How can I prevent fake abandoned checkouts from multiple email addresses?

Topic summary

Store owners are experiencing a surge of fake abandoned checkouts from bot-generated ProtonMail addresses following a pattern like mail01@protonmail.com, mail02@protonmail.com, etc. Each uses different names but similar email formats, making them harder to block than single-address spam.

Recommended Solutions:

  • Enable Shopify’s built-in spam protection under Online Store > Preferences > Spam Protection for customer accounts and newsletter signups
  • Install third-party apps like Negate Bot Protection, Shop Protector, or Fraud Filter (which can block specific email domains)
  • Use fraud prevention apps that block disposable email addresses and filter by domain (e.g., protonmail.com)
  • Enable Google reCAPTCHA in Settings > Checkout and customer accounts
  • Filter suspicious addresses in email marketing platforms to prevent them from receiving abandoned cart emails

Community Concerns:
Multiple users express frustration that this requires paid third-party apps despite already paying Shopify subscription and transaction fees. Some report the issue distorts their analytics and reporting. One user notes Shopify previously allowed IP address capture during abandoned checkout but removed this feature. The discussion remains open with no definitive free solution, and some users are considering alternative platforms.

Summarized with AI on October 23. AI used: claude-sonnet-4-5-20250929.

I have the same problem. And I don’t think I’m alone. A lot of abandoned payments from xxxx@protonmail.com.

Why should we, as paying customers, pay even more to ensure that our webshops are safe? And even pay for Apps that give access to our webshops!

Dear Shopify You simply need to tighten up the security that should be included in the payment. You offer a solution to your customers that is not optimal in terms of security. When you have said A, you must also say B.

That said, we’re happy with Shopify… when it works :blush:

2 Likes