Multiple Orders of $0 placed within seconds

Shopify Discussion
1

We had a customer (if you want to call him that) who placed 7 orders all within seconds of each other. The products he ordered were all items marked at $0 and are a contact us form rather than the add to cart CTA. That being said, there is no way for them to add this product to the cart and checkout. They also found a random code we use to offer free shipping so all 7 orders totaled $0. This all happened within one minute which makes me believe it was some sort of bot.

I was able to set the product to draft so he was unable to make another purchase but then he just moved on to the next product listed at $0 with a contact us.

My question, how was he able to add this item to the cart when it was strictly a contact us button that took you to an email rather than checkout? How was he able to find products strictly set to $0 so fast? Has this happened to anyone?

bad actor.PNG
bad actor.PNG1444Ă—445 56.9 KB

2

One can use cart api to add products to cart, no need to use your product page form(s).

One can also see the actual product price by fetching /products/XXX.js or /products/XXX.json files or use search and filter API to find zero price products.

You need to ensure that products you do not want to sell are set as unsellable in backend.

Example:

  1. https://firstsourcewireless.com/en-au/search?q=*&sort_by=price-ascending will list your products, starting with the cheapest, then, say,
  2. https://firstsourcewireless.com/en-au/products/squad-power-manager-spm-622.js will give your product variant id, say, 41013787426915, then
  3. https://firstsourcewireless.com/en-au/cart/41013787426915:1 will send you to checkout with this product
  4. or https://firstsourcewireless.com/en-au/cart/add?id=41013787426915 to simply add this to cart…

Everything except line 1 will work regardless of what your theme outputs.

3

Thats interesting. Did not know that. Thanks for explaining that to me

1 Like
4

How do you stop it? How do you set as Unsellable? we want our products and info to be visible but some are not sold online.

5

Hello @FlameEng , you can block products with a price of 0—or no price at all—using the Cart Lock app https://apps.shopify.com/cart-lock

Here’s a short video showing how to use the app: