Shopify bot signups: review before deleting customers

Merchants reporting a surge in fake Shopify customer accounts and newsletter signups have an immediate housekeeping problem: separating suspicious profiles from real people before the next campaign. A merchant report on r/shopify describes hundreds of daily signups and says hCaptcha has not stopped them. It also quotes a support explanation about a platform change. That quotation is a merchant’s account, not a public Shopify incident confirmation.

Start with the entry point

Shopify’s Help Centre says hCaptcha is enabled by default and covers contact, newsletter and comment forms, as well as login, account creation and password recovery pages. Check the spam protection settings in Online Store, Preferences. A setting being enabled is not proof that every signup reaching your email platform came through a protected Shopify form.

Klaviyo’s list bombing guidance, updated 20 October, describes submissions arriving through forms, checkout activity and integrations. Bots can submit real people’s addresses as well as invalid ones. Sending to those profiles can produce complaints and damage deliverability even when an address does not bounce.

Double opt in helps, but is not a universal block

Klaviyo requires confirmation before adding subscribers to a double opt in list. Check each affected list’s settings rather than assuming the default still applies. This reduces unconfirmed subscriptions; it does not prevent every malicious submission or eliminate all customer records.

Review a suspicious segment before suppression

Klaviyo recommends grouping profiles by evidence tied to the attack, such as entry point, time window, domain or a honeypot signal, then reviewing them before suppression. Suppressed profiles remain in the account. Email suppression does not stop SMS or push notifications.

Our recommendation is to avoid a blanket rule based on a common name or zero orders. A person who has not bought yet can still be a legitimate subscriber. Keep a record of the selection criteria and inspect a sample before taking action. Review automated welcome and abandoned checkout journeys as well as scheduled campaigns, because the problem is not confined to a single mailing list.

DTC Ops discusses reported bot signups, 22 October 2026

Read the original discussion if the embed does not load. It is practitioner commentary, not a Shopify platform incident report. We have not independently verified the thread’s claimed deliverability improvement.

For support, prepare dates, the affected form or integration, examples of the pattern and the controls already checked. Share customer information only through the provider’s appropriate private support channel. Preserve the evidence needed to distinguish a failed form defence from a separate integration or checkout route.