James James and the world of Automated Abandoned Cart Robots

Jamie_Grove
Excursionist
32 0 52

Hi, folks.

 

As most people know Google and Facebook will both place automated test orders to verify shipping and other details. The names are fairly well-known and they always abandon before finalizing checkout.

 

We have a new friend showing up in our logs by the name of James James. The email address sfj9usfhuios@gmail.com and location is San Antonio, California 94105. This bot is trying to check out 4-5 times per day with some of our free digital printables but abandons before going through with it. I have no idea why this might be happening because these particular products are not in the direct feeds going to FB and Google, though I know the page for the product still resides in Google.

 

Anyway, just wondering if anyone else has had this particular name/email combo come up in their abandoned cart logs.

 

Thanks!

 

Jamie

 

Replies 122 (122)
Yvy616
Excursionist
34 0 41
I completely agree! The Shopify is Canadian, it’s the same thing really. I believe the customer service personnel are either low wage or just don’t care, or don’t know and just read from a script. Sometimes I feel like I’m speaking to a brick wall when contacting their support.
If enough people make a stink of this, and go to social media, or other news platforms, maybe they will respond?

L_Meeks
Visitor
1 0 1

We had the same exact issue as everyone else. James James has been gone since the 15th of February Wonder, has anybody else seen a decline or drop in sales since the start of James James?

empiricalarby
Trailblazer
173 1 30

It's hitting my store currently every day multiple times

Michael_Alon
Visitor
2 0 6

Same issue, STEP UP SHOPIFY! Shut this down

Kary4
Visitor
2 0 1

Same thing happened to me today. Reached out to Shopify and basically they said this

 

“Thank you for your patience as we worked to investigate the issue you reported involving orders with zero totals on your shop. A select group of stores reported a similar issue. Upon investigation, it was observed that these stores had certain products listed as publicly available at no cost. It appears that a third party with potentially malicious intent discovered these free/no cost products and placed orders for them, utilizing the standard checkout process as any customer would. This third party took advantage of the information that was publicly accessible online, and there is no evidence suggesting these individuals had any unauthorized access to your store.” 

 

and also added that I need to remove any items that are classed as free as the only way to “resolve the issue”

tecques
Visitor
2 0 2

Thanks for contacting Shopify about this and sharing their updated response with us. I hope they are gone, but worry that they have left something behind since they were obviously poking around 3-4 times a day, every single day for 2-3 weeks! What would logically be the point to it...I hope some "action" does not get triggered down the line and we are left unfunctional saying "I told you so"!  I'm not particularly "tech minded", but is what I say unreasonable to be concerned about?

Kary4
Visitor
2 0 1

I completely understand your fears around this and I felt the same. The issue isn’t totally gone as I had it happen to me hours ago. But I have removed the “free” listings and hopefully that’ll put an end to it now. Ill

Definitely be keeping a close eye on this. None of the abandoned checkouts went through as orders for us as we don’t ship outside of the UK fortunately. 

Yvy616
Excursionist
34 0 41
That response doesn’t sound like they are doing anything about it. Just saying basically “don’t worry you’re fine” and dismissing it.

I don’t think this bot actually visits the store or adds to cart like a customer would. I was watching like a hawk for days and the abandoned checkouts do not match up with anyone from my visitor logs. Many times I had more abandoned checkouts from him than total visits in the same hour.

I also removed the add to cart button on the particular free item and they still proceeded with trying to check out.

I was told by a developer that it looks like this bot comes in through the back end somehow never really visiting my store as a customer would. So those blocking apps won’t work. And none have worked.
The only thing that has stopped him was putting the free item in draft mode. But that’s a temporary thing as I really need that product live, it’s an add-on I offer.

Shopify needs to take this seriously and protect their back end systems. They need to plug that hole.
ildikonemeth
Visitor
1 0 3

I have the same issue, it found 2 active products for 0$ (which weren't supposed to be free, probably human error there). I added the price back to these and checked all the products on the website, hundreds of them, every single one lol, everything had a price. Couple hours later it found a Bundle item in the catalogue for 0$ which wasn't even on the website, only active through a Bundle app where it was accidentally created hence the 0$, so i would guess it really is going through the backend, because it is finding stuff you cannot find on the storefront. This is just horrendous, and hasn't been solved by Shopify for over 1 month. 

Yvy616
Excursionist
34 0 41

I just noticed this in shopify help center. https://help.shopify.com/en/manual/checkout-settings/bot-protection 

So it seems shopify DOES have an innate bot protection, but they only allow Shopify Plus have it??? That's pretty messed up. This is something that they will benefit from if we all have it. 

Jamie_Grove
Excursionist
32 0 52

This is only a temporary protection tool. It lasts 60 minutes. My guess is that it is something that takes extra setup on their end (and has costs associated - like a cloudflare captcha). In any case, I have Plus and I probably wouldn't use it for this particular issue.

elizaRAFTP
Tourist
8 0 11

Hi! Our store also got James Jamesed in January and we spent weeks trying to block it/him (?) and tried all of the things Shopify support told us to do (zero help) and also tried three different fraud blocker apps (also didn’t work). We finally had our web designer tackle it and she successfully blocked him by creating a block tag on his account through our wholesale lock app. We had been deleting his account every day and he would just make a new one. So we left it and added the block tag so he can’t access any of our products and it has stopped. So sorry to everyone dealing with this and it’s so frustrating that Shopify just keeps saying there’s nothing they can do. 

elizaRAFTP
Tourist
8 0 11

Hi I am adding to my comment above with an unfortunate update. We haven’t heard from James James since Feb 11th and thought that our block tag had worked (we blocked his account from accessing our store and specific $0 items using wholesale block app) but yesterday he came back and now we have a few dozen abandon carts with each of our $0 items coming in batches every couple hours. We cannot get rid of our $0 items, we are a non-profit and our primary function is to provide free supplies to other nonprofits. Anyway, back to square one which is “there’s nothing we can do” from @Shopify 

bros
Visitor
2 0 5

This thread has almost 3,000 views in less than 4 weeks and Shopify still has not been helpful. @Shopify  please do something about this JAMES JAMES bot. 

sabinevk
Shopify Partner
1 0 3

@Shopify same issue in our shop. Please step up and give all shop owners a solution (not only Plus members for 60 minutes).
Bots have become indispensable these days, a solution must be found for this!

akamai
Visitor
2 0 1

We have the samething happening from Mr. James James. The thing I don't understand is my website is wholesale and only allowed to access if you have an account and sign in. A customer cannot create an account, I must do so. But somehow James James is able to bypass the password/account log in hurdle, create an account on his own, and then place an order. I have a default shipping at .01 so it stops there. I did update my $0 item to have a cost so hopefully that is all i will hear from him, but I sure don't like this access.

 

Shereen

RealTreat
Tourist
7 0 7

I have a similar setup and JJ got right around the Locksmith and Wholesale Gorilla barriers. It is very concerning indeed, that Shopify isn't demonstrating any concern over this via its customer support team. I have to hope that behind closed doors they are taking this seriously and working hard to address it. 

sassybadge
Tourist
7 0 16

Yes, I am getting the same and Shopify help told me others are getting it too but so far they haven't taken care of it.

HCMANDS
Tourist
10 0 13

Just experienced our first "James James" in our abandoned checkout early this morning.  There were only 2 and I saw the address was San Antonio, CA which I thought was odd so I googled the address which led me to this thread.  I deleted the customer and I do already have the Locksmith app so I locked the checkout page to that email hoping it will work.  I do have a few $0 products because I have a third part app that does my pricing.  We don't keep inventory, as all our items are made to order.  We also don't have any free shipping options, so hopefully those things sent the bot on its merry way.  But how disappointing of Shopify to not dig into this and figure out what they are trying to accomplish and how to prevent it.

sassybadge
Tourist
7 0 16

That bot has been clogging up my abandoned shopping cart for weeks. Shopify told me "it's harmless" but has done nothing to stop it. I was told to archive them but there is no way to make them stop appearing in my cart log, it's awful. Then again, they just changed the dashboard again on their app which removed the last feature I actually used and they told me Too bad so sad, so why would we expect any better from Shopify? They are not what they used to be. Shopify "help" is useless.

Ben12341
Excursionist
15 0 7

The thing is, I am seeing they all have the same  @rtremail.com in common.  You'd think Shopify could at least block that until they get a complete solution.  Is everyone seeing these same emails?

Ben12341
Excursionist
15 0 7

and then there is James James with a different address

 

AppMerc
Tourist
8 0 4
Mine all have a gmail address.  
Again, after we removed all 0.00 items - our friend has not been back.
Ben12341
Excursionist
15 0 7

Unfortunately, this won't work for us as we require free items

BK1012
Tourist
9 0 5

Same here Ben. I offer free digital downloads and it is an incentive for people to invest in our store. 

BK1012
Tourist
9 0 5

I’m going to try and offer a coupon for free digital downloads but keep the price at $1. I’ll let you all know if that works 🤷🏽‍♀️

Scorpionmotor
Tourist
3 0 3

How do they add items to the cart that do not have an "add to cart" button?

Ben12341
Excursionist
15 0 7

I've heard they are going thru the back end.  Please, everyone contact Shopify and report this issue as we are not getting the attention this needs.

RealTreat
Tourist
7 0 7

Maybe Shopify did block that email domain as JJ appears to be using a different address now. We got hit for the first time on March 15 by James James of San Antonio using sfj9usfhuios@gmail.com

Jamie_Grove
Excursionist
32 0 52

And it's not entirely harmless as it ends up entering your email lists and automated checkout abandonment flows.

Scorpionmotor
Tourist
3 0 3

Hello, got hit last night and early this morning 32 orders @ $0.00 + over 400 abandon carts all @ $0.00. I do have  many "items" on the site that are not for sale eg the press section or garden/food photos etc - How do they add items to the cart that do not have an "add to cart" button? Any help would be greatly appreciated. Thank you.

 

Most James James for the abandon carts - sfj9usfhuios@gmail.com - James James - 321232 Klays san antonio California 94105 United States 2016570312

 

but the 32 orders @ $0.00 are mostly different people. 

BK1012
Tourist
9 0 5

There are multiple threads on this with 100s of customers affected. Imagine the number who haven’t reported it! @Shopify  you need to step up and protect your customers. This is not harmless as it is wasting our time and energy. 

Scorpionmotor
Tourist
3 0 3

Hello, yes I agree w/ you 100%. How do they add items to the cart that do not have an "add to cart" button?

sassybadge
Tourist
7 0 16

Great point, it IS wasting our time and causing unease among all of use not referring to James James as a "NEW FRIEND," who as come to visit. As Shopify worded it...unbelievable.

 

capecalikim
Visitor
1 0 0

Yes, we have an average of 10 abandoned carts away from James James in San Antonio, California.

Ben12341
Excursionist
15 0 7

Have you reported this to Shopify?  The more people who contact them, the better chance we have of getting this fixed.

BackInTimez
Tourist
5 0 9

Just to help others out here. 

 

@Jamie_Grove  @MJComputerGeek  @elizaRAFTP @sassybadge  @capecalikim  

 

I too was hit with hundreds of abandoned carts almost overnight from "James James"

 

After investigations and reaching out to visitors who have been taking advantage of this I have intelligence to suggest this is what's happening:

 

  • There're "FREE PRODUCT" discords set up, which use bots to scan Shopify stores en-mass for free products denoted by any product with $0.00.

 

  • Test orders attempts then placed by the bot which has the default James James and associated address details stored within it.

 

  • From the order attempts confirming free products are available they are then categorised and listed within the Discord servers/chats as links to the free products whereby members of said discord community can browse the various industry 'categories' to find "free" products they're interested in.

 

  • Whilst some of these discord members are just interested in legitimately free products I suspect the bots and service users are also trying to capitalize on $0.00 product listing errors by site admins in the hope to grab a valuable "free" product.

I've coded some additional bits to prevent this on my own site but I won't detail here to avoid giving info anywhere for bots to update. + My setup case will be different to other stores.

 

But I thought I'd post the above here so people have more of an understanding about why this is happening.

 

elizaRAFTP
Tourist
8 0 11

Thanks for looking into this. Our “free” products are locked to the public and only approved customers with logins can access them.  James James never actually reaches checkout, only abandoned orders. If the bot is posting links to our free products on Discord, people should still not be able to get access to them unless they are also somehow bypassing our store like the bot. The bot is not “visiting the store” like a normal customer they are somehow getting into the back end and adding products to a cart directly, there is no way they could have access to otherwise. Nothing we have tried to block this bot from doing this has worked so far. 

BackInTimez
Tourist
5 0 9

The bot won't visit the store like a normal user, they will be scanning (iterating through) your Shopify site's directory trees and product listings en-mass. Especially since 90% of Shopify sites use the same core product hierarchy.. 

 

Then it will drop A link direct to the product itself which (speculating now) is likely a variation of the abandon-cart url the James James bot picked up upon it's cart loading of products and it'll likely replace a product ID with one of the free one's it's found on your site enabling visitors to bypass going via the front page of the site entirely.

 

It doesn't matter if they are "locked to the public' or not, if the product is LIVE (ie not in Draft) it will have a shopify handle and url attached to it which is what the bot is exploiting. 

 

Forget any notion of a bot scrolling through your site like a normal human - that's not what's happening here.

ApplecrossGal
Tourist
7 0 1

What would happen if we create a draft order for James James with an actual paid-for product (I appreciate the bot has multiple email addresses but it is only using one on our site) When it goes to the cart page the cart will not be empty and it will have to process the draft order first. Could this be a temporary fix?

 

 

BackInTimez
Tourist
5 0 9

I think it' unlikely to work since cookie for abandon cart is stored on users machine via browser so (AFAIK) there's no easy way to force a custom session (what your suggestion essentially is) back to the user session cookie without some hackery.

 

ArrowsAim
Excursionist
20 0 23

This issue has also affected items with a value over $0 (this did not happen to me, I disabled my $0 items when actual orders first started coming through). From another thread on this same topic: 

 

1000016068.jpg

 

Ben12341
Excursionist
15 0 7

Hi, we would all be so greatful if you would share your coding fix with Shopify since they cannot seem to figure it out themselves.  

Yvy616
Excursionist
34 0 41
Thank you!!!! That makes so much sense and sheds light on this. Now if only Shopify would prevent this…so I can put the product live again.

Yvy616
Excursionist
34 0 41

Hi it's been a bit quiet but wanted to share a new experience. Though I have not seen James James abandoning checkout since I turned the free item into draft mode. Since last Wednesday, I am now seeing a lot of abandoned orders for my next cheaper product (around $13) About 3 a day, all with same fake address "Street 10 Apt 2" with different cities/states. In this case the name does not equal last name, they "Seem" legit at first.

Anyone else? This is a never ending battle...Names all seem Portuguese  (or Brazilian, I don't know)

Yvy616_0-1713209855912.png

One thing I did just notice: I had disabled Shop Pay a couple of months ago for other reasons. Still use shopify payments but not the "ShopPay" (that helps speed checkout). I just turned it back on Tuesday, end of day, and this started Wednesdsay morning. Either it's a coincidence, or this activity is linked to ShopPay.

 

Stakeholder
Excursionist
23 0 4

[User Deleted Post]

Yvy616
Excursionist
34 0 41
I don’t know if they are attempting payment (how can I see if they’ve gone that far in checkout?) yes it most likely is credit card number checking, but I found curious is they may be using shoppay as their means to attempt this.
BackInTimez
Tourist
5 0 9
  • Go into the abandoned order/cart section of orders.
  • Go into the abandoned order in question
  • At the bottom of that page will have a timeline of events.

 

If payment has been attempted you'll see some red text along the lines of  [Unable to process a payment for $13.00 USD using a CreditCard info here]

Yvy616
Excursionist
34 0 41

Oh I had checked there, it does show a failed attempt (invalid card umber, insufficient funds, card expired) on a fewof them, but shows nothing at all on the rest of them.

BackInTimez
Tourist
5 0 9

Are they attempting payment on these? 

 

Could be rogue user (or bot) attempts to verify stolen / fraudulent CCs before making larger payment amounts or enabling them to sell-on the CC information as "Verified working" which commands a higher price on the black market. 

 

Using the lowest priced item is a way to avoid red flags on stolen CC's as banks often immediately stop one off unusually high payment amounts AND/OR a way to verify stolen CC information where small purchase amount is likely to fly under the real owners radar on bank statements thus preventing real owner cancelling card/reporting to their bank.