Over the last few months, one of our client’s stores has started to receive an onslaught of fake customer accounts being created. These accounts are all subscribing to email marketing and causing issues with email marketing spam scores. All of these fake accounts have just one thing in common, the email address features a + somewhere in the address.
We have enabled Shopify Hcaptcah in the store settings for all forms
Through investigation I am confident these are not being added by either one of the two newsletter sign-up forms on the site as they both add a tag to the customer record, none of the spam accounts have this tag.
the only other form on the list is the contact form, however this doesn’t subscribe new users.
I don’t believe these accounts are being added at the checkout, as our abandoned cart and checkout spam scores are very low and not showing any signs of abuse.
The site has a lot of apps installed over the years so I was suspicious that one of them may be the cause, however when filtering the customer list by “created_by_app_id = Online Store” I can see the offending spam accounts listed.
The site has legacy customer accounts in the theme editor, including the Customer register template, however none of these is live to the public, Shopify customer support has confirmed this.
I’ve searched for other forms on the site and can not find any hidden pages with forms that might be the cause here.
Has anyone else encountered something similar or have odas on where to look next to find the source of our issues?