How can I prevent fake abandoned checkouts from multiple email addresses?

[Aroha87]

I am getting many abandoned checkouts from different "people", all having different and convincing names, however every single email is: mail##@protonmail.com, where ## is some combination of two numbers, eg: mail01@protonmail.com.

Does anyone else experience this? Is there a way to prevent these fake abandoned checkouts?

I have read others dealing with fake abandoned checkouts, however those seem to be from one email address. All of mine are coming from different email addresses of the above formula.

[Victoria]

Hi, @Aroha87.

Welcome to the Shopify community and thanks for reaching out!

I understand you're receiving an influx of abandoned checkouts from different users who use different names and email addresses. This may be a bot / spam causing a high number of abandoned carts.   

Bots are able to create multiple customers and abandoned checkouts. Unfortunately, there is no way to completely block all bot traffic or actions on a storefront. However, I'll share some options that can help minimize the flow of bots in your store.

Once logged into your Shopify admin, head to the Online Store > Preferences > Spam Protection section. You're able to enable spam protection for the following:

• Customer account creation, login and password reset.
• Newsletter email address entry and blog comment entry.
  

A second option is to look into installing apps to help protect your store and checkout from fake accounts and bots. I recommend the app(s): Negate ‑ Bot Protection that includes a 7-day free trial and Shop Protector that includes a 14-day free trial. You can also check out our App Store for additional apps that may interest you. 

I'd also like to hear what kind of online business you've started, what you're currently working on and if you need assistance with areas of your store. I'll be happy to take a look and offer further advice. 

[Pete_Hegn]

We are having the exact same issue on joice.dk. with @protonmail.com fake checkouts.

[Pete_Hegn]

Is it somehow possible to ensure that if the checkout contains a "*@protonmail.com", the draft checkout is not saved? 

[Victoria]

Hi, there @Pete_Hegn.

Thank you for joining the thread!

I understand you're also experiencing a similar issue with a particular email address creating fake abandoned checkouts. 

In addition to the apps shared above for preventing bots on your storefront (Negate ‑ Bot Protection, Shop Protector) I recommend looking into the Fraud Filter app.

When integrating this app you're able to create specific filters to flag suspicious orders, block known customers and add an additional layer of security to your store. 

Below is a list of additional ways Fraud Filter can help protect your business:

• Restrict checkout to only certain customers.
• Prevent certain customers from ordering.
• Prevent customers from a particular referring site from ordering.
• Prevent certain brands of credit cards from checking out.
• Warn you of potentially fraudulent orders or cancel orders outright.

I recommend checking out our Fraud Filter resource and FAQ for more information.

[Kasper1]

Fandt i på en løsning?

[cocobutter]

I installed Blockify - IP Block app and it works fantastic!

[MadeleineW]

Thanks!! At last a suggestion on how to get rid of this extremely annoying
thing. Will try and post here how it works.

[aebasol]

Hello

how did you use the app to avoid this situation

[cocobutter]

I installed the app, found the IPs from the abandoned fake checkouts and blocked them. So far, almost a year later, things are much better.

[Elza1000]

Which app?
Where do you find the IPs and how do you block them?

[cocobutter]

I wanted to assist you but, I show that now Shopify made some changes on how to get customers IP address on fake abandoned emails/carts. Now I can't find it. Before, you just had to go to the customer checkout page and there was an option to get that info. 

[josefinedracke]

Hi,

Just wanted to let you know that the exact same thing has been happening to us during the entire month of juli (our site is www.jackojuno.com). A bunch of abandoned checkouts with male names (which we thought was strange since our customers are 99% women). We have contacted Shopify Support regarding this and got a similar answer to yours.

Best,

Josefine

[Victoria]

Hi, @josefinedracke.

Welcome to the Shopify community and thanks for joining the thread!

 The abandoned checkouts that have been created does sound like it may have been generated by bots. I'm glad you were able to connect with our support team to look closer into the issue.

You can also look into bot protection apps like Negate Bot Protection, and Shop Protector or browse our app store for a variety of bot protection apps. 

I hope this helps!

[EG512]

Why can't Shopify do something instead of having to buy another monthly app? I feel like the security team could work in the background to do this for all of us.  It seems like an overflowing problem.

[cocobutter]

I know right! Shopify takes a percentage of our sales. You would think they should take some responsibility as it's on their servers.

[Governor]

Have the same issue in 2024.  Most likely a Bot Protection App causing this to create a need for apps just like it

[cocobutter]

Just out of curiosity, how many fake abandoned checkouts are you getting and if you've installed another app aside from Blockify IP

[Elza1000]

Every time we issue a discount code, we get a surge of these fake customers. It probably has something to do with google shopping. The last sale we created a week ago and we already have about 200 new customers who created fake accounts and fake check-outs.

[cocobutter]

Sounds like a google bot. Usually they create a fake email address that follows some logic. You may need to create a filter to block those but, it can be annoying as it is always changing.

[Ablestar_Daniel]

There's sites like https://www.joinhoney.com/ and others that gather coupon codes for lots of different stores. These sites will periodically check to see if discount codes are valid (in other words, create a fake checkout and try the code) so that's another possible source of the checkouts, especially if you've noticed it's happens more after you have a new code.

[myra24]

Hi,

You may try this third-party fraud prevention app if you think the Shopify built-in fraud app is not enough for your case.

This fraud prevention app can:

-block free, disposable email address

-block email address by using email domain (e.g. protonmail.com)

-block blacklisted email address

-block email address by using email domain age

and perform other validation like IP validation, credit card validation and so on.

Hope it helps. 

[hemgren]

Same problem here. The problem at the moment is that the fake traffic messes up my analytics. Is there any way of banning accounts with this protonmail to get into the site? 

[Victoria]

Hi, @hemgren.

Thank you for reaching out and joining the thread!

Although there is no way to ban or block all bot traffic, you are able to minimize the number of bots in your store.

As shared in my previous post, to help limit the number of bots you can navigate to the Online Store > Preferences > Spam Protection section of your Shopify admin.

You're able to enable spam protection for the following:

• Customer account creation, login and password reset.
• Newsletter email address entry and blog comment entry.

 I'll share a screenshot below of what this looks like within your admin. You'll want to ensure the two boxes under Spam protection are checked.

I recommend exploring some of our bot protection apps within our App Store for an added layer of protection against your store.

Feel free to thread any additional questions you may have here.

[Shepherd-Oxford]

Hi, We have both those items ticked and we're still getting maybe 20-30 fake abandonned checkouts a day. Any other ideas - prefer not expensive apps! Thanks.

[cocobutter]

In my case, installing the app helped. Shopify's recommended bot preference is totally useless.

[kalinuevo]

I'm having the exact same problem with many of those @protonmail.com...

I hope Shopify would come up with a solution to prevent "xxxx@protonmail.com" making any order.

Have a wonderful day.

[MadeleineW]

H, I have the same problem and ticking the spam filter boxes didn't help. I haven't yet tried any of the suggested apps. I kind of think this should be resolved by Shopify and not something that I as a customer with payment plan should have to pay extra for. I mean, adding payed apps for extra functionality is one thing, but paying extra for this kind of thing...?

[Victoria]

Hi, all.

Thank you for joining the thread!

We appreciate you sharing your feedback on this request. I've shared this information with our development team to look into implementing this feature in the future. I recommend keeping our Shopify Changelog on hand to stay up to date on new updates for the platform. 

[Elza1000]

Same thing here. A lot of fake abandoned check-outs. All have similar profiles. The fake customers place hundreds of items into their cart, resulting in hundreds or thousands of dollars at check-out. Also, most email addresses come from free gmail accounts. We have spam protection on account creation, but it does not seem to help as all of these fake accounts have created an account and are signed up for our email list. Does anyone know the reason why these bots would create these fake check-outs? Is this a targeted sabotage by competitors? Any thoughts? 

Also, how is Shopify planning to deal with the problem? 

[cocobutter]

I don't think Shopify plans to do anything. I installed Shop Protector and uninstalled it a couple of hours later. The Shop Protector app did not help in my case. I have over 500 fake abandoned orders created since last night, all using the name ramiro ramiro with IP address 192.241.73.162 and ramiro@gmail.com email address. Hopefully, someone at Shopify looks into this.

[Axel5]

I wish Shopify should add a way to stop certain domains.

I hear that some of the third party apps devs are making the fake abandomed orders just to sell their apps. I dont know if it is true but it kind of makes sense.  

[Xythia]

Yeah the problem is you would likely need to block the traffic before they even access our sites, something I believe only shopify are able to do and no app could resolve.

What I'm wondering is if google are responsible for a lot of the fake checkouts. My site have normally had about one fake abandoned checkout per week, but yesterday and today I've had 5 PER DAY. Only difference is that I installed the google channel yesterday. If google is responsible it would be good bot traffic but it's still seriously messing with our newly launched sites stats.

Anyone else noticed a big increase in the number of fake abandoned checkouts? 

[cocobutter]

The Google bot I believe I've already identified. It always goes by John Smith, fakexxxx@fakemail.com.

It's still unbelievable that Google bot would create 50+ fake orders. Good or bad, it messes with statistics. I understand the crawling aspect, but creating fake abandoned checkouts? Why?

The other spammer is not Google. IP address 192.241.73.162 came up as an abusive IP address in several sites already so hopefully, something gets done although I don't have high hopes for it.

[Stelton]

I have the same problem. And I don't think I'm alone. A lot of abandoned payments from xxxx@protonmail.com.

Why should we, as paying customers, pay even more to ensure that our webshops are safe? And even pay for Apps that give access to our webshops!

Dear Shopify You simply need to tighten up the security that should be included in the payment. You offer a solution to your customers that is not optimal in terms of security. When you have said A, you must also say B.

That said, we're happy with Shopify.... when it works 😊

[MinnaM]

We are here having the same issue. Not manu but still. Do they do any other harm to the shop? Whats the point of these bots? All is @protonmail.com...

[cocobutter]

I don't think any harm is done. It's probably doing it to crawl your website. I find it annoying because it throws my reporting off. After installing the program and doing some tweaking I no longer receive these fake orders.

[Brodega]

We experience the same problem from different @protonmail.com aderesses. Been going on for more than a year now and it causes our Shopify analytics not to be correct, and it messes up our email marketing.

Shopify - please solve this issue and do NOT ask me to install apps that cost me extra money - This happens on YOUR platform and YOU should solve this. You must be able to stop these bot attacks (or are the app developers better at developing than you?)

[Aaron2024]

Have you had any help from Shopify yet? 

[cocobutter]

LOL I gave up on Shopify the first few months I signed up when I realize they don't answer any real questions without reading from a script.

[MadeleineW]

No, nothing...I find it soooo annoying!

[Dotflakes]

In my case,  all have different email addresses with different shipping addresses from different countries, but billing addresses are same. Miami, Florida. 

[cocobutter]

Fortunately, after installing Blockify I haven't had any issues. As a test, I turned it off a few times and there it goes again, tons of visits and fake customer accounts and abandoned orders.

Shopify made some changes a few months back. Before I was able to get the IP address when customer account is created/abandoned orders but, now those don't come up anymore. 

So I just keep Blockify installed and turned on.

[Justin1994]

Lucky for you! We also have the app installed and currently at Enterprise plan but we still receive some few abandoned checkouts from bots. Not sure how to combat this type of attack. If you don't mind, will you share the setting you use in your Blockify app so we can check and compare with ours? 

[cocobutter]

Hi, each store is different but, this is what I found to work for me. Also, the customer service for Blockify is pretty awesome if you need further assistance.

I monitor the Visitor Analytics and attention to the Risk score column. I can range from 0 to 100. I find a number for example, 33 and use that as a starting point.

Then I go to Settings, under Bot Killer, then Risk score starts at.... then I put in 33.

I monitor for a few days and see how that works. If there are still to many I up that number until I find a balance to what I think works best for me.

Hopefully, this has helped you.

[Aaron2024]

I tried Blockify and it doesnt work because you arent able to access the IP addresses on abandonded cart check outs. Blockify told me the best thing to do is turn on log in before check out which does work but kills conversions. Ive reached out to Shopify multiple times but they dont care. You have to upgrade to PLUS to get the bot option. I might change platforms. I turned on manual capture just to avoid any chargebacks. Its only going to get worse with AI.

[cocobutter]

I am lucky that it worked out perfect for me.

I think I mentioned in a previous answer, Shopify used to allow you to grab the IP addresses during abandoned checkout but that changed some time ago. Wish they brought it back.

We're not only paying a subscription service to Shopify but, we also pay a percentage for each transaction. It adds up.

If you move to a new platform please post. I'm interested.

[Aaron2024]

I had Magento with invisible Google captchas and never had bot issues . Had that business for 12 years. Shopify doesn't really seem to be addressing bot issues or really care on the lower level plans. They way Shopify sites are structured I think they have to implement options to handle bots.  I've called them 4 times you just get a customer service person with the same script and you can't actually speak to any one that makes decisions or has experience on the matter but reading the forums it's affecting alot of Shopify stores for the last few years.

[MadeleineW]

Thanks - well nothing seems to be adressed by Shopify and I also find the
themes limited. I am considering other options but haven't decided yet.
Will let you know if I remember!😁

[hangahammockcol]

I'm also interested to shut down my shopify store and find other options to run the business in a better way, without BOTS.

Shopify is getting worst and worst every year