Shopify spam customer accounts with links in the name: what they are and what to do

Some fake customer accounts don’t have a name at all. Instead, the first or last name field holds a message: “Your account has been suspended, visit …”, a prize offer, or a crypto pitch, sometimes with a link. These accounts are not aimed at you. They are aimed at whoever owns the email address the bot typed in.

Why bots put messages in the name field

When an account is created, a store can send a welcome or account email that greets the customer by name, for example “Hi {first name}”. If the “name” is a scam message, your store sends that message from your trusted address to the victim’s inbox. Your store becomes the delivery service for the spam, and your sending reputation can suffer.

What Shopify already blocks

In our own testing, Shopify rejected a customer whose last name contained a URL when it was created through the Admin API, with the message “Last name cannot contain URL”. Scam text without a link, such as “Your account has been suspended visit shopify-verify.xyz” written as plain words, was still accepted. So you still need to look for these accounts yourself.

What to do

1. Take the name out of account emails

Go to Settings → Notifications and open the customer account emails your store sends (such as the account welcome and invite emails). If they include the customer’s first name, consider removing it or replacing it with a neutral greeting. Then a scam “name” can’t be delivered through your emails even if an account gets created.

2. Turn on hCaptcha

In Online Store → Preferences → Spam protection, enable hCaptcha for login, create account and password recovery pages.

3. Find and remove existing accounts

On the Customers page, search for words that commonly appear in these messages, such as “visit”, “claim”, “bonus”, “account” or “.xyz”. Check that each result has no orders, tag them, and delete them in bulk once you’re sure. Customers with orders can’t be deleted, which is a useful safety net.

4. Keep them out of your email marketing

Make sure these accounts aren’t subscribed to marketing and aren’t synced to your email tool. A tag-based exclusion makes this easy to maintain.

Automating it

Disclosure: we build BotSweep. It reads the name, email and note of each new customer and flags scam text and links in name fields within seconds, alongside other bot patterns. Flagged accounts are tagged and can be unsubscribed from marketing automatically. The manual steps above work without any app.