I’ve been getting hit hard by the Amazon scraping/bot orders (emails ending in @buyforme.amazon, etc).
I’ve already tried emailing Amazon’s branddirect to opt-out, but the orders keep coming through. Right now, I’m manually checking every single order to cancel them before fulfillment to avoid chargebacks, but I can’t keep doing this at 2 AM or on weekends.
My question is: Has anyone found a way to actually block these at the checkout stage?
I tried setting up a standard Fraud Filter, but it only flags them—it doesn’t seem to stop the authorization, so I’m still dealing with the payment fees/refund headache.
Is there a specific setting or a simple tool anyone is using to just auto-void these specific email domains instantly? I’d happily pay a few bucks a month just to stop looking at my order dashboard like a hawk, but I can’t find anything that handles this specifically for the Amazon bots.
Underlying problem merchants have no way to edit or lockdown the frontend apis such as the ajax api ,permalinks, or the MCP server apiwhich will only exacerbate this issue from here out as mercantilism becomes more automated with tools like or agent systems for checkout .
Of course the real underlying problem is billion dollar corps want this.
If the store is on plus use checkout blocks https://apps.shopify.com/checkout-blocks
Others plans see shopify-function apps for checkout validation https://apps.shopify.com/search?q=block%20email%20in%20checkout
Or have a custom one made @PaulNewton
Note: shopify functions feature availability can vary by plan
If blocking the mail address isn’t an option then an alternative,
Untested with amazons bot system: Stores using only the online-sales channel could try advanced theme customizations to add a hidden cart-attribute, and from that REJECT any cart/checkout missing that attribute; because external entry to checkout may be missing that attribute as the bot may not even have visited the theme only apis.
If it flags them use shopify-flow or the mechanic app to automate canceling orders.
that can be even easier if the fraud-app isn’t tagging orders in the orders admin, as you can check the email at order creation time instead of waiting for fraud validation to process.
Custom alternatives,
https://shopify.dev/docs/api/functions/latest/cart-and-checkout-validation
Inverting the problem, if you have time to waste, there’s trying the new SPA app generation to prototype a mini-app to list these offending apps in their own tiny dashboard.
As a prototype it can at least help to figure out requirements of building a full app.
https://help.shopify.com/en/manual/shopify-admin/productivity-tools/sidekick/generate-apps
If you unable to block them at checkout, you can change your payments setting from Automatic capture to Authorize only.
Then use Flow app to check whether new orders were made by @buyforme.amazon and cancel, otherwise capture payments for you.
No need to monitor your sales 24/7 when Flow can do that.
Flow is a free app, setup is pretty simple (and they’ve added an AI assistant to help with it).
Second the Manual Payment Capture or After Fulfillment, and Flow to cancel those orders. That way you don’t have to deal with the headache and fees. Also use Shopify Fraud Control to implement checkout rules.
Hi @justinlord
From the checkout, you can do that by using the Shopify Script Editor (Shopify Plus only) or an app like Order & Checkout Protect, which allows you to automatically cancel or hold orders depending on patterns in the email. Now you may set it to auto-void orders containing “@buyforme.amazon” to save yourself some fees while you sleep and get less manual monitoring.
I’d recommend using the Shopify app called Blox. If you enter that email once, it will automatically connect and block any new emails coming from that bot. It’s been blocking dozens of orders per day for us.
The authorize-only + Flow approach that’s been suggested is the right move, and I want to add a bit more detail on why it actually solves your problem even though it feels like a workaround.
The core issue with Fraud Filter is that it operates after authorization - the payment attempt has already gone through, which is where your fees come from. Switching to authorize-only changes that entirely. No capture happens until you (or Flow) explicitly triggers it, so when Flow auto-voids the order, there’s genuinely nothing to refund and no capture fees.
For the Flow setup specifically: trigger on ““Order created,”” condition on customer email containing ““buyforme.amazon”” (substring match works fine, so you catch any variation of the domain), action is cancel order + void payment. That’s it. Takes maybe 15 minutes including testing, and you can run it against a real cancelled order to confirm the void goes through properly.
Now if you want to actually stop these at checkout so the order never gets created in the first place - that’s a different layer, and it’s harder on non-Plus plans. That requires Shopify Functions, which is what powers checkout validation apps. Some apps in that space do support email domain blocking during checkout. If you search the app store for checkout validation or checkout blocking and filter by email-related features, you’ll find a few options. Checkout Blocks (already linked above) is the well-known one but is Plus-only. For non-Plus, the Functions-based options are more limited but they exist.
For the @buyforme.amazon case specifically though, the Flow approach probably covers most of your pain. True checkout blocking would stop them from even submitting, but if your main concern is fees and the 2 AM order monitoring - authorize-only + Flow handles both.
One more thing: the cart attribute trick PaulNewton mentioned is interesting but likely won’t apply here. Amazon’s Buy For Me feature does appear to go through the normal checkout flow rather than hitting cart/checkout APIs directly, so bots coming from it would have the expected storefront attributes.