a basic user experience and fraud protection issue.   

Thanks for your input.

[Steve82]

We had over 5,300 abandoned carts since 1/26 and almost 200 orders the last 2 days.

They are getting around recaptcha. They appear to be getting in via the account creation back door you created. The bot is creating tons of abandoned carts and tons of actual orders (fake orders). I have talked to one of our app developers and they can see there is nothing they can do with advanced product options to stop the problem. The bot is not making it to their app, it is piercing right to shopify. The bot is evolving too. It started as james james, then went to a same first name/last name and started completing checkouts, now i can see it is starting to make different first and last names. The next step might be tons of non $0 orders with stolen credit cards, or ........ This needs fixed @Victor . This can screw up imports to accounting software, crm software, etc. Many of these programs have user or transaction limits and spending hours deleting everything is not acceptable. I am more inclined to switch platforms instead of waste my time with cleaning up the order mess.

[ColonyMa]

Thank you Steve82. I am hoping if we all share our issues with these abandon Carts that @Shopify Support will help eliminate this problem.

[ArrowsAim]

As a temp fix I set my $0 products to "draft" on Tuesday 2/13 and haven't seen James James since. 

That said, I'm not settling for this solution as a long term fix and I'm 100% with you on considering other platforms of @Shopify doesn't offer a solution.

[Trishgower]

Are you by chance using the digital downloads app?

[ArrowsAim]

Nope! This thread has a list of apps between two users experiencing this issue: https://community.shopify.com/c/technical-q-a/james-james-and-the-world-of-automated-abandoned-cart-...

At this point I'm positive these bots are crawling Shopify sites for items priced $0.00 and exploiting them to test platform vulnerability at checkout. Another user is now experiencing real items priced over $0.00 checking out for $0.00, marked as paid, without any method of payment. 

[Ben12341]

No we do not

[BK1012]

I am …. Could that be the issue? 

[Ben12341]

I agree

not fixing this issue soon will require to use a different platform as we require $.00 products

[Erie_Canal]

The Spam Bot James James (first name and last name are the same) is hitting our store too. Over 5000 abandoned carts in 11 days. The bot is adding $0.00 products to the cart. For many years we have heavily relied on our $0.00 products for marketing purposes. We do not want to delete our $0.00 products.

Shopify Support is not much help.

Come on @Victor Shopify. PLEASE come to the rescue soon!!!

[sdmason]

We are getting bot orders in from James James as well as other fake name /addresss with @rtremail.com ending but they are actually showing up as paid  and needs to be fulfilled even though the sticker is  $4 but payment is zero. Any thoughts on how it got into orders and not just abandoned cart as no payment was actually made?

[ArrowsAim]

Many merchants, including myself, have had captcha enabled the entire time. This is NOT a solution.

The only effective method of preventing ACs and completed checkouts by these bots is to disable any $0 products (as hidden prods, protected prods, & prods w/o add to cart buttons remain affected in stores with blocking apps and captcha).

[sandy40]

Still no updated solutions for this? As others have stated, the reCAPTCHA is doing nothing for this issue. We see several of these per day come through and you can tell they are fake orders and see that they are using invalid credit card numbers - why no fix for this yet? 

[KiwiDesigner70]

I have a client this is happening to.  While trying to be helpful, Shopify haven't been able to resolve.  Not being able to access checkout code doesn't help.  Surely it wouldn't be too big a task for Shopify to develop a block list for customers to list any email addresses or partial email addresses that automatically removes all items from the cart, deletes the order and therefore prevent an abandoned cart?

[DailyHB]

Need some sort of solution for this. If go into your email app and look at the abandoned checkout emails it hurts the email reputation scores.

[KiwiDesigner70]

Sorry but this is NOT a solution for Abandoned Carts, because CAPTCHA only works after that point.  After a LOT of communication with Shopify without success, I found an app that does the trick.  Yes it's paid, but it's either keep going with Shopify banging your head or cough up when you shouldn't.  Anyway, here's the link in case anyone is interested: https://apps.shopify.com/ellipsis-human-presence-technology?search_id=0beb95ce-ca3b-4411-8222-e83609...

[rgkessinger]

We have had the same situation, only there are at least 40 a day for the past week. It is filling up our AC report and we have to "dig" for authentic AC notifications. The name being used is James James. Is that similar to yours? 

[ColonyMa]

Yes! Same with us 6-10 a day with the name James James. Shopify help??

[ArrowsAim]

We're experiencing the same, with a total of 97 ACs from Jan 25th through this morning, all from James James. 

What's the purpose or possible purpose of this? Should we be worried?

[ColonyMa]

Thank you for letting us know. Good questions. Maybe Shopify will look at this as not an individual account problem and help us solve the issue.

[Jlw-WishRock]

SAme, but today we had 51 orders in about 7 min all from different people with first and last name the same.  On live chat with Shopify rn.

[ArrowsAim]

I had 14 orders in 12 min this morning with the same name pattern, randomized emails from the same domain (@rtremail.com), and with a different IP for every order.

Here's a thread w/ myself & 2 others having the same AC issue: https://community.shopify.com/c/technical-q-a/james-james-and-the-world-of-automated-abandoned-cart-...

You're the only other person I've found so far who's also had actual orders placed in their shop.

This is a HUGE problem. @Shopify 

[kserolas]

I would say that a friend of yours is making fun of you. Perhaps an unhappy customer? There is nothing that you can do about it. They will stop eventually 

[Jlw-WishRock]

There's NO WAY that these are not all related. But I don't understand what they have to gain from it.

[Ben12341]

None of Shopify's response to fix this issue work.  And not all Shopify plans are "Compatible" for 3rd party apps.  These bots are coming thru the backend and don't appear in the "Live View".  Shopify needs to step up and fix this as we have $.00 items that we require in our store.  Please contact Shopify and let them know if you have the same bot issue as they "decide what issue to work on next" and they need to hear our voices.  See the "James James" discussion also on Community

[ArrowsAim]

I've personally reached out to @Shopify multiple times and from what I'm hearing from others, it sounds like Shopify has at least acknowledged the issue. Still, we're not seeing a fix or any real gesture from Shopify showing that they're taking action. I'm wondering if the appropriate action to take (since we're months into this issue now) would be to make a more publicly visible stink, maybe on social media or by engaging publicly with other commerce platforms regarding how they would protect us from what we're experiencing here. I'm not particularly savvy in that arena, but I'm casting the net and happy to provide support in piling on engagement.

I want my $0 items back and, quite frankly, losing them to bot activity is a deal breaker.

[Ben12341]

They told me they vote on which issue to work on next, and it may not be this issue 

[Rahul]

I think We Found out the Solution, Just Open > Customers Section in Shopify tab, For Example the Customer Name is James James and Customer Mail is sfj9usfhuios@gmail.com Simply delete the Customer From  > Customers Section ( on Shopify Dashboard ) Now Open your website go on Log in & Register Section, Simply Register with same name ( James James ) and same gmail ( sfj9usfhuios@gmail.com ) ( of that bot is using to create Abandoned Checkouts ), and create a Strong Password, Now you'll see the bot is failed to place Abandoned Checkouts on your store.                                                             

[CWO-FT]

If you accept any "pay over time" payments, like Affirm, keep an eye out for fraudulent orders and use a carrier that does not allow the delivery address to be changed once you have sent it. We had a similar issue that progressed to fraudulent orders using stolen identities with Affirm and they would call the carrier and change the delivery address once we had shipped. 

[apps-developer]

try one of those anti bot shopify apps. there are plenty that have bot block or vpn block so it would filter our bots which are trying to do these abandoned carts. For example: https://apps.shopify.com/kedra-shield-website-security