Shopify's Fake Abandoned Checkout Bots Are Corrupting Your Customer List and Analytics: A Containment Plan
Since early 2025, waves of bots — merchants have nicknamed one recurring pattern "James James" — have been creating tens of thousands of fake customers and abandoned checkouts on Shopify stores, wrecking email deliverability, GA4 conversion data, and ad attribution. Shopify has not shipped a platform-level fix. Here's a concrete Shopify Flow and email-hygiene plan to contain the damage.
If your Shopify admin has quietly filled up with customer profiles named things like "Will Will" or "Tyler Tyler," an email address ending in @yopmail.com or @rtremail.com, and an abandoned checkout count that has climbed for no reason you can point to, you're not imagining it and you're not the only store it's happening to. Since roughly January 2025, Shopify merchants have been reporting recurring waves of bot traffic — one persistent pattern is nicknamed "James James" after a recurring fake profile — that create fake customer accounts and abandoned checkouts at scale, sometimes 10-20 a day on a small store, sometimes in the thousands on larger ones. Community threads describe individual merchants clearing out 50,000+ fake profiles in a single cleanup pass.
This isn't the low-volume spam every store has always had a little of. It's automated, it runs in waves every few hours, and as of a merchant thread from April 2026, Shopify's own product team engaged publicly after a merchant posted hard numbers showing abandoned checkouts had grown by roughly a fifth in the four weeks after Shopify said it had "strengthened protections." There is no changelog entry documenting a platform-level fix. This is a problem you have to contain yourself, not one you can wait out.
What's actually happening
- Fake customer creation at volume. Accounts get created with empty or placeholder name fields, or with a first name equal to the last name ("Will Will," "Tyler Tyler," "Yezeus Yezeus"), sourced from a rotating pool of disposable-email domains.
- Rotating IPs, common user agents. Merchants report attacks spread across thousands of IP addresses using ordinary browser user-agent strings, which is why simple IP blocking doesn't hold — there's no single IP or subnet to block.
- Checkout initiated, rarely completed. The bots get far enough to create an abandoned checkout record (which requires only contact info, not payment) and then stop, which is what inflates your abandoned-checkout counts and abandoned-cart recovery email sends without ever producing a fraudulent order.
- Waves, not a steady trickle. Merchants describe activity in bursts roughly every 4-12 hours rather than a constant background rate, which is a useful signal when you're trying to distinguish a bot wave from a real traffic spike.
Why this costs more than admin clutter
The direct damage isn't the fake profiles sitting in your customer list — it's what happens once your other tools treat them as real:
- Email deliverability. If abandoned-checkout recovery emails or welcome flows fire against tens of thousands of disposable or dead addresses, your sender reputation takes the hit, which affects delivery to your real customers too.
- Marketing platform costs and noise. Platforms like Klaviyo bill and segment by profile count — a flood of fake profiles inflates your contact count and pollutes every segment built on "all customers" or "abandoned checkout" triggers.
- Analytics and ad attribution. Abandoned-checkout events and conversion rate calculations skew hard when a big share of "sessions that reached checkout" never had a real person behind them, which is the same kind of integrity problem we cover from the tracking-code side in fixing GA4 purchase tracking after the Web Pixels migration — bad input data breaks attribution regardless of how correctly your pixel is wired.
- Wasted staff time. Manually reviewing and deleting fake accounts one at a time doesn't scale once the volume passes a few dozen a day.
Step 1: confirm the pattern before you automate anything
Pull a sample of 20-30 recent customer records or abandoned checkouts and look for the shared signature rather than assuming every unfamiliar customer is a bot. The patterns that show up repeatedly in merchant reports:
- First name and last name are identical, or one of them is blank.
- No shipping address, or an address with only a country/postcode filled in.
- Email domain from a known disposable list (
yopmail.com,rtremail.com, and similar throwaway providers rotate in and out — check your actual sample rather than trusting a fixed list). - Zero page views beyond the checkout step itself, if your analytics can show session depth per customer.
Don't automate deletion on "email looks weird" alone — false positives here mean deleting a real customer's account, which is worse than leaving a few bot profiles uncleaned for another day.
Step 2: automate cleanup with Shopify Flow, not manual review
Shopify Flow can act on a Customer created trigger before the volume becomes unmanageable. A workflow matching the pattern merchants have had success with:
- Trigger: Customer created
- Condition: Customer's first name is empty OR customer's last name is empty OR customer's default address does not exist
- Action: Add tag
bot-suspected(safer first pass) — or, once you've confirmed the pattern holds for your store, the Delete customer action directly
Tag first, delete second. Running the workflow in tag-only mode for a week lets you spot-check the tagged batch before you let Flow delete customers unattended — a workflow that's slightly wrong at 50 fake accounts a day is a nuisance; the same workflow wrong at 50 real accounts a day is a support disaster.
Add a second Flow triggered on Checkout created with the same empty-name condition to tag suspect abandoned checkouts, so your recovery email app can exclude them from send lists at the source instead of after the fact.
Step 3: cut off the flood before it reaches your email platform
Cleaning up inside Shopify doesn't automatically clean up Klaviyo, Omnisend, or whichever platform you sync customers into — a profile synced before you tagged and deleted it in Shopify can still sit in an email list. Build a suppression segment in your email platform keyed on the same signal (missing name fields, disposable domain, or the bot-suspected tag if your integration syncs Shopify tags), and exclude that segment from every automated flow, not just cold campaigns. Do this before you clean up Shopify, because the email platform is where the deliverability damage actually happens.
Step 4: reduce how far bots get without hurting real checkout conversion
Two settings changes merchants report as genuinely useful, and one that's a real tradeoff:
- Switch to the three-page checkout layout (Settings → Checkout) if you're currently on the single-page layout — bots tuned against the single-page flow don't always adapt cleanly to the multi-step version, and it costs you nothing to test.
- Temporarily disable abandoned-checkout recovery emails while you're mid-cleanup, so a wave of bot checkouts doesn't get an automatic recovery email sent to a disposable address during the window before your Flow tagging catches up.
- Requiring customer login before checkout is the last resort, not the first move — it does stop anonymous bot checkouts, but it also adds friction for every legitimate guest checkout, and most stores lose more real conversions than they save in bot cleanup effort. Only reach for this if the volume is genuinely unmanageable through Flow and email hygiene alone.
Step 5: for Shopify Plus, a checkout validation Function has a real but limited role
If you're on Plus and have Shopify Functions available — the same replacement platform covered in our Shopify Scripts migration guide — a cart or checkout validation Function that rejects known disposable email domains at the information step can stop some of this before an abandoned checkout is even recorded. Be clear-eyed about its limits though: a validation Function only runs once a real customer reaches that step in your storefront's checkout UI. Bots that hit the Storefront API directly, bypassing your theme entirely, never trigger it. Treat it as one more layer, not the fix.
Setting expectations honestly
Nothing in this plan stops the bot traffic at its source — that has to happen on Shopify's infrastructure, and as of this writing there's no confirmed platform-level fix, despite Shopify's public statements about strengthened protections. What this plan does is stop the fake data from reaching the systems where it does real damage: your email sender reputation, your marketing platform's contact list, and your conversion analytics. That containment is achievable today with Flow and segment exclusions; waiting for Shopify to close the underlying hole is not a plan you can budget around.
Code Kaarigari builds Shopify Flow automations and checkout Functions for stores dealing with exactly this kind of platform-level noise, and can wire up the tagging, suppression, and validation layers described here end to end. Start with our Shopify development services, or contact Code Kaarigari to get a Flow-based containment workflow running against your own store's bot pattern.