Yes same issue with us. Street 10 apt 2. I will say that after a week of creating abandoned checkouts, they successfully made a purchase today. Thankfully shopify flagged it as high fraud potential, and i immediately recognized the street 10, apt 2 address, so I canceled the order. Still, I’d like to understand if there is anything to do to block them; and what is their end game? It seems that they’re always looking for the lowest cost item in the store, whether it’s $0 or another small figure.
Oh @jtstevens , I just saw what you read about testing credit cards. That makes complete sense. And it also means our sites aren’t necessarily the target of the malicious activity, but a tool to help them make a greater purchase somewhere else? In any case, what are we supposed to do about this? Can you report when a credit card succeeded?
I found this thread to have some helpful solutions: https://community.shopify.com/post/2421632
I have not had any credit cards succeed yet.
Those apps won’t work. 1) because it’s hard to match the IP addresses with the customer because Shopify doesn’t show IP addresses. 2) they change their IP
I have the same issue. Might have to be a class action against Shopify for them to do something. They need to offer a captcha on the check out page.
Those don’t work. Shopify doesn’t show IP address of abandoned cart customers so you can’t Match up the IP. 2nd they change IP addresses. If you are a Shopify site owner you are a sitting duck!
They are testing credit cards on your site. They have bots that enter the information. Usually its the card info, name , city, zip code. In shopify for AVS They must only verify state, city, zip code because the street is always the same. They test the cards across alot of websites until one goes through.
Come on. This won’t work. 
They usually just pick the lowest price point product in the store. How would this work. Come on. Shopify needs a captcha on the check out page.
This is the same bot on my store. They are testing credit cards. They target shopify stores because shopify is negligent and doesn’t offer a way to stop it. You can require customer to log in before check out which does stop the bot but will kill your conversation rate. One you change it back They will start again. Seems they are testing a few transactions across alot of Shopify stores. I had one transactions go through. It is also bad for your conversation rate because it messes up all your sales data. We need to get alot of Shopify stores together and demand they fix it.
We had the exact same problem. Spambot ordering $0.00 items that they should not have had access to as you have to be approved to order on our site. We changed all the 0 items to .01 and it seems to have stopped.
We wee very concerned that shopify said there was nothing they could do about it. Makes me wonder what other back end information is vulnerable.
Right now the issue is bots running credit cards. They are testing credit cards across shopify sites because shopify isn’t doing anything to stop them. They should add a captcha to check put page. High negligence on shopifys part to allow this go occur. You can change to require customer to log in before check out but that I’d a conversion killer. We need to all get together and demand they fix it.
In this case, if they pick products with lowest price point, you can simply create a rule to block certain customers based on the email ID they use, mostly all of these orders are from the same email id.
Plus if you want you can block checkout based on the location also. I mean specfic zip code they enter in the checkout.
Yeah. I’m having the same problem right now too. Shopify doesn’t seem to have a solution for this.
Have you found a solution yet? Mine started a few days ago too. I’m trying to avoid the “require customer to log in” method because I don’t want to kill conversions, but Shopify have not replied by with a solution yet. I’m so frustrated.
Hi! I found a workaround for preventing bots to actually place orders (though this doesn’t solve the problem of abandoned checkouts). Note we are on the “Basic” Shopify plan, so we don’t have the option to add Recaptcha to check out, which I believe would otherwise solve this issue.
Here’s our workaround:
Download the Shopify Flow app (free). There’s then a template within the app called “Capture payment if order is not high fraud risk”. This basically leverages Shopify’s Fraud analysis, which typically flags Bot activity as “High Fraud Risk”. If Shopify then flags the order as High Fraud Risk, it will not automatically capture payment and instead prompts you to check the order and manually accept payment if deemed OK. See attached screenshot.
And then my workaround for abandoned checkouts is only a partial solution and doesn’t work all the time (I’m not sure why!). I again use the Flow app to tag those customers that were created by Bot activity and which created the abandoned carts. This way, I can easily segment out the fake accounts and then delete those customers and just Archive / ignore the abandoned carts (not ideal but it’s the best solution I’ve found). For me this has worked because all the bots have the same street address (street, 10 apt, 2). So I just set up a flow that recognizes that address and tags the customer as FAKE. See attached screenshot.
Thanks Immnul! This is a great option. I tried a different app that was supposed to stop the checkout with certain conditions, but I could not get it to work. However, this app seems to be doing the trick. I set up both of the flows that you put in your post, but only one of them has triggered so far. I also added an automatic deletion of the customer. Since yesterday, it has triggered 10 times and deleted all of the customers from the abandoned carts. Also, none of the carts have tested a credit card, so it seems to be stopping that before it can happen too. And none of the customers have ended up on my email automation sequences. So far so good.
Oh I’m so glad it’s working for you… I’ve added the delete customer step on my side. However, I’m really finding the tagging based on address to be hit or miss and I’m not sure why. For example, this latest one (Kansas) Flow didn’t tag the customer… but I really don’t get why. Whereas for this Indiana address, it DID tag it. Do you @jtstevens have any idea why it doesn’t always work? Does it always work for you? Also, are you concerned about this is affecting your tracking of conversion rate?
NOTE: I’m sharing personal information only because these are CLEARLY fake accounts
Thats the exact issue we are having
10
apt
2
Ok. I spoke too soon. Some of mine are hit or miss now too… I think I found out why, though. If I go to an abandoned cart where it still tested a credit card and the customer was not deleted, I found that the ‘customer’ does not have an address, but the ‘order’ has a shipping address and billing address. So our trigger in Flow is on customer creation, but the customer does not have an address. I looked for other triggers that can be used, but only can see ones for order creation, which is too late.
I found another thing that I am going to try, though. On an abandoned cart, you can “Copy checkout URL”, so I had a look at a few of those pages. Seems like all of my traffic is coming from locale=en-br (in the URL anyways). So I am going to try a different country blocker app.