Fake Customer Accounts on Shopify: Where They Come From and How to Stop Them

Fake customer accounts on Shopify are usually bots submitting your newsletter, contact or legacy account forms. Shopify creates a customer profile for every mailing-list or account signup. To stop them, keep hCaptcha on, move to the current passwordless customer accounts, and turn on double opt-in so unconfirmed signups never get marketing. Then delete the fakes that have no orders.

Everything below is based on Shopify's Help Center and developer docs as of 6 October 2026, linked in each section. Shopify changes its admin often, so if a menu path has moved, search the Help Center for the setting name.

Where the fake profiles come from

Any form that collects an email can create a customer profile, and bots fill forms automatically.

Shopify's managing customers page lists what creates a profile: "Signing up for your mailing list or a customer account", "Placing an order", and "Starting an order, but abandoning their checkout". The newsletter form is the easiest target. It needs only an email, and Shopify's contact information guide says those addresses "are stored in the Email subscribers customer segment".

There are two common patterns, and they carry different risks:

What you see	Likely cause	Main risk
Random names, gibberish addresses, bursts of signups	Generic form spam	Bounces when you send marketing
Real-looking addresses at Gmail or company domains, never opened	A bot submitting victims' addresses to many sites (list bombing)	Spam complaints from people who never signed up

The second row is the dangerous one. Your store becomes one of the senders in an attack on someone's inbox, as described in how to stop fake signups. Merchants on the Shopify Community forums have described waves of fake accounts arriving despite CAPTCHA, so treat settings as one layer, not a cure.

Step 1: keep hCaptcha on

hCaptcha is on by default. Check it hasn't been switched off, and don't run another CAPTCHA app alongside it.

According to Shopify's online store preferences page, hCaptcha can run "in contact, newsletter signup, and comment forms" and "on login, create account, and password recovery pages". To check, go to Online Store > Preferences, find Spam protection, and make sure both boxes are ticked:

• Enable hCaptcha on contact and comment forms
• Enable hCaptcha on login, create account, and password recovery pages

Two warnings from the same page. First, "hCaptcha isn't compatible with custom code or third-party apps that add CAPTCHA", so if an app adds its own CAPTCHA, use one or the other. Second, the account-page setting applies to legacy customer accounts. Shopify updated how hCaptcha connects to the legacy login, account and register forms on 28 October 2024 and deprecated the old /challenge page, so an older theme may need updating for the protection to work.

Step 2: upgrade from legacy customer accounts

Legacy customer accounts are deprecated, and the current customer accounts use a one-time email code instead of a password.

Shopify's upgrade guide says plainly: "Legacy customer accounts are deprecated." With the current customer accounts, customers "enter their email address and receive a one-time 6-digit verification code. A password isn't required to sign in." The preferences page adds that "the customer accounts verification process doesn't require hCaptcha".

Shopify doesn't publish anti-abuse figures for this, so we won't claim a number. The design point is simple: signing in requires reading a code sent to that inbox, which a bot with a made-up address can't do. Review the upgrade guide's limitations first, especially if you built a custom registration form or rely on workflows triggered by legacy accounts.

Step 3: turn on double opt-in for marketing

Double opt-in doesn't stop the profile being created, but it keeps unconfirmed addresses out of your marketing.

Go to Settings > Notifications > Customer notifications, then in Marketing double opt-in select Customer marketing confirmation. Shopify describes it as requiring "customers to click a link in an email to confirm that they want to receive email and SMS marketing from you".

Three details from Shopify's documentation:

• "Customers who subscribe to your mailing before you activate double opt-in aren't required to confirm their status." Existing fakes stay subscribed, which is why step 4 exists.
• If a subscription app collects signups, set double opt-in in that app too. If it has no such option, "any customers who sign up are marked as a subscriber".
• Update your newsletter form's confirmation message to tell people to check their inbox.

One confirmation email per signup is still an email to a possible victim. Pair double opt-in with hCaptcha so bots can't trigger thousands of them. The trade-offs are covered in double opt-in vs email verification.

Step 4: find and delete the fakes you already have

Build a segment of profiles with no orders from the attack window, review it, then bulk delete.

Shopify's segment editor uses a query language. Its reference documents number_of_orders, customer_added_date and customer_email_domain, with relative dates like -30d. A starting segment:

number_of_orders = 0 AND customer_added_date >= -30d

Narrow it before deleting. Sort by date added and look for bursts. To check one suspicious domain, add AND customer_email_domain = 'example.com'. Real subscribers with no orders look a lot like fakes in this view, so delete only the clusters you're confident about.

Then, on the Customers page, select the profiles and choose Delete customers. Shopify's rules:

• Deleting "can't be undone".
• Profiles can't be deleted if the customer "is associated with one or more orders", "has ever had a subscription", is waiting on a GDPR erasure, or is due a scheduled gift card.
• In a bulk delete, "only the profiles that can be deleted are deleted".

Erasing personal data is different from deleting. Shopify redacts the name and address, "but the profile and order history remain".

If you want this automated, check what your tool actually fires on. Shopify Flow's Customer created trigger is documented as starting "when a new customer places an order in your store, or when a customer profile is manually created", so don't assume it catches newsletter signups.

Step 5: verify before you send

Export the Email subscribers segment, verify it, and remove what bounces before your next campaign.

Fake signups hurt most when you email them. Addresses that don't exist hard bounce, and a run of bounces in one send tells mailbox providers your list collection is careless. Some junk addresses are also spam traps.

Export the segment as CSV, run it through a verifier, and unsubscribe or delete the invalid rows. Leave risky and catch-all results out of big sends until they've engaged. Any verification service works for this. SimpleVerifier takes CSV uploads of up to 100,000 rows on monthly plans, and the free email list health check gives you a quick sense of how bad the problem is. Checkout typos and discount-popup abuse, the other ecommerce sources of bad addresses, are covered in email verification for ecommerce stores.

The short version

1. Online Store > Preferences > Spam protection: keep both hCaptcha boxes ticked, and don't stack a second CAPTCHA app.
2. Upgrade to the current customer accounts, which use one-time codes and replace the deprecated legacy accounts.
3. Settings > Notifications > Customer notifications > Customer marketing confirmation: turn on double opt-in.
4. Segment number_of_orders = 0 profiles from the attack window, review them, and bulk delete. Profiles with orders can't be deleted.
5. Verify the Email subscribers list before every big campaign.