You found the fake checkout, copied the email address, and blocked it. The next one arrived an hour later under a different email, with the same street address and the same phone number. That is not bad luck. It is how the bots are built.
CartWatch compared 101,710 flagged Shopify checkouts with 56,697 real ones across 322 stores over the 90 days ending 15 October 2026. At the typical store, 98.6% of flagged checkouts arrived with an email address that no other flagged checkout on that store had used. The full study is How Shopify Checkout Bots Rotate Emails, Names and Addresses.
What an email blocklist actually catches
A blocklist can only hold addresses you have already seen. So the question is how often a bot comes back with one you have.
At the typical store, about one flagged checkout in seventy. On 87 of the 113 stores CartWatch read in full with at least 50 flagged checkouts, 90% or more of flagged checkouts carried an email used exactly once. Across all 60,374 flagged checkouts on the 241 fully read stores there were 49,161 distinct emails. To cover half of those checkouts you would need 18,974 addresses on the list.
And every one of them would be added after the fact. The checkout that taught you the address has already been written to Orders → Abandoned checkouts, already been sent a recovery email if you have that on, and already become a profile in Klaviyo, Omnisend, or whatever your store syncs to. Blocking the address prevents a repeat that, on most stores, was never coming.
Compare the shoppers. On the same stores, 92.8% of non-flagged checkouts also had a one-off email, and the 7% who repeated did it on every field at once, which is what a returning customer or a second attempt looks like. An email that comes back is a weak sign of a bot. It is more often a person.
Blocking a domain does not work either
The next move most merchants try is blocking a whole provider. The data does not support it.
| Email provider | Flagged | Not flagged |
|---|---|---|
| Outlook, Hotmail, Live, MSN | 29% | 11% |
| Gmail | 17% | 55% |
| Yahoo | 12% | 11% |
| Proton | 12% | 0.3% |
| iCloud | 8% | 4% |
| AOL | 5% | 3% |
| Yandex | 3% | 0% |
| Everything else | 13% | 16% |
Bots use the providers your customers use. 94% of flagged emails were on a mainstream free provider, against 84% of shopper emails. Disposable domains, the Mailinators of the world, were 0.3% of flagged checkouts. Blocking them changes nothing.
Proton and Yandex are the exception: in this data they are almost always a bot. But together they are 15% of flagged checkouts, and the Proton users you do have are real customers who chose a privacy mailbox. Blocking them trades a small cut in spam for a certain cut in orders. Flagged emails were spread across 188 domains; shoppers across 4,613. There is no domain you can block that catches bots without catching people, and none that catches most of the bots.
Blocking a pattern does not work
The addresses do have a shape. Among flagged checkouts, 47% put the name from the checkout into the email with digits after it (emma.wilson4821@), 26% had a run of four or more digits, and 50% had a dot in the local part. The trouble is the second column: 25%, 10%, and 18% of real shoppers’ emails look the same way. firstname.lastname1987@gmail.com is how a lot of people write their email. A rule that blocks it blocks them.
This is also why CartWatch’s own blacklist is exact-match only. A fragment rule like outlook.com or smith would refuse real customers by the hundred.
What the bots do not change
The email rotates because it is free to rotate. The rest of the identity does not.
| Share of checkouts with a value used only once on that store | Flagged | Not flagged |
|---|---|---|
| Email address | 98.6% | 92.8% |
| Name | 59.1% | 92.4% |
| Street address | 23.7% | 93.5% |
| Phone number | 20.4% | 93.3% |
Across the fully read stores, eleven street addresses account for half of all flagged checkouts. Five phone numbers account for half. 68% of flagged checkouts shipped to an address that other flagged checkouts on the same store had used with a different email, against 2.2% of shoppers. Among addresses used five or more times, the median address had a different email on every single use.
They stay, too. 85% of flagged checkouts on a repeated address sat on one still in use 30 or more days after it first appeared. And they travel: 70% of flagged checkouts with an address used one that also appeared on another store, and 51% used one seen on ten or more. One real Manhattan street address appeared on 113 stores and 15,176 flagged checkouts, under 15,144 different emails and 13 names.
So the thing worth blocking is the address or the phone, not the email. That comes with its own problem. A street address is shared by a household. A phone number is shared by a family. 123 Main St shows up on real test orders. A merchant blocking addresses by hand will, sooner or later, block a real customer and never hear about it. The values that repeat are the values that collide.
Where an email blocklist still earns its place
None of this makes the blocklist useless. It is the right tool for a narrow job.
- A repeat address you have already seen place fake orders. Some bots do reuse the whole identity. On 17 of the 113 stores, a quarter or more of flagged checkouts shared an email with another one. On those stores a list of twenty addresses does real work.
- A slow-rotating actor. One farm in the study cycled the same hundred emails across the same addresses and names for months, on more than 30 stores. Each of those emails is worth listing.
- An address you want refused regardless of score. A chargeback, a known fraudster, or a shopper who keeps ordering free samples.
CartWatch’s Blacklist page does this on every plan. An address on it is always flagged, tagged, and suppressed in your connected email provider, and, with payment blocking on (Standard and above), refused when it attempts payment. Matching is exact, the list holds 100 addresses, and the whitelist wins if an address is on both. What it will not do is get ahead of a bot that invents a new email per checkout, which is most of them.
What works instead
The record behind the email did not rotate, so score the record. CartWatch scores every checkout on the whole thing: how the email is built, whether the address verifies, the network it came from, whether it showed any storefront session, and whether the same address, phone, or name has been seen on confirmed bots before, on your store or across the CartWatch network. No single field decides it, which is what lets it see past the one field the bot changed.
Then act on the score rather than on a list you maintain:
- Tag the customer and suppress the email in Klaviyo, Omnisend, Mailchimp, Drip, Brevo, and other connected providers (Starter and above), so a one-off email never becomes a profile you pay for or a welcome flow you send.
- Refuse the payment when a flagged checkout attempts it (Standard and above), so the store stops being useful for card testing.
- Delete the customer record of very-high-risk bots if you turn that on (Standard and above).
Shopify still writes the abandoned checkout. No app can stop that or delete it afterwards. What changes is what happens next: nothing reaches your email provider, nothing reaches your payment processor, and the row sits in a list you no longer need to read, because the Human checkouts tab in CartWatch is the clean one.
A lot of these checkouts never load your theme, so a storefront IP or country blocker does not meet them either. What those tools do and do not stop is in How to Block Countries on Shopify. How bots reach checkout without a storefront session is in How Shopify Checkout Bots Actually Behave.
These figures are stores running CartWatch, not Shopify as a whole. Stores usually install CartWatch because the abandoned checkout list already looks wrong.
FAQ
Can I block an email address from checking out on Shopify? Shopify has no built-in setting for it. Shopify’s free Fraud Control app and third-party apps, including CartWatch’s Blacklist, can refuse a checkout or its payment for an exact address. The checkout record is still created, and the bot’s next checkout will almost certainly use a different email.
How many bot emails repeat? At the typical CartWatch store, 1.4% of flagged checkouts used an email that another flagged checkout there had used. Across 60,374 flagged checkouts on 241 stores there were 49,161 distinct emails.
Should I block Gmail, Outlook, or Proton addresses? No. Gmail is 55% of real shoppers’ emails and the Outlook family is 11%. Proton and Yandex are nearly always bots in this data but only 15% of them, and blocking them loses real privacy-minded customers.
Do bots use disposable email domains? Rarely. 0.3% of flagged checkouts used a disposable domain. 94% used a mainstream free provider.
What do bots reuse if not the email? The street address, the phone number, and often the name. Eleven addresses covered half of flagged checkouts on the fully read stores, and five phone numbers covered half. 70% of flagged checkouts with an address used one that also appeared on another store.
Why not block addresses and phones instead?
Because they collide with real customers. A household shares an address, a family shares a phone, and 123 Main St appears on real test orders. Scoring the whole record, with the repeated address as one signal among several, catches the bot without a hand-kept list that eventually blocks a person.
CartWatch scores Shopify checkouts as they arrive. On the Starter plan and above, it can tag the customer and keep the address out of Klaviyo, Omnisend, Mailchimp, Drip, and Brevo. On the Standard plan, payment blocking blocks bots from attempting payment. Install CartWatch from the Shopify App Store.