I'm having trouble with fake orders!

Hi @Bandit - are they actually placing orders or just starting checkout?

A number of my clients have had the same issue with bot sign ups, so we have implemented reCAPTCHA on their Shopify store (link below) and also made our Klaviyo lists double opt in.

Info on bot list bombing: https://help.klaviyo.com/hc/en-us/articles/9890182538011

Turn on reCAPTCHA in Shopify: https://help.shopify.com/en/manual/online-store/setting-up/preferences

Additional tip: if you did have bot signups to your list, a common pattern is the emails will contain a + sign. Create a segment with the following rule: 

Properties about someone - email contains: +

Then you can delete all members of this segment to keep your account clean. Info on how to delete members of a segment here: https://help.klaviyo.com/hc/en-us/articles/24312135764251

Thanks for your comment.

Only checkouts attempts so so far.

Recapcha is active for shopify but as you know Klavyio does not have this option and double opt in is active.

I can activate the filter you describe for bots but this does not stop them from doing the above.

In my case a bot has subscribed with a “legitimate” name. 

I suspect the bot might be testing stolen credit card details?

Any thoughts on this?

Thank you Bluesnapper, this is indeed valuable information to keep in mind. 

Johnsmith is something I was not aware of. 👈👍

I noticed one of the users mentioned to delete the spam bots, I think it is more efficient to suppress these accounts. Deleting the accounts from the list still gives the bots from the original email address a chance to resubscribe and enter the list at a later point. I created a segment using the unengaged segment method, exported the csv. I had a list of a bout 250 email address. many of which contained the “+” character as mentioned. I isolated these from the email addresses that was actually customers by deleting the real customers from the list and reimported the csv back into klaviyo. once i reimported the list it was about 120 bot accounts i manually suppressed the whole list. this is my workaround for bot accounts. I will do this every 30 days or so to clean my list and improve deliverability. 

We too have abandoned carts with the email johnsmith005@storebotmail.joonix.net (+ about 100 other variations)  I have suppressed all of them but as someone mentioned that doesn’t matter, they will keep coming back...I am wondering if anyone can answer if this will mess up our search rankings,  filing us to spam folders etc… I am concerned this will affect our visibility and sales...or is this harmless and will help our google feed… 

Supposedly, the John Smith bots are from google and they don’t want you to automatically block them. 

John Smith Checkout Abandonment Are Google’s Validation Bot | FeedArmy Co., Ltd.

Reading through another forum: 

‎12-05-2024 11:01 AM

Googles bots are John Smith with gmail address. Not Joonix.net. Joonix is a web and software company interested in selling security and whatnot to web site owners. Their methods make me raise my eyebrow! Joonix.net is owned by Markmonitor.com. The Joonix site seems to just be a 404. While the Markmonitor is selling services to website owners/managers.  Shopify could stop all of it with a simple one line in their ht access file blocking that domain from even getting on the server. It appears to me they are attempting to spoof looking like Google bots.

Another post suggest:
manually transferring the NEW automatic email sign ups from your store to an excell spreadsheet into to a "dummy" audience so you can tilter the bot emails and them purge them before mailing. 

Good morning,
I’ve been reading your messages because I’m currently dealing with the same issue on my Klaviyo account.
Unlike what was mentioned earlier, in my case the BOT email addresses are no longer simple “John Smith” variations. Instead, they now appear as completely different addresses using seemingly legitimate names, and the domains also vary (@gmail, @aol, @outlook, etc.).

To explain better: from January to April 2024, the BOT activity on my account came exclusively from addresses like johnsmith005@storebotmail.joonix.net (with over 100 variations of this format). After April 2024, this activity stopped. However, starting again in August 2025, the BOTs reappeared — but this time they are no longer using those fake “John Smith” emails. Instead, they are using what look like real addresses, for example:  hillwilson.669@yahoo.com, campbell311@hotmail.com, smith.white@aol.com, and so on.

This makes it much harder to identify and group them in order to suppress them all at once.
Has anyone experienced something similar? Do you know if these are still Google BOTs, or if they might come from another source? On my account I’ve already enabled double opt-in, but I would really prefer not to add reCAPTCHA to the checkout.

Hi ​@Giulia.gesca,

In situations like this, you’ll want to take a look at these bot profiles that are coming through to Klaviyo and see if they all share certain traits with each other. Do they all come from one location? Are they all taking very specific actions (starting a checkout for one specific product, then subscribing to the same list, and never opening any emails, ect)? Do they all share certain profile properties, like having the “Shopify Tags” property, but that property being empty?

It’s very likely that these bots all do share similarities like this, and you can create a segment with a number of conditions that work together to identify these bots. The more conditions you add that these bots share, the less likely it’ll be that you’ll catch real profiles in this. Once you create a segment like this, I’d recommend suppressing it periodically, so these profiles won’t count towards your active profiles, or be a risk to receive emails from you.