How to find and delete fake bot customers on Shopify

Why do bots create customer accounts on my store?

• Card testing. Each bot checkout can leave a customer record behind, often with a real person's stolen email.
• Signup and newsletter forms. Bots fill unprotected forms, sometimes to collect discount codes they post on coupon sites.
• List bombing. Attackers flood signup forms with real people's emails, which then get your marketing emails and mark them as spam (Klaviyo Help Center).

How can I tell a bot customer from a real one?

• Zero orders, and created in a batch minutes apart from others like it.
• A placeholder name (John Doe, Test Test), or a first and last name that repeat the email.
• A disposable email domain (such as mailinator.com or yopmail.com) or a random string of letters.
• The same address or phone number shared by many different names.
• Subscribed to email marketing but never opened an email.

Zero orders alone doesn't make a bot: newsletter subscribers and new shoppers also have no orders. Look for two or more signs together.

How do I delete fake customers in bulk in Shopify?

1. In your Shopify admin, go to Customers.
2. Filter to customers with no orders, created during the attack window. Sort by date created so the batches stand out.
3. Export the filtered list as a CSV first. Deleting is permanent, and the export is your backup.
4. Select the bot accounts and choose Delete customers from the bulk actions.

Shopify won't delete a customer who has orders, a pending GDPR erasure, an undelivered scheduled gift card, or who ever had a subscription. In a bulk delete, only the profiles that can be deleted are deleted, and the rest stay in your list (Shopify Help Center).

Do I also need to remove them from Klaviyo?

Yes. Deleting a customer in Shopify doesn't remove the profile from Klaviyo, and active profiles count toward your Klaviyo plan. Klaviyo says it doesn't charge for suppressed profiles (Klaviyo Help Center), so suppress the bot profiles in Klaviyo before you delete them in Shopify, while you can still match them by email. See how to stop bot signups in Klaviyo.

Can I automate it with Shopify Flow?

Shopify Flow has a Delete customer action (source). It deletes whatever your conditions match, so test the conditions on a tag first (for example, tag instead of delete for a week) and keep a backup.

How do I stop new bot accounts?

• Keep hCaptcha on. It's on by default for contact, newsletter and comment forms, and for legacy customer account pages (source).
• Keep double opt-in on in Klaviyo, so only people who confirm get on your list (source).
• Stop the bot checkouts that create them. If the accounts come from card testing, see how to stop card testing.

How does Linesman clean up fake customers?

• Finds them. The Bot Receipt scores the customers created in the last 90 days who have no orders, and groups them into Bots, Likely bots and Protected.
• Backs them up. Download a CSV of your selection before anything changes.
• Deletes or tags them. Delete them, or tag them linesman:bot if you'd rather review them in Shopify. Customers with orders or the linesman:allow tag are always skipped.
• Suppresses them in Klaviyo first (Pro), so they stop counting toward your Klaviyo bill.
• Keeps new ones out (Pro, optional): new bot signups are tagged right away and deleted after 24 hours if they still have no orders.

The Free plan deletes up to 250 bot customers a month and tags any number. Pro has no limit.

Frequently asked questions