How to Block Disposable Email Addresses on Shopify
Throwaway inboxes like Mailinator and 10 Minute Mail are behind a lot of fake orders, discount abuse and card testing. Here's how to block them at checkout in one click.
Short answer
Shopify has no setting to block disposable email addresses. Ongoing Defender blocks about 50 well-known throwaway inbox services at checkout with one switch, and lets you add any other domain you spot, including all of its subdomains.
Why throwaway inboxes matter
A disposable email address takes seconds to create and disappears soon after. That makes it the first choice for anyone who doesn't want to be traced.
| Problem | How a throwaway inbox helps them |
|---|---|
| First-order discount abuse | A new address for every order, so the same person claims your welcome discount again and again |
| Card testing | A fresh address for every attempt |
| Fake orders and bots | No real person behind the order to contact or trace |
| Chargebacks | An inbox that's gone before you can follow up |
How to do it with Ongoing Defender
- 1Install Ongoing Defender and turn on Checkout rules.
- 2Switch on Block disposable email addresses.
- 3When you spot another throwaway service in your orders or abandoned checkouts, add its domain under email domains. Its subdomains are blocked too.
- 4Write the message blocked buyers see, for example asking them to use their usual email address.
- 5Test a checkout with a throwaway address to see it blocked.
Blocked buyers see no payment or shipping options, just your message, on every checkout including Shop Pay and Apple Pay.
How to spot a throwaway address
- A domain you've never heard of, often with random letters or numbers.
- An inbox name that looks random, like xk29fq@.
- Several abandoned checkouts in a row, each with a different unfamiliar address.
- The same shipping address or phone number with a new email each time.
- Search the domain. Throwaway services advertise themselves openly.
Keep real customers' private addresses working
Some genuine shoppers use private relay addresses, like Apple's Hide My Email, which forward to their real inbox. They're real customers, so leave domains like privaterelay.appleid.com off your own block list.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Block throwaway inboxes at checkout | Not built in | One switch |
| Block a whole domain and its subdomains | Not built in | Add the domain once |
| Block a specific email | Fraud Control, for Shopify Payments stores only | Any payment provider |
| Hide Shop Pay, Apple Pay and Google Pay from blocked buyers | Needs an app | Automatic |
Tips for best results
- Turn on Stop repeated checkout attempts too, so anyone cycling through addresses is caught by their phone or shipping address.
- Check your abandoned checkouts weekly for new throwaway domains and add them.
- If your welcome discount is being abused, block the shipping address and phone of repeat claimers as well.
Related guides