Why do I have so many fake customers on Shopify?

Usually bots submitting your account, contact or newsletter forms. Check that hCaptcha is on in Online Store > Preferences and that any custom forms still trigger it.

Does hCaptcha protect the Shopify newsletter form?

Yes, when the form is recognised: Shopify's CAPTCHA covers forms posting to /contact with form_type contact or customer, and Shopify's Liquid form tags output those attributes by default.

Can I delete fake customers in bulk?

Yes. Select them in Customers and choose Delete customers. Profiles that are not eligible, such as customers with orders, are kept.

Should I use a third-party CAPTCHA app on Shopify?

Shopify says hCaptcha isn't compatible with custom code or apps that add CAPTCHA, and recommends removing them so hCaptcha works for your customers.

Do Shopify customer accounts stop bot sign-ups?

They make them harder. Customer accounts sign in with a one-time 6-digit code sent to the email address, with no password, and Shopify notes their verification does not need hCaptcha.

— Fraud and bots on Shopify · Guide

How to stop fake customer accounts and spam sign-ups on Shopify

Published 27 October 2026 · Sources read 27 October 2026 · General information, not legal advice

Short answer

Make sure hCaptcha is on in Online Store > Preferences, since it protects customer account, contact and newsletter forms and is on by default.^[1]^[2] Check that custom forms in your theme still trigger it,^[2] consider Shopify's customer accounts with one-time codes,^[3] then review and delete the fake profiles in bulk.^[4]

Why bots sign up to your store

Fake sign-ups are a common complaint from Shopify merchants: a burst of new customer profiles or newsletter subscribers with random names, throwaway email addresses or links in the name field. Bots fill in any public form they can find, and a store has several: account registration, login, password recovery, the contact form and the newsletter sign-up.^[2]

Why it matters even when no order is placed:

Your customer list and reports fill with records that are not people, which makes real growth harder to read.
Marketing emails go to addresses nobody reads, and spam links in names can end up in your own emails.
Shopify recommends keeping hCaptcha active precisely to limit spam bot activity on contact and comment forms and customer account pages.^[5]

How to recognise bot sign-ups

Many new customers in a short period, often at odd hours, with no orders.
Names that are random strings, the same name repeated, or URLs and promotional text in the first or last name.
Email addresses from disposable domains, or long runs of similar addresses.
A jump in traffic or form submissions you cannot match to any campaign. Shopify suggests watching Shopify analytics or Google Analytics for spikes and patterns that might indicate bots.^[5]

Rule out innocent causes before you delete anything. Shopify notes that a spike can also come from an integration migrating customer records, from publicity you did not expect, or from hCaptcha having been turned off.^[6]

Step 1: Make sure hCaptcha is on and working

Shopify uses hCaptcha to analyse visitor behaviour and block spam from bots, and it is activated by default on all Shopify stores.^[1] When it is unsure about a visitor it can show an interactive challenge, or return a "CAPTCHA failed" error when it is very sure the visitor is not human.^[1]

1
Open your preferences
From your Shopify admin, go to Online Store > Preferences and find the hCaptcha settings.^[1]
2
Turn it on for every form
Make sure hCaptcha is active for customer login, account creation and password recovery, and for contact and comment forms.^[1]^[5]
3
Remove other CAPTCHA add-ons
Shopify says hCaptcha isn't compatible with custom code or third-party apps that add CAPTCHA, and recommends removing them so hCaptcha works.^[1]

Step 2: Check that your theme's forms are covered

hCaptcha only protects the forms it can recognise. The code for it arrives through the theme's content_for_header object, so a theme that leaves that out has no CAPTCHA at all.^[2] Forms are recognised by their action attribute and a hidden form_type input:^[2]

customer forms post to a URL containing /account, with form_type customer_login, create_customer or recover_customer_password;
contact and newsletter forms post to /contact, with form_type contact or customer;
blog comment forms post to /blogs, with form_type new_comment.

Shopify's Liquid form tags output these attributes by default.^[2] The risk is a hand-built form, a page-builder section or an app's pop-up that posts somewhere else. Ask whoever built it to check those attributes, or test the form yourself and see whether the hCaptcha notice appears when you start typing.^[2]

Step 3: Consider Shopify's customer accounts

Shopify now offers customer accounts with passwordless sign-in: the customer enters an email address and receives a one-time 6-digit code.^[3] Shopify recommends upgrading to customer accounts as one way to keep login protected, and notes their verification process does not need hCaptcha.^[1] Because each sign-in needs access to the inbox, the account form is a less attractive target for scripts than a plain registration form.

Legacy accounts still work. If you keep them, Shopify asks you to make sure your theme uses the current hCaptcha set-up, since the old /challenge page was deprecated.^[1]

Step 4: Clean up the fake profiles safely

1
Filter first
Filter the customer list to the period of the attack and to customers with no orders, then read a sample to make sure they really are fake.
2
Export a copy
Export the filtered list before deleting, so you have a record and can restore anyone removed by mistake.
3
Delete in bulk
In Customers, select the profiles and choose Delete customers from the bulk actions. Shopify deletes only eligible profiles; customers with orders, among others, are kept.^[4]
4
Automate it if it keeps happening
Shopify Flow has a Delete customer action, so a workflow can remove profiles that match a pattern you are confident about.^[7] Start with a tag-only workflow and review what it would remove before letting it delete.

Keeping it from coming back

Update your theme and apps regularly; Shopify lists this among its own steps for reducing bot impact.^[5]
After installing any app that adds a pop-up, sign-up form or quiz, test that form for the hCaptcha notice, because its form may not be one hCaptcha recognises.^[2]
Check new customers weekly for a few weeks after an attack, so a new wave is caught early.
Make sure the staff who manage the store know what bot activity looks like; Shopify recommends educating staff for the same reason.^[5]
Keep your marketing lists for people who confirmed them, so a burst of fake sign-ups does not reach your email campaigns.

When fake accounts start placing orders

Fake accounts are sometimes the first step of something more expensive, such as orders paid with stolen cards. Shopify's fraud analysis gives eligible orders a low, medium or high risk recommendation,^[8] and our guide to stopping card testing on Shopify covers what to do when the orders arrive.

Where Estre fits

Estre, a Shopify app from the same company as this site, flags bot sign-ups by the patterns described above: random names, throwaway email, spam links and bursts.^[9] Every flag is explained in plain words, and its watch mode shows what Estre would do before it changes anything.^[9] Paid plans add bulk clean-up of bot accounts and hold risky orders until you Approve or Block them.^[9]

Read more on the Estre page and on Shopify bot security.

Questions

Why do I have so many fake customers on Shopify?: Usually bots submitting your account, contact or newsletter forms. Check that hCaptcha is on in Online Store > Preferences and that any custom forms still trigger it.^[1]^[2]
Does hCaptcha protect the Shopify newsletter form?: Yes, when the form is recognised: Shopify's CAPTCHA covers forms posting to /contact with form_type contact or customer, and Shopify's Liquid form tags output those attributes by default.^[2]
Can I delete fake customers in bulk?: Yes. Select them in Customers and choose Delete customers. Profiles that are not eligible, such as customers with orders, are kept.^[4]
Should I use a third-party CAPTCHA app on Shopify?: Shopify says hCaptcha isn't compatible with custom code or apps that add CAPTCHA, and recommends removing them so hCaptcha works for your customers.^[1]
Do Shopify customer accounts stop bot sign-ups?: They make them harder. Customer accounts sign in with a one-time 6-digit code sent to the email address, with no password,^[3] and Shopify notes their verification does not need hCaptcha.^[1]

Flag bot sign-ups as they happen

Estre flags bot sign-ups and risky orders on Shopify and explains every flag. The Free plan judges 100 orders a month; paid plans start at $14.99 a month with a 7-day free trial.

See Estre on the Shopify App Store

Disclosure: Estre is made by Misimi Corp, which also makes Shaewoo and publishes this site.

Sources

Every fact in this guide links to one of these, read on 27 October 2026. Estre is named only where it is relevant; nothing here is a review, a rating or a promise about results.