Bogus customer accounts

[Greg15]

At my Shopify store there is someone who has created over 100 bogus customer accounts - each with a different fake email address.  There are no orders, just bogus accounts.   I have no idea what the purpose of this would be.  Is there a way to deny access to specific domains, such as Fakemail.com?

[Kimi]

Hi, @Greg15.

For context, there are bots that disguise themselves as normal browser traffic that can create multiple customer accounts on stores. To help address this issue, we've noticed that stores on Shopify have experienced reduced fake customer accounts and spam emails by adding a Google reCaptcha to their site. Google reCaptcha helps analyse the behaviour of visitors to online stores and blocks spam from bots. So I highly recommend setting this up on your store if you haven't already done so.

Can you also elaborate what you mean in regards to blocking certain domains? Do you mean to block specific email addresses from being able to create a customer account on your store, or from accessing your storefront altogether?

[Greg15]

Blocking specific email addresses would probably be futile.  I was referring to the domain name in my post such as "Fakemail.com".  Every bogus account had an email address like 12345@fakemail.com, or 98765@fakemail.com.

I will have to look into some examples of the recaptcha.  I have encountered this on some websites and got so frustrated at the complicated process that I gave up on the order.   Thanks for the idea.

[Kimi · Accepted solution]

@Greg15

If your online store is open to the public without any customer login required, there wouldn't be a way to block a group of email addresses that are attached to a specific domain. Because these are also most likely bots, the best way to minimise this issue is to look into adding Google reCaptcha as noted in my earlier reply. Totally understand your concern though in the extra step and process it will add for customers on their end, so as you mentioned you can look into it further first and trial it before committing.

For future reference, if you do happen to come across specific customers from a certain location that are spam in nature and would like to block them from browsing your store, installing an IP blocker app like this one should help.

[DivellaD]

It's more complicated than that. I have reCaptcha enabled and it does nothing to prevent these @fakemail.com addresses from subscribing. Furthermore, I use Klaviyo and all these submissions are added to my customer profiles there. Speaking with your team I was told it is a Klaviyo issue and to use reCaptcha and/or double opt in (we've tested both), but both are already enabled. It is not a Klaviyo issue.

[Muriel_Santos]

It looks like the "solution" doesn't work and still no other answers here to help us out. Any news on your side? So frustrating! I just got 42 "new subscribers" from this fakemail under the same name (Mark Mustermann) and all of them started check out and left. It's making me nervous!

[DivellaD]

Just got another 48 today. This is getting ridiculous! There NEEDS to be a way we can block someone from creating an account!

[Kimi]

Hi @DivellaD and @Muriel_Santos.

At this stage, installing an app such as Shop Protector would be the best way to help protect your store. This app should help with stopping fake account creations, bogus newsletter sign-ups and checkouts created by bots. The app's also been highly rated by a lot of our merchants, so I recommend taking a closer look at it to see if it will suit your needs. Because this app has been created by a third-party developer though, you can contact the app's support team directly if you have any app-specific questions.

I can definitely see how important it is to be able to have a feature natively within the Shopify admin to further help with managing spams and bots, however. Because of this, I'll pass on the information and thoughts you've shared here with me to our developers. Shopify is ever-growing and we're always looking at solutions to improve our platform. We can only do so with feedback from our merchants, so it's always greatly appreciated when you share your thoughts and feedback with us.

[awilliamsonm]

I have the same Mark Mustermann fake accounts that appeared at my store today... about 100 accounts.  This happened about 5 or 6 months ago too (same name).  It is frustrating to have to remove these from all systems once you see them.  In Klaviyo, it shows a pattern of subscribing and adding a product to the cart and then abandoning.  I'm guessing I got one fake account for every product on my site. 

I'm a little confused at a solution here.

[CorinnesCustom]

I have the same bot name! I bet it's Shopify hiring people to act as bots to inflate shop activity. As you may have heard Shopify's stock price is plummeting. I like how their only solution is a paid app that costs $3.49/month to stop this issue.

[CorinnesCustom]

The solution is always spend more money. Buy yet another shopify app. 

[rbortner]

I also have the same account. This Mark guy sure is prolific, lol

[pete8314]

Love how Shopify marks these things as solved, when they're clearly not. 

Anyway, we noticed the same issue, as we ended up sending 134 postcards (via PostPilot) to "Mark Mustermann".

Shopify Flow still doesn't support the ability to delete accounts, so I've created a Flow to at least tag the customer (which removed them from all Klaviyo/PostPilot lists), and then open a ticket for one of the team to delete the account.

Anyone actually called Mark Mustermann is going to be disappointed. Sorry actual Mark.

[pete8314]

I felt bad for Mark. Added a condition to see if he spends money before deleting, so far none of the 134 Mark Mustermann's have.

[rbortner]

Wow, that's quite the procedure (and time spent) for one spammer! But I understand given that you spent real money to mail him something. 

[pete8314]

134 versions of the same spammer, so add up the costs of PostPilot, Klaviyo etc, it's something. 

[Tony47]

It is absolutely Google Bot - or one of a myriad of their (essential) bots. DO NOT block the traffic or IP addresses, just segment out of your marketing flows (email domain including 'fakemail' email name including 'fake' etc.. add customer name 'Mark Mustermann' if you like though there must be a legit person somewhere) and delete.

After initially freaking out my store was being attacked over and over again for months - this is what I've now learnt:

Aside from the name, email and domain, other giveaways it's not just any malicious bot (100% bounce rate, average session time 0 seconds, browser: headless chrome/ Linux etc) is the geolocation: Ashburn VA, (or Chicago).

You can confirm your Mark Mustermann's by exporting any one of them from your Shopify customers list and looking at the User Agent. It will include the bot name (for example "/Storebot-Google/") and then cross-check that against Google's official crawler list: 

https://developers.google.com/search/docs/advanced/crawling/overview-google-crawlers

(in my case and prob most storeholders, it's the Storebot)

70% of the world’s internet traffic flows Ashburn, VA (Google and AWS data centers). Trillions and trillions of daily searches. Generally, Google is pretty good at filtering their bots from your site. Every now and again my ecomm store gets a spike in these bots (primarily via checkout, adding every product I have to cart as a separate fake user, including Google LLC phone number, and then removing from cart).
This can negatively affect your rep with email service providers if you then send out email automations, ie abandon cart sequences (or add them to campaigns), to these fake emails that then bounce (hence, segment them out).

Also, it skews your analytics (ironically, Google Analytics) for the day/week/month, and then your CPC, etc. Filtering out of analytics is harder imo (probably why I haven't done it yet)

https://www.envano.com/2020/01/what-is-bot-traffic-and-how-to-avoid-it/

https://organicdigital.co/blog/how-to-block-google-analytics-spam-from-ashburn-and-chicago/

https://erudite.agency/insights/exclude-bot-traffic-google-analytics/

https://kwsmdigital.com/why-do-i-have-so-much-website-traffic-from-ashburn-2/

[CorinnesCustom]

Omg finally a real solution. No thanks to Shopify. Thank you Tony you are a genius. 

[GlobalWaves]

Thank you Tony!