How to stop “James James” bot sign-ups on Shopify

If your Shopify customer list suddenly fills with people called James James, you’re not alone. Merchants have been reporting this pattern in the Shopify Community since at least early 2024, in a thread that has grown past a hundred pages. The accounts are created by scripts, not shoppers, and they never place an order.

How to recognise them

• The first name and last name are the same word: “James James”, sometimes “Robert Robert” or another repeated name.
• They arrive in bursts, often dozens in a short window.
• The email addresses look random or come from free mail providers.
• They have 0 orders and $0 spent.

Some merchants also see a wave of abandoned checkouts at the same time. Those checkouts can trigger abandoned-cart emails to addresses nobody reads.

Step 1: turn on hCaptcha for account forms

In your Shopify admin, go to Online Store → Preferences. In the Spam protection section, make sure hCaptcha is enabled for login, create account and password recovery pages, and for contact and comment forms. It reduces automated sign-ups but won’t stop all of them.

Step 2: find the existing accounts

In Customers, search for “James James” to see how many there are. To catch variations, create a segment of recent customers who have never ordered:

number_of_orders = 0 AND customer_added_date >= -30d

Sort by date and look for the repeated-name pattern. Don’t act on the repeated name alone: some genuine names, like the Burmese “Aung Aung”, repeat a word. Check the email and the timing too.

Step 3: keep them out of your email tool

Tag the fake accounts (for example fake-signup) and exclude that tag from the audience your email marketing tool syncs from Shopify. If they are already in your email tool, suppress or remove them there as well, so they don’t count towards your subscriber total or hurt your sender reputation.

Step 4: delete them

Once you’ve checked a sample, select the tagged customers on the Customers page and delete them in bulk. Shopify won’t delete customers who have orders, which protects any real buyer you might have tagged by mistake. Deletion is permanent, so always tag and review first.

Keeping on top of it

New waves can arrive at any time, so repeat the segment check weekly. Disclosure: we build BotSweep, a Shopify app that does this automatically. It checks each new sign-up within seconds, tags likely bots and sends borderline accounts, like the repeated names above, to a review queue rather than acting on them. It focuses on customer accounts; it doesn’t remove abandoned checkouts.