Why bots create fake customer accounts on your Shopify store (and how to clean them up)

You open your Shopify customer list and find dozens, sometimes thousands, of accounts that no human created: James James, RobertTaw RobertTaw, names made of random letters, or a “name” that reads like a phishing message. None of them ever order anything. This article explains what they are, why the usual fixes don’t stop them, and how to clean them up.

What fake customer accounts look like

• Duplicated names: the same word in the first and last name fields (“James James”, “Mark Mark”), often created in bursts.
• Gibberish: keyboard-mash or random letters such as “SwHqpLkdMa vXnBqRte”, usually with an equally random email address.
• Scam text in the name field: messages like “Your account has been suspended, visit …” or money offers placed where a name should be.
• Throwaway emails: addresses from temporary-mail services that will never receive a receipt.

Why bots create them

Merchants in the Shopify Community have reported this pattern for years, with one well-known thread about “James James” accounts running to over a hundred pages. The motives vary, but two are common:

• Abusing your store’s emails. When an account is created, your store can send a welcome or account email that includes the customer’s name. If the “name” is a scam message, your trusted store address ends up delivering it to whatever inbox the bot entered.
• Testing and list-building. Automated scripts probe sign-up forms at scale to test email addresses or find forms they can abuse.

Why IP and country blockers often miss them

Many bot-protection apps work on the storefront: they block visitors by IP address or country when a page loads. Sign-up bots frequently send requests straight to the account-creation form without loading your pages like a browser would, so storefront blocking never gets a chance to see them. That is why merchants report still getting fake accounts after installing a blocker.

What they cost you

• Email marketing bills: many email tools charge by the number of profiles or subscribers, so every fake account synced from Shopify can raise your plan.
• Deliverability: sending campaigns to addresses that never engage can hurt your sender reputation.
• Misleading reports: sign-up and customer counts stop reflecting real people.

How to clean them up, step by step

1. Make sure hCaptcha is on

In your Shopify admin go to Online Store → Preferences and, in the Spam protection section, check that hCaptcha is enabled for contact and comment forms and for login, create account and password recovery pages. It reduces form spam, though it won’t catch every bot and doesn’t remove accounts that already exist.

2. Find the suspicious accounts with a segment

Go to Customers → Segments and create a segment for recent accounts that have never ordered, for example:

number_of_orders = 0 AND customer_added_date >= -7d

Widen the date range to cover the period when the spike started. Scan the list for the patterns above. Be careful with names that repeat for legitimate reasons: some real names, such as the Burmese “Aung Aung”, use the same word twice.

3. Tag them and stop the email sync

Select the fake accounts and add a tag such as fake-signup. Then exclude that tag in your email tool’s Shopify sync or segment rules, so the accounts stop counting as subscribers. You can find them again later with:

customer_tags CONTAINS 'fake-signup'

4. Delete them once you’re confident

After checking a sample, select the tagged customers and delete them in bulk from the Customers page. Shopify doesn’t allow deleting customers who have orders, which is a useful safety net. Deletion is permanent, so tag first and delete second.

Automating it

Disclosure: we build BotSweep, a Shopify app that does steps 2–4 automatically. It checks every new sign-up within seconds, tags likely bots and unsubscribes them from email marketing, and sends borderline accounts to a review queue instead of acting on them. Customers with orders are never actioned automatically, and deletion is off unless you turn it on. The manual steps above work just as well if you prefer to do it yourself.