How to Stop Fake Orders on Shopify
Fake orders come from card testers, bots, fraudsters and pranksters, and each needs a different fix. Here's how to tell them apart, check a suspicious order, and stop them at checkout for good.
Short answer
Shopify flags risky orders, but it won't stop the same person ordering again. To stop fake orders, block them at checkout. Ongoing Defender blocks known emails, phones, addresses and throwaway inboxes, and automatically blocks details used in repeated checkout attempts. For orders already placed, check the order's risk analysis before you fulfil, and cancel and refund the ones that are fake.
What kind of fake order are you getting?
"Fake order" covers several different problems. They look alike in your Orders list, but each one is stopped a different way, so it's worth working out which you have before changing any settings.
| Type | What you'll see | What stops it |
|---|---|---|
| Card testing | Bursts of small orders or failed payments minutes apart, often with made-up names like John Doe | Automatic blocking of repeated details, and hiding payment methods |
| Stolen-card fraud | A real-looking order, often high value or rush shipping, where billing and shipping addresses don't match | Shopify's fraud analysis, then blocking the details once confirmed |
| Bot checkouts | Abandoned checkouts filling up with gibberish names and throwaway email addresses | Blocking disposable email services at checkout |
| Repeat offenders | Someone you've already refunded, banned or lost a chargeback to, back with a new order | Blocking their email, phone, address and account |
| Fake cash-on-delivery orders | Orders that are refused at the door, leaving you with the shipping cost | Blocking known phone numbers and addresses |
| Fake accounts | New customer accounts with no orders at all | Blocking their email patterns at checkout, plus a cleanup. See below |
Most stores get more than one type. Start with whichever is costing you money: chargebacks first, then wasted shipping.
How to check a suspicious order in Shopify
Before you cancel anything, look at what Shopify already knows. Every eligible online card order gets a fraud analysis, and it's more useful than most merchants realise.
- 1Open the order and find the Order risk section.
- 2Read the recommendation. Shopify rates the order low, medium or high risk, with advice such as "Confirm with the customer before fulfilling" or "Consider canceling this order." Medium and high-risk orders also get a warning symbol in your Orders list.
- 3Open the risk evaluation for the detail behind it: whether the billing address (AVS) and card security code (CVV) checks passed, whether the customer's location matches the card, and whether more than one card was tried.
- 4Look at the IP address listed there. A proxy or hosting company address on a first-time order is a warning sign.
- 5If you're still unsure, email the customer before fulfilling. Real buyers usually reply quickly; fraudsters usually don't.
Don't judge an order on a single indicator. Shopify itself says indicators don't represent the order's overall risk. Fraud recommendations need the Grow plan or higher, or Shopify Payments; the individual indicators are on Basic and up.
How to stop them with Ongoing Defender
Checking orders one by one deals with today's problem. Blocking at checkout stops the same person coming back tomorrow, before an order or a payment exists.
- 1Install Ongoing Defender and turn on Checkout rules. Shopify asks you to approve checkout permissions the first time.
- 2Switch on Block disposable email addresses. It blocks about 50 well-known throwaway inbox services, such as Mailinator and 10 Minute Mail, which bots and card testers rely on.
- 3Turn on Stop repeated checkout attempts. After 5 checkouts with the same email, phone or street address within 60 minutes, that detail is blocked automatically. You can change both numbers.
- 4For each confirmed fake order, block the details behind it. Search for the customer and block their account, email and phone in one click, or use Block at checkout on their page in Shopify admin. Add the shipping address too, since fraudsters change emails far more often than addresses.
- 5If the orders come from an email domain the fraudster owns, block the whole domain instead of each address.
- 6Before you finish, enter a real customer's details in Test a checkout to make sure none of your rules would catch them.
Blocked buyers see no payment or shipping options, just your message, which never says which rule matched. Rules run on Shopify's own servers for every checkout, including Shop Pay, Apple Pay and Google Pay, so bots that skip your storefront are stopped too.
What to do with fake orders already placed
- Don't fulfil until the risk analysis has finished. Shipping a fraudulent order is what turns it into a chargeback you lose, along with the goods.
- Cancel and refund orders you're sure are fake. Refunding a stolen-card order before the cardholder disputes it usually avoids a chargeback and its fee.
- Restock the items when you cancel, so they go back on sale.
- Block the details straight away, so the same person can't try again with the next order.
- During a wave of fake orders, consider switching to manual payment capture. You only take payment after checking each order, so nothing is charged to stolen cards you'd later refund.
If a real customer gets caught by Shopify's own temporary IP block, create a draft order and send them an invoice. Shopify's block usually lifts within a day and can't be removed sooner.
What about fake customer accounts?
Since early 2026, many merchants have reported bots creating thousands of customer accounts that never order, often reusing the same handful of fake names. These bots call Shopify's account sign-up directly, so they don't show up as orders at all, just as clutter in your customer list.
Shopify support has told merchants it can't block them at the store level. To clear them out, create a customer segment of accounts with zero orders, review it, and bulk delete. Shopify Flow can tag new zero-order accounts for a weekly review.
Spot a pattern in their emails or domains? Block it in Ongoing Defender, and none of those accounts can ever place an order.
Why Ongoing Defender instead of Shopify's built-in tools
Shopify gives you good information about risky orders. What it doesn't give you is a simple way to stop the same people coming back. That's the gap Defender fills.
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Block a known fraudster before they can order | Fraud Control rules, for Shopify Payments stores only | Any payment provider, on any paid plan |
| Stop orders from throwaway email inboxes | Not built in | One switch blocks about 50 well-known services |
| Stop card testers | Temporary IP blocks that usually lift within a day | Repeated details blocked automatically until you remove them |
| Hide every payment method from a blocked buyer, including Shop Pay and Apple Pay | Needs an app | Automatic |
| Act on an order you've already spotted | Flow can cancel it after it's placed | Block the buyer so the next order never happens |
| Check a rule won't catch a real customer | Not built in | Test a checkout with any details first |
Tips for best results
- Block the email, phone and shipping address together. Fraudsters change emails far more often than addresses or phone numbers.
- Add throwaway email domains as you spot them, on top of the built-in list.
- During a wave of fake orders, tighten the repeated-attempt limit, for example to 3 checkouts in 30 minutes, then relax it once things calm down.
- For fake cash-on-delivery orders, block the phone number and address. They stay the same when the name changes.
- Look over the rules marked Added automatically now and then, and remove any you don't need.
Related guides