How can I prevent fake abandoned checkouts from multiple email addresses?

[Aroha87]

I am getting many abandoned checkouts from different "people", all having different and convincing names, however every single email is: mail##@protonmail.com, where ## is some combination of two numbers, eg: mail01@protonmail.com.

Does anyone else experience this? Is there a way to prevent these fake abandoned checkouts?

I have read others dealing with fake abandoned checkouts, however those seem to be from one email address. All of mine are coming from different email addresses of the above formula.

[Justin1994]

Lucky for you! We also have the app installed and currently at Enterprise plan but we still receive some few abandoned checkouts from bots. Not sure how to combat this type of attack. If you don't mind, will you share the setting you use in your Blockify app so we can check and compare with ours? 

[cocobutter]

Hi, each store is different but, this is what I found to work for me. Also, the customer service for Blockify is pretty awesome if you need further assistance.

I monitor the Visitor Analytics and attention to the Risk score column. I can range from 0 to 100. I find a number for example, 33 and use that as a starting point.

Then I go to Settings, under Bot Killer, then Risk score starts at.... then I put in 33.

I monitor for a few days and see how that works. If there are still to many I up that number until I find a balance to what I think works best for me.

Hopefully, this has helped you.

[Aaron2024]

I tried Blockify and it doesnt work because you arent able to access the IP addresses on abandonded cart check outs. Blockify told me the best thing to do is turn on log in before check out which does work but kills conversions. Ive reached out to Shopify multiple times but they dont care. You have to upgrade to PLUS to get the bot option. I might change platforms. I turned on manual capture just to avoid any chargebacks. Its only going to get worse with AI.

[cocobutter]

I am lucky that it worked out perfect for me.

I think I mentioned in a previous answer, Shopify used to allow you to grab the IP addresses during abandoned checkout but that changed some time ago. Wish they brought it back.

We're not only paying a subscription service to Shopify but, we also pay a percentage for each transaction. It adds up.

If you move to a new platform please post. I'm interested.

[Aaron2024]

I had Magento with invisible Google captchas and never had bot issues . Had that business for 12 years. Shopify doesn't really seem to be addressing bot issues or really care on the lower level plans. They way Shopify sites are structured I think they have to implement options to handle bots.  I've called them 4 times you just get a customer service person with the same script and you can't actually speak to any one that makes decisions or has experience on the matter but reading the forums it's affecting alot of Shopify stores for the last few years.

[MadeleineW]

Thanks - well nothing seems to be adressed by Shopify and I also find the
themes limited. I am considering other options but haven't decided yet.
Will let you know if I remember!😁

[hangahammockcol]

I'm also interested to shut down my shopify store and find other options to run the business in a better way, without BOTS.

Shopify is getting worst and worst every year 

[AndrejG1994]

03/2025. After years of mentioning it here by multiple users shopify did not come up with solution. Needless to say a simple solution! We need to be able to very simply block an email domain from checkout. 

[eBeeLuv]

this won't work as bots are now able to enter the backend bypassing any and all current Shopify paid apps. These apps are not allowed to monitor the checkout page. So these new bots go directly into the checkout page. All different names, addresses from all over the world. We have a paid app BoostMark in place for a number of years and no issue - now the bots have learned how to bypass and enter back end via the checkout page. Shopify needs to place a bot protector on all checkout pages for any shop that is being used on their platform. 

You can have recaptcha selected, you can have all IP's outside the U.S. etc. blocked, you can have VPN's and Tors blocked. Nothing is stopping these new bots - it needs to be addressed by Shopify!!! 

[jamesmashiri]

Hi @AndrejG1994, @Aroha87 and all,

I've encountered the same problem and solvid it with a Flow automation. It's not 100 % proofed, but goes like this:

• WHEN a customer abandons
• CHECK for e-mail domain and other critera (e.g. address or phone ***234567 etc)
• CHECK for staff set tag "LEGIT"
• ADD a customer TAG and ADD a customer note
• SEND internal e-mail with request to staff for action, i.e. set tag "LEGIT" if legit, otherwise do nothing
• WAIT 8 hrs (or any time shorter than automated recovery e-mail send delay)
• CHECK if there's a tag "LEGIT"
• IF not THEN DELETE customer

This won't effectively block anything, but it will sift thru the abandoned carts and take automated + notified action that will delete the fakes. Works like a charm. I usually see 3–4 runs per week with a couple of small client shops with this Flow active.

[ShizaRizwan]

Hello. Yes, this is something other store owners have also experienced. What you are seeing is likely automated bot activity that is using slightly altered email addresses to simulate real abandoned checkouts. These bots often do this to test forms or trigger your abandoned cart email system.

Since the emails are changing slightly each time, it is harder to block them using basic filters. However, here are a few steps you can take to reduce or prevent this type of fake traffic. Hope this helps: 

• Enable Google reCAPTCHA in your Shopify admin under Settings > Checkout and customer accounts. This helps block basic bots from interacting with your checkout.
• Use a bot protection app like Shop Protector or Human Presence from the Shopify App Store. These apps are designed to detect and block suspicious or non-human behavior.
• Monitor your email flows to make sure these fake entries are not cluttering your abandoned cart emails or affecting your performance metrics.
• Consider using customer tags or filters within your email marketing platform (like Klaviyo or Omnisend) to prevent suspicious addresses from receiving your automated emails.