We are experiencing around 20 spam accounts being created in our store per day. We have confirmed they are “not verified” by using Shopify Flow to flag them. This apparently means they are not coming through the admin or API. We are deleting the accounts with flow but the problem is those people are receiving welcome emails.
We tried a honeypot on the customer registration form, tried password protecting the form and tried commenting out the form altogether. The spam does not appear to be coming from the form. I don’t think it is coming from another app because we have very few apps but I can’t verify that.
Does anyone know how these accounts get created? A lot of them have “blogspot” in the names of the customers or random duplicate first and last names.
